WO2021249055A1

WO2021249055A1 - Vpn rule matching method and apparatus, and device, and storage medium

Info

Publication number: WO2021249055A1
Application number: PCT/CN2021/090535
Authority: WO
Inventors: 余长林; 陈伟; 施晟; 曲鹏超
Original assignee: 中兴通讯股份有限公司
Priority date: 2020-06-08
Filing date: 2021-04-28
Publication date: 2021-12-16
Also published as: CN113839848A

Abstract

Disclosed in embodiments of the present application are a VPN rule matching method and apparatus, and a device, and a storage medium. The method comprises: receiving VPN rule entries; normalizing the VPN rule entries; configuring the normalized VPN rule entries; receiving an access request sent by a user terminal; extracting key information in the access request; and matching the key information with the configured VPN rule entries.

Description

VPN rule matching method, device, equipment and storage medium

Technical field

The present disclosure relates to the field of network communication technology, and in particular to a method, device, device, and storage medium for matching virtual private network rules.

Background technique

With the development of communication technology, the development of the Internet has promoted the development of virtual private networks (Virtual Private Network, VPN) based on the public network, which makes it possible to interconnect different departments of enterprises across regions through public networks. There is no need for enterprises to build networks repeatedly, which can save a lot of communication costs and funds. These new business requirements put forward higher performance requirements for VPN configuration and management.

In related technologies, the management platform sends VPN rules to different service modules through the interface layer, so that each service module can configure and manage the VPN rules according to specific policies. There is a large amount of information interaction between the interface layer and the business module, which seriously affects the configuration efficiency of VPN rules. In addition, the existing VPN matching rules all adopt the linked list model. When the VPN demand is not large and the number of matching entries is small, the linked list model basically meets the business needs. However, as business requirements increase, in the case of VPN rules of the order of 10K or more, the Hash table or linked list model cannot meet the requirements, which seriously affects work efficiency.

Summary of the invention

The embodiment of the application provides a method for matching VPN rules, including: receiving VPN rule entries; normalizing the VPN rule entries; configuring the normalized VPN rule entries; and receiving the VPN rule entries sent by the user terminal Access request; extract the key information in the access request; and match the key information with the configured VPN rule entry.

The embodiment of the present application also provides a VPN rule matching device, including: a VPN rule normalization processing module, configured to receive VPN rule entries, and perform normalization processing on the VPN rule entries; a VPN rule configuration module, Used to configure the normalized VPN rule entries; a key information extraction module, used to receive an access request sent by a user terminal, and extract key information in the access request; and a matching module, used to combine the key The information is matched with the configured VPN rule entries.

An embodiment of the present application also provides a communication device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor. The processor executes the computer program according to the embodiment of the present application. Matching method of VPN rules.

The embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the processor implements the VPN rule matching method according to the embodiment of the present application.

Description of the drawings

Fig. 1 is a flowchart of a VPN rule matching method according to an embodiment of the present application;

Figure 2 is a schematic structural diagram of a VPN rule matching device according to an embodiment of the present application;

Fig. 3 is a working principle diagram of a VPN rule matching device according to an embodiment of the present application;

as well as

Fig. 4 is a schematic structural diagram of a device according to an embodiment of the present application.

detailed description

In order to make the purpose, technical solutions, and advantages of the present application clearer, the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. It should be noted that the embodiments in this application and the features in the embodiments can be combined with each other arbitrarily if there is no conflict.

It should be understood that the embodiments described here are only used to explain the present disclosure, but not used to limit the present disclosure.

In the following description, the use of suffixes such as “module”, “part” or “unit” used to indicate elements is only for facilitating the description of the present disclosure, and has no special meaning in itself. Therefore, "module", "part" or "unit" can be used in a mixed manner.

Fig. 1 is a flowchart of a VPN rule matching method according to an embodiment of the present application. This method can be used to configure and match VPN rules, and can be executed by a matching device according to the VPN rules of this application.

As shown in Fig. 1, the VPN rule matching method according to the embodiment of the present application includes the following steps S110 to S160.

In step S110, a VPN rule entry is received.

In an embodiment, the VPN rule entry sent from the management platform may be received. The management platform can be a third-party platform that needs to create a VPN. Different management platforms can adopt different communication protocols and data structures. For example, the management platform may be the TR069 platform. A VPN rule entry may include a destination Internet Protocol (IP) address range, a destination Uniform Resource Locator (URL), and a source Media Access Control (Media Access Control, MAC) address.

In step S120, normalization processing is performed on the VPN rule entries.

In an embodiment, the communication protocol and/or data structure of the VPN rule entry may be normalized. Normalize different communication protocols to the same communication protocol, and normalize different data structures to the same data structure.

In the embodiment, different management platforms can dynamically send a large number of VPN rule entries. After receiving the VPN rule entries, the communication protocols and/or data structures of multiple VPN rule entries can be normalized to avoid This solves the problem of using different service modules to process VPN rule entries separately due to the different communication protocols and/or data structures of each management platform. In an embodiment, VPN rule entries from different management platforms can be processed uniformly. The normalization of VPN rule entries can shield the differences between management platforms, reduce the amount of exchanged data and the number of messages, and improve the configuration and processing efficiency of VPN rules.

In step S130, the normalized VPN rule entries are configured.

The process of configuring the VPN rule entry can be understood as the process of adding the VPN rule entry to the preset database. The preset database can be used to configure and manage VPN rule entries, including adding, deleting and querying VPN rule entries.

In an embodiment, the step of configuring the normalized VPN rule entry may be: judging whether the normalized VPN rule entry exists in the preset database; responding to the normalized VPN rule entry existing in In the preset database, the configuration success information is returned to the management platform; in response to the normalized VPN rule entry does not exist in the preset database, the normalized VPN rule entry is added to the preset database.

You can query the normalized VPN rule entry in the preset database. If you can find the same VPN rule entry as the normalized VPN rule entry (which corresponds to the received VPN rule entry), you can contact the management platform Return the successful configuration information; if you can't find it, you can add the normalized VPN rule entry to the preset database. That is, in an embodiment, the VPN rule entries stored in the preset database may be normalized VPN rule entries.

In an embodiment, the VPN rule entry may be a destination IP address range or a destination URL, and the step of adding the normalized VPN rule entry to the preset database may include: converting the normalized VPN rule entry into a range Tree (IntervalTree) structure; and adding the interval tree structure to the preset database.

The interval tree structure can be understood as a tree structure formed by the destination IP address interval. The interval tree structure may include multiple nodes, a root node, a child node, and a leaf node, and each node represents an address interval. The address range represented by the child node is a subset of the address range represented by its parent node. In an embodiment, the destination IP address may be stored in the preset database in the form of an interval tree structure.

Specifically, the destination IP address interval may be divided into multiple sub-intervals; the node position of each sub-interval is determined according to the IP address range corresponding to each sub-interval; and the interval tree structure is constructed according to the node position.

The relationship between any two sub-intervals in the multiple sub-intervals may include at least one of the following: an inclusive relationship or an empty set of intersection, that is, the address interval represented by the child node is a proper subset of the address interval represented by its parent node, and is in the interval The intersection between the address ranges represented by nodes at the same level of the tree structure is an empty set. Exemplarily, the destination IP address range is "1-100", and the divided sub-ranges may include "1-100", "1-50", "51-100", "1-30", and "31-50" , "51-80" and "81-100". The root node of the interval tree structure is "1-100", the root node contains two child nodes "1-50" and "51-100", and the child node "1-50" contains two leaf nodes "1-30" and " 31-50", the child node "51-100" contains two leaf nodes "51-80" and "81-100". After determining the node position corresponding to each subinterval, the interval tree structure can be established according to the node position.

Specifically, after the destination IP address interval is converted into an interval tree structure, if the converted interval tree structure is a branch of an existing interval tree structure, the converted interval tree structure can be added to the existing interval tree structure; If the converted interval tree structure is not a branch of the existing interval tree structure, you can add the converted interval tree structure as an independent interval tree structure to the preset database; if the converted interval tree structure is the same as the existing interval tree If the structure has a partial intersection, the existing interval tree structure can be adjusted according to the converted interval tree structure to obtain the adjusted interval tree structure.

In an embodiment, if the VPN rule entry is a destination URL, the destination URL can be converted into a destination IP address range, and the above process can be executed to convert the destination IP address range into an interval tree structure.

In an embodiment, the VPN rule entry may be the source MAC address, and the step of adding the normalized VPN rule entry to the preset database may include: converting the normalized VPN rule entry into a linked list structure; and The linked list structure is added to the preset database.

The linked list structure can be a hash (Hash) table. If the VPN rule entry is the source MAC address, the MAC address can be stored in the form of a linked list structure.

In step S140, an access request sent by the user terminal is received.

The user can be a user in the management platform, and the user can send an access request through a LAN port or a WLAN port.

In step S150, the key information in the access request is extracted.

The key information can be the destination IP address or MAC address.

In step S160, the key information is matched with the configured VPN rule entry.

If the key information belongs to the configured VPN rule entry, it is determined that the matching is successful, and the VPN channel is allocated to the user terminal, so that the user terminal can transmit data through the VPN channel.

In an embodiment, if the key information is a MAC address, the step of matching the key information with the configured VPN rule entry may include: querying the MAC address in the linked list structure. If the MAC address that is the same as the MAC address in the key information can be found, the match is successful; if it cannot be found, the match is unsuccessful.

In an embodiment, if the key information is the destination IP address, the step of matching the key information with the configured VPN rule entry may include: converting the destination IP address into a destination IP address range; and converting the converted destination IP address The interval is matched with the interval tree structure. If the converted destination IP address range belongs to the IP address range in the interval tree structure, the matching is successful. In this embodiment, the interval tree structure is used to match the user's access request, and it is not necessary to traverse all address intervals, which can improve the matching efficiency. Using interval tree structure instead of linked list structure can greatly increase the processing speed, and red-black tree technology can also be used to provide the best possible worst-case guarantee. Red-black trees can complete search, insertion, and deletion in O(log n) time, where n represents the number of elements in the interval tree structure, and in the same case, the linked list structure is about O(n) time-length complexity level.

The destination IP address can be converted into a destination IP address range in which both the start address and the end address are destination IP addresses. For example, the destination IP address is 5, and the converted destination IP address range is 5-5. When matching, first determine the corresponding interval tree structure according to the converted destination IP address interval, and then start a downward search from the root node of the determined interval tree structure. If a node that matches the converted destination IP address interval is found, The matching is successful. If no node matching the converted destination IP address range is found, the matching is unsuccessful.

In the embodiment, if the key information is successfully matched, it means that the user is a legitimate user, and a VPN channel can be allocated to the user, so that the user terminal of the user can transmit data through the VPN channel.

According to the embodiments of the present disclosure, the technology of interval overlap, red-black tree, and interval tree can be applied to solve the matching problem of VPN rule entries of optical network unit (ONU) gateways on the order of 10K or more, and the matching efficiency is improved.

According to the embodiment of the present disclosure, the VPN rule entries are normalized and then configured, which can reduce the amount of information exchange, thereby improving the configuration efficiency. In addition, matching the key information in the user's access request with the configured VPN rule entries can improve the matching efficiency.

In the embodiment, after the VPN channel is allocated to the user terminal, it is also possible to: collect behavior data of the user terminal; perform statistical analysis on the behavior data to obtain the analysis result; and perform at least one of the following operations according to the analysis result: adjust the user's priority Level, adjust the priority of the VPN channel and adjust the network bandwidth.

In the embodiment, the access request may be received from multiple user terminals. In this case, the key information may be matched with the configured VPN rule entry according to the priority of the user terminal corresponding to the key information. The matching can be performed in sequence from the highest priority of the user terminal to the last.

In an embodiment, the step of allocating the VPN channel to the user terminal may include: allocating the VPN channel to the user terminal according to the priority of the VPN channel, and allocating the adjusted network bandwidth to the VPN channel. The VPN channel with high priority can be allocated to the user terminal first, and the network bandwidth can be allocated to the VPN channel according to the adjusted network bandwidth.

Fig. 2 is a schematic structural diagram of a VPN rule matching device according to an embodiment of the present application.

As shown in FIG. 2, the VPN rule matching device according to the embodiment of the present application may include a VPN rule normalization processing module 210, a VPN rule configuration module 220, a key information extraction module 230, and a matching module 240.

The VPN rule normalization processing module 210 is configured to receive VPN rule entries and perform normalization processing on the VPN rule entries.

The VPN rule configuration module 220 is used to configure the normalized VPN rule entries.

The key information extraction module 230 is configured to receive the access request sent by the user terminal, and extract the key information in the access request.

The matching module 240 is used to match the key information with the configured VPN rule entries.

In an embodiment, the VPN rule normalization processing module 210 is configured to perform normalization processing on the communication protocol and/or data structure of the VPN rule entry.

In an embodiment, the VPN rule configuration module 220 is configured to: determine whether the normalized VPN rule entry exists in the preset database; in response to the normalized VPN rule entry existing in the preset database, return that the configuration is successful的信息; In response to the normalized VPN rule entry does not exist in the preset database, the normalized VPN rule entry is added to the preset database.

In an embodiment, the VPN rule entry may be a destination IP address range or a destination URL, and the VPN rule configuration module 220 is used to: convert the normalized VPN rule entry into an interval tree structure; and add the interval tree structure to the preset database.

In an embodiment, the VPN rule entry may be a destination IP address interval, and the VPN rule configuration module 220 may be used to: divide the destination IP address interval into multiple sub-intervals, and the relationship between any two sub-intervals in the multiple sub-intervals includes the following relationship One: the containment relationship or the intersection is an empty set; the node location of each sub-interval is determined according to the IP address range corresponding to each sub-interval; and the interval tree structure is constructed according to the node location.

In an embodiment, the VPN rule entry may be a destination URL, and the VPN rule configuration module 220 may be used to: convert the destination URL into a destination IP address interval; divide the destination IP address interval into multiple sub-intervals, and any two of the multiple sub-intervals The relationship between intervals includes one of the following relationships: an inclusion relationship or an empty set of intersection; determining the node position of each subinterval according to the IP address range corresponding to each subinterval; and constructing an interval tree structure according to the node position.

In an embodiment, the VPN rule entry may be a source MAC address, and the VPN rule configuration module 220 may be used to: convert the normalized VPN rule entry into a linked list structure; and add the linked list structure to the preset database.

In an embodiment, the key information may include a destination IP address, and the matching module 240 may be used to: convert the destination IP address into a destination IP address interval; and match the converted destination IP address interval with the interval tree structure.

In an embodiment, the VPN rule matching device may further include an allocation module, and in response to the key information belonging to the configured VPN rule entry, it is determined that the matching is successful, and the allocation module is used to allocate the VPN channel to the user terminal.

In an embodiment, the VPN rule matching device may further include: a behavior data analysis module for: collecting behavior data of the user terminal; performing statistical analysis on the behavior data to obtain an analysis result; and performing at least one of the following operations according to the analysis result : Adjust the priority of the user terminal, adjust the priority of the VPN channel, and adjust the network bandwidth.

In an embodiment, the VPN rule normalization processing module 210 receives access requests sent by multiple user terminals, and the matching module 240 may be used to compare the key information with the configured VPN rules according to the priority of the user terminal corresponding to the key information. The entries are matched.

In the embodiment, the matching module 240 may also be used to allocate a VPN channel to the user terminal according to the priority of the VPN channel, and to allocate an adjusted network bandwidth to the VPN channel.

Fig. 3 is a working principle diagram of a VPN rule matching device according to an embodiment of the present application.

As shown in Figure 3, multiple management platforms issue VPN rule entries through the communication module, and the VPN rule matching device can receive the VPN rule entries sent by the management platform, normalize the VPN rule entries, and perform normalization on the normalized VPN rule entries. VPN rule entries are configured. The user sends an access request, and the VPN rule matching device can extract the key information in the access request sent by the user, and match the key information with the configured VPN rule entry. If the matching is successful, that is, the key information belongs to the configured VPN rule entry, the VPN channel can be allocated to the user terminal, so that the user terminal can transmit data through the VPN channel.

As shown in FIG. 4, the device according to the embodiment of the present application includes: a processor 310 and a memory 320. The number of processors 310 may be one or more. One processor 310 is taken as an example in FIG. 4. The number of memories 320 may be one or more, and one memory 320 is taken as an example in FIG. 4. The processor 310 and the memory 320 may be connected by a bus or in other ways. The bus connection is taken as an example in FIG. 4. In an embodiment, the device may be a communication device.

As a computer-readable storage medium, the memory 320 can be configured to store software programs, computer-executable programs, and modules, such as program instructions/modules corresponding to the device in any embodiment of the present application. The memory 320 may include a program storage area and a data storage area, where the program storage area may store an operating system and an application program required by at least one function; the data storage area may store data created according to the use of the device, and the like. In addition, the memory 320 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state storage devices. In some examples, the memory 320 may further include a memory remotely provided with respect to the processor 310, and these remote memories may be connected to the device through a network. Examples of networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

The device provided above can be configured to execute the VPN rule matching method according to any embodiment of the present application, and have corresponding functions and effects.

The program stored in the corresponding memory 320 may be a program instruction/module corresponding to the signal processing method provided in the embodiment of the present application. The processor 310 executes the computer equipment by running the software program, instruction, and module stored in the memory 320. One or more functional applications and data processing, that is, a method for matching VPN rules according to any embodiment of the present application.

The embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the processor implements a method for matching VPN rules. The method includes: receiving VPN rule entries; The rule entries are normalized; the normalized VPN rule entries are configured; the access request sent by the user terminal is received; the key information in the access request is extracted; and the key information is matched with the configured VPN rule entry.

Those skilled in the art should understand that the term user terminal encompasses any suitable type of wireless user equipment, such as a mobile phone, a portable data processing device, a portable web browser, or a vehicle-mounted mobile station.

The various embodiments of the present application may be implemented in hardware or dedicated circuits, software, logic or any combination thereof. For example, some aspects may be implemented in hardware, and other aspects may be implemented in firmware or software that may be executed by a controller, microprocessor or other computing device, but the application is not limited thereto.

The embodiments of the present application may be implemented by executing computer program instructions by a data processor of a mobile device, for example, in a processor entity, or by hardware, or by a combination of software and hardware. Computer program instructions can be assembly instructions, instruction set architecture (Instruction Set Architecture, ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or written in any combination of one or more programming languages Source code or object code.

The block diagram of any logic flow in the drawings of the present application may represent program steps, or may represent interconnected logic circuits, modules, and functions, or may represent a combination of program steps and logic circuits, modules, and functions. The computer program can be stored on the memory. The memory can be of any type suitable for the local technical environment and can be implemented using any suitable data storage technology, such as but not limited to read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), optical Memory devices and systems (Digital Video Disc (DVD) or Compact Disk (CD)), etc. Computer-readable storage media may include non-transitory storage media. The data processor can be any type suitable for the local technical environment, such as but not limited to general-purpose computers, special-purpose computers, microprocessors, digital signal processors (Digital Signal Processing, DSP), application specific integrated circuits (ASICs) ), programmable logic devices (Field-Programmable Gate Array, FGPA), and processors based on multi-core processor architecture.

The above are only exemplary embodiments of the present application, and are not used to limit the protection scope of the present application.

By way of exemplary and non-limiting examples, a detailed description of the exemplary embodiments of the present application has been provided above. However, considering the accompanying drawings and claims, various modifications and adjustments to the above embodiments are obvious to those skilled in the art, but they do not deviate from the scope of the present disclosure. Therefore, the proper scope of the present disclosure will be determined according to the claims.

Claims

A method for matching VPN rules of a virtual private network, including:

Receive VPN rule entries;

Normalize the VPN rule entry;

Configure the normalized VPN rule entries;

Receive an access request sent by the user terminal;

Extract the key information in the access request; and

Match the key information with the configured VPN rule entry.
The method according to claim 1, wherein the step of normalizing the VPN rule entry comprises:

Normalize the communication protocol and/or data structure of the VPN rule entry.
The method according to claim 1, wherein the step of configuring the normalized VPN rule entry comprises:

Judging whether the normalized VPN rule entry exists in a preset database;

In response to the normalized VPN rule entry existing in the preset database, return information indicating that the configuration is successful;

In response to that the normalized VPN rule entry does not exist in the preset database, adding the normalized VPN rule entry to the preset database.
The method according to claim 3, wherein the VPN rule entry is a destination network interconnection protocol IP address range or a destination Uniform Resource Locator URL, and the normalized VPN rule entry is added to the preset The steps to set up a database include:

Converting the normalized VPN rule entries into an interval tree structure; and

Adding the interval tree structure to the preset database.
The method according to claim 4, wherein the VPN rule entry is the destination IP address range, and the step of converting the normalized VPN rule entry into the interval tree structure comprises:

Dividing the destination IP address interval into a plurality of sub-intervals, and the relationship between any two sub-intervals in the plurality of sub-intervals includes one of the following relationships: an inclusion relationship or an intersection is an empty set;

Determine the location of the node where each sub-interval is located according to the IP address range corresponding to each sub-interval; and

The interval tree structure is constructed according to the position of the node.
The method according to claim 4, wherein the VPN rule entry is the destination URL, and the step of converting the normalized VPN rule entry into the interval tree structure comprises:

Converting the destination URL into a destination IP address range;

Dividing the destination IP address interval into a plurality of sub-intervals, and the relationship between any two sub-intervals in the plurality of sub-intervals includes one of the following relationships: an inclusion relationship or an intersection is an empty set;

Determine the location of the node where each sub-interval is located according to the IP address range corresponding to each sub-interval; and

The interval tree structure is constructed according to the position of the node.
The method according to claim 3, wherein the VPN rule entry is a source media access control MAC address, and the step of adding the normalized VPN rule entry to the preset database comprises:

Converting the normalized VPN rule entries into a linked list structure; and

The linked list structure is added to the preset database.
The method according to claim 4, wherein the key information includes a destination IP address, and the step of matching the key information with the configured VPN rule entry comprises:

Converting the destination IP address into a destination IP address range; and

Match the converted destination IP address interval with the interval tree structure.
The method according to claim 1, further comprising:

In response to the key information belonging to the configured VPN rule entry, it is determined that the matching is successful; and

The VPN tunnel is allocated to the user terminal.
The method according to claim 9, further comprising,

Collecting behavior data of the user terminal;

Perform statistical analysis on the behavior data to obtain analysis results; and

Perform at least one of the following operations according to the analysis result:

Adjust the priority of the user terminal, adjust the priority of the VPN channel, and adjust the network bandwidth.
The method according to claim 10, wherein the step of receiving access requests sent by multiple user terminals and matching the key information with the configured VPN rule entry comprises:

The key information is matched with the configured VPN rule entry according to the priority of the user terminal corresponding to the key information.
The method according to claim 10, wherein the step of allocating a VPN tunnel to the user terminal comprises:

The VPN channel is allocated to the user terminal according to the priority of the VPN channel, and the adjusted network bandwidth is allocated to the VPN channel.
A VPN rule matching device, including:

The VPN rule normalization processing module is used to receive VPN rule entries and perform normalization processing on the VPN rule entries;

The VPN rule configuration module is used to configure the normalized VPN rule entries;

The key information extraction module is used to receive the access request sent by the user terminal, and extract the key information in the access request; and

The matching module is used to match the key information with the configured VPN rule entry.
A communication device, comprising a memory, a processor, and a computer program stored on the memory and capable of running on the processor, wherein the processor executes the computer program as described in any one of claims 1-12 The matching method of VPN rules.
A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the processor implements the VPN rule matching method according to any one of claims 1-12.