WO2022068484A1

WO2022068484A1 - Service chain address pool slicing method, device and system

Info

Publication number: WO2022068484A1
Application number: PCT/CN2021/114833
Authority: WO
Inventors: 葛昊
Original assignee: 中兴通讯股份有限公司
Priority date: 2020-09-30
Filing date: 2021-08-26
Publication date: 2022-04-07
Also published as: CN114363183A

Abstract

Embodiments of the present disclosure provide a service chain address pool slicing method, device and system. The method comprises: slicing an IPV6 address segment according to a slice granularity to obtain a plurality of address segment slices; and assigning corresponding firewalls to the plurality of address segment slices according to the number of firewalls to obtain address segment slice information comprising a corresponding relationship between the address segment slices and the firewalls, the address segment slice information being used by the firewalls to issue a first BGP dynamic route, the first BGP dynamic route being used by a router to acquire first routing information comprising the address segment slice information, and the first routing information being used by the router to forward service data. The present invention can solve the problem in the related art of since IPV6 addresses are sufficient, how to make service data of a user to access a network converge on each network element according to a user address. A service is forwarded by means of the routing information comprising the address segment slice information, so that service data of the same user can be converged to the same network element for processing.

Description

A service chain address pool slice processing method, device and system

CROSS-REFERENCE TO RELATED APPLICATIONS

The present disclosure is based on Chinese patent application CN202011063013.5 filed on September 30, 2020 with the title of “A Method, Device and System for Processing Address Pool Slices of a Service Chain”, and claims the priority of the patent application, which is incorporated by reference The disclosures are fully incorporated into this disclosure.

technical field

The embodiments of the present disclosure relate to the field of communications, and in particular, to a method, device, and system for processing a service chain address pool slice.

Background technique

Service Function Chaining (or Service Chain) technology is a forwarding technology that guides network service packets to pass through multiple service processing nodes (Service Function) in sequence. Fast and flexible entry and exit of the business chain.

Nowadays, the biggest problem of Internet Protocol Version 4 (Internet Protocol Version 4, referred to as IPV4) is the limited network address resources, which seriously restricts the application and development of the Internet. IPV6) is gradually replacing IPV4. There is also such a demand for business chains.

However, due to sufficient IPV6 addresses, Network Address Transform (NAT) translation is no longer required for internal and external networks. How to make the upstream and downstream traffic of users accessing the network converge on each network element according to the user address is the biggest problem. .

In the related art, due to the sufficient IPV6 addresses, no solution has been proposed yet for how to make the service data of the user accessing the network aggregated on the network element according to the user address.

SUMMARY OF THE INVENTION

Embodiments of the present disclosure provide a service chain address pool slice processing method, device, and system, to at least solve the problem in the related art of how to aggregate service data of users accessing the network on network elements according to user addresses due to sufficient IPv6 addresses.

According to an embodiment of the present disclosure, there is provided a service chain address pool slice processing method, which is applied to a gateway, and the method includes:

Perform slicing processing on the IPV6 address segment according to the slicing granularity to obtain multiple address segment slices;

Assign corresponding firewalls to the plurality of address segment slices according to the number of firewalls, and obtain address segment slice information, wherein the address segment slice information includes a correspondence between address segment slices and firewalls, and the address segment slice information is used for the The firewall publishes the first Border Gateway Protocol (Border Gateway Protocol, BGP for short) dynamic route, and the first BGP dynamic route is used by the router to obtain the first route information including the address segment slice information, and the first route information is used forwarding service data to the router.

According to another embodiment of the present disclosure, there is also provided a service chain address pool slice processing method, which is applied to a firewall, and the method includes:

Receive the address segment slice sent by the gateway, wherein the address segment slice is that the gateway performs slice processing on the IPV6 address segment according to the slice granularity, obtains multiple address segment slices, and allocates the multiple address segment slices according to the number of firewalls Obtained after the corresponding firewall, the address segment slice information includes the correspondence between the address segment slice and the firewall;

Advertise a first BGP dynamic route according to the address segment slice, wherein the first BGP dynamic route is used by the router to obtain first route information including the address segment slice information, and the first route information is used by the router Forward business data.

According to another embodiment of the present disclosure, there is also provided a service chain address pool slice processing device, which is applied to a gateway, and the device includes:

The first slice processing module is configured to perform slice processing on the IPV6 address segment according to the slice granularity to obtain a plurality of address segment slices;

The first allocation module is configured to allocate corresponding firewalls for the plurality of address segment slices according to the number of firewalls, and obtain address segment slice information, wherein the address segment slice information includes a correspondence between address segment slices and firewalls, and the address segment slices The segment slice information is used by the firewall to advertise the first BGP dynamic route, and the first BGP dynamic route is used by the router to obtain the first route information including the address segment slice information, and the first route information is used by the router Forward business data.

According to another embodiment of the present disclosure, there is also provided a service chain address pool slice processing device, which is applied to a firewall, and the device includes:

The receiving slice module is configured to receive the address segment slice sent by the gateway, wherein the address segment slice is that the gateway performs slice processing on the IPV6 address segment according to the slice granularity to obtain a plurality of address segment slices, and according to the number of firewalls Obtained after multiple address segment slices are assigned to corresponding firewalls, the address segment slice information includes the correspondence between address segment slices and firewalls;

A distribution module, configured to publish a first BGP dynamic route according to the address segment slice, wherein the first BGP dynamic route is used by a router to obtain first route information including the address segment slice information, and the first route information for the router to forward service data.

According to another embodiment of the present disclosure, there is also provided a service chain address pool slice processing system, the system at least includes: a gateway, a firewall, and a router, wherein,

The gateway is configured to perform slicing processing on the IPV6 address segment according to the slicing granularity to obtain multiple address segment slices, allocate corresponding firewalls to the multiple address segment slices according to the number of firewalls, and obtain address segment slice information, wherein the The address segment slice information includes the correspondence between address segment slices and firewalls;

the firewall, configured to publish the first BGP dynamic route according to the address segment slice information;

The router is configured to acquire first routing information including the address segment slice information according to the first BGP dynamic route, and forward service data according to the first routing information.

According to yet another embodiment of the present disclosure, there is also provided a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, wherein the computer program is configured to execute any one of the above methods when running steps in the examples.

According to yet another embodiment of the present disclosure, there is also provided an electronic device comprising a memory and a processor, wherein the memory stores a computer program, the processor is configured to run the computer program to execute any of the above Steps in Method Examples.

Description of drawings

1 is a block diagram of a hardware structure of a mobile terminal according to a method for processing a service chain address pool slice according to an embodiment of the present disclosure;

2 is a flowchart 1 of a method for processing service chain address pool slices according to an embodiment of the present disclosure;

3 is a second flowchart of a method for processing a service chain address pool slice according to an embodiment of the present disclosure;

4 is a block diagram of a service chain address pool slice processing system according to the present embodiment;

5 is a block diagram of a service chain address pool slice processing system according to the present preferred embodiment;

6 is a block diagram of a service chain address pool slicing system according to the present preferred embodiment;

FIG. 7 is a flowchart of address pool slice processing according to the present embodiment;

8 is a flowchart of incremental slicing processing performed by adding an address segment according to the present embodiment;

FIG. 9 is a flowchart of media stream processing of service chain according to the address segment according to the present embodiment;

10 is a block diagram 1 of a service chain address pool slice processing apparatus according to the present embodiment;

FIG. 11 is a second block diagram of an apparatus for processing a slice of a service chain address pool according to this embodiment.

Detailed ways

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings and in conjunction with the embodiments.

It should be noted that the terms "first", "second" and the like in the description and claims of the present disclosure and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific sequence or sequence.

The method embodiments provided in the embodiments of this application may be executed in a mobile terminal, a computer terminal, or a similar computing device. Taking running on a mobile terminal as an example, FIG. 1 is a block diagram of the hardware structure of a mobile terminal of a method for processing a service chain address pool slice according to an embodiment of the present disclosure. As shown in FIG. 1 , the mobile terminal may include one or more (in Only one is shown) a processor 102 (the processor 102 may include, but is not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data, wherein the above-mentioned mobile terminal may also include a Transmission device 106 and input and output device 108 for communication functions. Those of ordinary skill in the art can understand that the structure shown in FIG. 1 is only a schematic diagram, which does not limit the structure of the above-mentioned mobile terminal. For example, the mobile terminal may also include more or fewer components than those shown in FIG. 1 , or have a different configuration than that shown in FIG. 1 .

The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as computer programs corresponding to the data processing methods in the embodiments of the present disclosure. This function application and the business chain address pool slicing processing are implemented, that is, the above method is implemented. Memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory located remotely from the processor 102, and these remote memories may be connected to the mobile terminal through a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

Transmission means 106 are used to receive or transmit data via a network. The specific example of the above-mentioned network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, NIC for short), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (Radio Frequency, RF for short) module, which is used to communicate with the Internet in a wireless manner.

This embodiment provides a service chain address pool slicing processing method running on the above-mentioned mobile terminal or network architecture. FIG. 2 is a flow chart 1 of the service chain address pool slicing processing method according to an embodiment of the present disclosure, as shown in FIG. 2 As shown, applied to the gateway, the process includes the following steps:

Step S202, performing slicing processing on the IPV6 address segment according to the slicing granularity to obtain a plurality of address segment slices;

In one embodiment, before slicing the IPV6 address segment according to the slicing granularity to obtain multiple address segment slices, a slicing command is received, wherein the slicing command carries the slicing granularity, and the IPV6 address segment is obtained. With the number of firewalls, slicing is facilitated.

Step S204: Allocate corresponding firewalls to the multiple address segment slices according to the number of firewalls, and obtain address segment slice information, wherein the address segment slice information includes the correspondence between address segment slices and firewalls, and the address segment slice information uses Publishing a first BGP dynamic route on the firewall, where the first BGP dynamic route is used by the router to obtain first route information including the address segment slice information, and the first route information is used by the router to forward service data, The service data includes uplink service data and downlink service data, or uplink service traffic and downlink service traffic.

Through the above steps S202 to S204, the problem of how to make the service data of the user accessing the network aggregated on each network element according to the user address can be solved in the related art due to sufficient IPV6 addresses, and forwarding the service through the routing information including the address segment slice information , so that the service data of the same user can be aggregated into the same network element for processing.

In one embodiment, after slicing the IPV6 address segment according to the slicing granularity to obtain the plurality of address segment slices, the address segment slice information is stored in a database; the address segment slices are The information is sent to the network element and the firewall, where there are one or more network elements and one or more firewalls, and the network element and the firewall store the address segment slice information after receiving the information, so as to facilitate delayed forwarding of service data.

In one embodiment, after assigning corresponding firewalls to the plurality of address segment slices according to the number of firewalls, and obtaining address segment slice information, uplink service data is received, wherein the uplink service data carries an IPV6 address; The uplink service data is sent to the target network element, wherein if the next hop of the target network element is a firewall, the target network element is configured to send the uplink service data to the firewall according to the address segment slice .

In one embodiment, after assigning corresponding firewalls to the plurality of address segment slices according to the number of firewalls, and obtaining the address segment slice information, a notification message of IPV6 address segment change is received, wherein the IPV6 address segment The modification includes adding one or more IPV6 address segments and deleting part of the IPV6 address segments; performing slicing processing on the changed IPV6 address segment according to the slicing granularity to obtain multiple address segment slices after the change; The multiple address segment slices after the change are allocated to corresponding firewalls, and the changed address segment slice information is obtained, so that the address segment slice information can be updated in real time when the IPV6 address segment is added or deleted.

According to another embodiment of the present disclosure, a method for processing a slice of a service chain address pool is also provided. FIG. 3 is a second flowchart of the method for processing a slice of a service chain address pool according to an embodiment of the present disclosure. As shown in FIG. 3 , the application For firewalls, the process includes the following steps:

Step S302: Receive an address segment slice sent by the gateway, wherein the address segment slice is that the gateway performs slice processing on the IPV6 address segment according to the slice granularity, and obtains multiple address segment slices, which are divided into the multiple addresses according to the number of firewalls. Obtained after the segment slice is allocated to the corresponding firewall, the address segment slice information includes the correspondence between the address segment slice and the firewall;

Step S304: Publish a first BGP dynamic route according to the address segment slice, where the first BGP dynamic route is used by a router to obtain first route information including the address segment slice information, and the first route information is used for The router forwards the service data.

Through the above steps S302 to S304, the problem of how to make the service data of the user accessing the network aggregated on each network element according to the user address can be solved in the related art because the IPV6 address is sufficient, and the service is forwarded through the routing information including the address segment slice information. , so that the service data of the same user can be aggregated into the same network element for processing.

In an embodiment, after the first BGP dynamic route is advertised according to the address segment slice, the uplink service data forwarded by the last-hop target network element according to the address segment slice is received, and the uplink service data is forwarded according to the address segment slice. The data is sent to a router, wherein the router forwards the upstream service traffic according to the first routing information.

In an embodiment, after the first BGP dynamic route is published according to the address segment slice, the downlink service data forwarded by the router according to the first routing information is received, and the address segment slice is forwarded according to the address segment slice. Downlink business data.

According to another embodiment of the present disclosure, a service chain address pool slice processing system is also provided. FIG. 4 is a block diagram of the service chain address pool slice processing system according to this embodiment. As shown in FIG. 4 , the system at least Including: gateway 42, firewall 44, router 46, among which,

The gateway 42 is configured to perform slicing processing on the IPV6 address segment according to the slicing granularity to obtain multiple address segment slices, allocate corresponding firewalls to the multiple address segment slices according to the number of firewalls, and obtain address segment slice information, wherein the The address segment slice information includes the correspondence between address segment slices and firewalls;

The firewall 44 is configured to publish the first BGP dynamic route according to the address segment slice information;

The router 46 is configured to acquire first routing information including the address segment slice information according to the first BGP dynamic route, and forward service data according to the first routing information.

Fig. 5 is a block diagram of a service chain address pool slice processing system according to this preferred embodiment. As shown in Fig. 5, the system further includes: a network element 48,

The gateway 42 is further configured to store the address segment slice information in a database, and send the address segment slice information to the network element and the firewall.

the network element 48, configured to store the address segment slice information;

The firewall 44 is further configured to store the address segment slice information.

In an embodiment, the gateway 42 is further configured to receive uplink service data, and send the uplink service data to a target network element, wherein the uplink service data carries an IPV6 address, and the target network element is: one of the network elements;

the target network element, configured to send the uplink service data to the firewall according to the address segment slice when the next hop of the target network element is a firewall;

The firewall 44 is further configured to send the uplink service data to the router according to the address segment slice;

The router 46 is further configured to forward the upstream service traffic according to the first routing information.

In one embodiment, the gateway 42 is further configured to receive a notification message of an IPV6 address segment change, and perform slice processing on the changed IPV6 address segment according to the slice granularity to obtain multiple address segment slices after the change; and Allocate corresponding firewalls to the changed address segment slices according to the number of firewalls, and obtain the changed address segment slice information, wherein the IPV6 address segment change includes adding one or more IPv6 address segments, deleting part IPV6 address segment;

The firewall 44 is further configured to publish a second BGP dynamic route according to the changed address segment slice information;

The router 46 is further configured to acquire second routing information including the updated address segment slice information according to the second BGP dynamic route, and forward service data according to the second routing information.

The above-mentioned gateway may specifically be a serving gateway/packet data gateway (ServingGateWay/Packet Data Network GateWay, referred to as SGW/PGW for short), and the network element may specifically be a service chain agent, and FIG. 6 is a slice of the service chain address pool according to the present preferred embodiment. The block diagram of the system, as shown in Figure 6, the system includes,

SGW/PGW, an important part of a mobile communication network, includes a SFCC-Master (referred to as SFCC-M) module.

SFCC, Service Function Chain Controller, business chain controller, divided into Master and Agent. It is used for the maintenance of business chain data, and the data is synchronized to the Agent by the Master.

SFCP, Service Function Chain Proxy, service chain proxy, used for traffic processing of the service chain.

FW, firewall, is used to build a relatively isolated protective barrier between the internal and external networks.

Router, a router, a device that connects two or more networks and acts as a gateway between networks.

In this embodiment, the upstream and downstream traffic of the same user accessing the network is aggregated and processed on each network element according to the user address, which can provide better services. This enables each NE to send traffic from the same user address to a specific next-hop NE through the slice of the address pool. It mainly includes the following steps:

There is a user IPv6 address pool on the SGW/PGW. The maintainer enters the address pool slice command, which includes the slice granularity and the VNFID of the last hop firewall.

The SFCC-Master device of the SGW/PGW distributes the IPV6 address segments of all users equally according to the number of firewalls according to the slicing algorithm.

The SFCC-Master device synchronizes the calculated slice results to all SFCC-Agents (referred to as SFCC-A).

The SFCC-Agent of each network element resynchronizes the slicing result to the corresponding data processing module.

Slice information also needs to be synchronized to routers and network elements through BGP or manually.

When a user accesses the Internet, each data processing module sends the user's Internet access traffic to the corresponding network element device according to the slice information.

When the user address segment increases or decreases, the SFCC-Master device performs slice calculation, and synchronizes the results to each SFCC-Agent, and the SFCC-Agent then synchronizes to the corresponding data processing module.

FIG. 7 is a flowchart of address pool slicing processing according to this embodiment. As shown in FIG. 7 , there are mainly the following steps:

Step S701, the SGW/PGW performs slicing processing on the IPV6 address segment according to the slice granularity and the number of FWs to obtain slice information (corresponding to the above-mentioned address segment slice information). Specifically, the SGW/PGW has configured the IPV6 address segment, input The first slicing command, the slicing command includes the slicing granularity, and the SFCC-Master module of the SGW/PGW reads the IPV6 address segment information and the FW information. The SFCC-Master slices the IPV6 address segment according to the slice granularity and the number of FWs, and saves slice information to the database.

Steps S702-S704, the SGW/PGW transmits the slice information to each network element and the firewall, specifically, to SFCP1, SFCP2 and the firewall, and the SFCC-Master module transmits the slice information to the SFCC-Agant module and the firewall of each network element;

In steps S705-S707, each network element and the firewall store the slice information. Specifically, the SFCC-Agent module of each network element resynchronizes the slice information to the corresponding data processing module.

Step S708, the firewall advertises a BGP dynamic route (corresponding to the above-mentioned first BGP dynamic route) according to the slice information. Specifically, after the firewall obtains the slice information, it advertises the BGP dynamic route according to the corresponding relationship between the address segment slice and the firewall;

Step S709, the router obtains routing information.

FIG. 8 is a flowchart of incremental slice processing by adding an address segment according to the present embodiment. As shown in FIG. 8 , it mainly includes the following steps:

Step S801, the SGW/PGW receives a notification message of address segment change, specifically, the SFCC-Master module of the SGW/PGW registers the address segment information change notification message of the database.

Step S802, the SGW/PGW performs slicing processing on the changed address segment according to the number of saved firewalls and the slicing granularity, and obtains updated slicing information, wherein the address segment is added to the SGW/PGW, and relevant records are added to the database. The module is synchronized to the SFCC-Master module. The SFCC-Master obtains the address segment information, slices the new address segment information according to the number of saved firewalls and slice granularity, and saves the updated slice information to the database.

Steps S803-805, the SGW/PGW sends the changed slice information to each network element (SFCP1, SFCP2) and the firewall, and others transmit the incremental slice information to the SFCC-Agant module and the firewall of each network element through the SFCC-Master module .

Steps S806-808, each network element and the firewall store the changed slice information. Specifically, the SFCC-Agent module of each network element resynchronizes the incremental slice information to the corresponding data processing module.

Step S809, the firewall advertises the BGP dynamic route (corresponding to the second BGP dynamic route described above) according to the changed slice information, and after the firewall obtains the incremental slice information, advertises the BGP dynamic route according to the relationship between the address segment slice and the firewall;

Step S810, the router obtains the changed routing information.

The operation of deleting an address segment is similar to that of adding an address segment, and will not be repeated here.

FIG. 9 is a flowchart of media stream processing of service chains according to address segments according to the present embodiment. As shown in FIG. 9 , it mainly includes the following steps:

Step S901, the SGW/PGW sends the upstream traffic to the SFCP1. Specifically, when the user accesses the Internet, the data processing module of the SGW/PGW sends the upstream traffic to the data processing module of the SFCP1.

Steps S902-903, SFCP1 determines that the next hop is not a firewall, and sends it to SFCP2 according to the original hash HASH algorithm. Specifically, the data processing module of SFCP 1 sends it to the next hop network element ( That is, the data processing module of SFCP2), and record it in the data flow table.

Steps S904-905, SFCP2 determines that the next hop is a firewall, and sends the uplink data to the firewall according to the slice information. Specifically, the data processing module of SFCP2 determines that the next hop is a firewall, and then sends the data according to the slice information and the address information of the user. The specific data processing module sent to the firewall and recorded in the data flow table.

Step S906, the firewall sends the uplink data to the router according to the slice information. Specifically, the specific data processing module of the firewall sends the uplink data to the router according to the slice information, and records it in the data flow table.

Step S907, the router sends the downlink data to the firewall according to the routing information. Specifically, the router transmits the downlink data to a specific data processing module of the firewall according to the BGP routing information configured on the router.

Step S908, the firewall sends the downlink data to the SFCP2. Specifically, the data processing module of the firewall queries the data flow table, and sends the downlink data to the data processing module corresponding to the previous hop SFCP2.

Step S909, SFCP2 sends the downlink data to SFCP1. Specifically, the data processing module of SFCP2 queries the data flow table, and sends the downlink data to the data processing module corresponding to the previous hop SFCP1.

Step S910, the SFCP1 sends the downlink data to the gateway. Specifically, the data processing module of the SFCP1 queries the data flow table, and sends the downlink data to the data processing module of the SGW/PGW.

According to another embodiment of the present disclosure, a service chain address pool slice processing apparatus is also provided, which is applied to a gateway. FIG. 10 is a block diagram 1 of the service chain address pool slice processing apparatus according to this embodiment, as shown in FIG. 10 . , the device includes:

The first slice processing module 102 is configured to perform slice processing on the IPV6 address segment according to the slice granularity to obtain a plurality of address segment slices;

The first allocation module 104 is configured to allocate corresponding firewalls for the plurality of address segment slices according to the number of firewalls, and obtain address segment slice information, wherein the address segment slice information includes a correspondence between address segment slices and firewalls, and the The address segment slice information is used by the firewall to advertise the first BGP dynamic route, and the first BGP dynamic route is used by the router to obtain the first route information including the address segment slice information, and the first route information is used for the Routers forward service data.

In one embodiment, the apparatus further includes:

a storage module, configured to store the address segment slice information in a database;

The first sending module is configured to send the address segment slice information to the network element and the firewall.

In one embodiment, the apparatus further includes:

a first receiving data module, configured to receive uplink service data, wherein the uplink service data carries an IPV6 address;

The second sending module is configured to send the uplink service data to the target network element, wherein if the next hop of the target network element is a firewall, the target network element is configured to send the The uplink service data is sent to the firewall.

In one embodiment, the apparatus further includes:

A message receiving module, configured to receive a notification message of an IPV6 address segment change, wherein the IPV6 address segment change includes adding one or more IPV6 address segments and deleting part of the IPV6 address segment;

A second slice processing module, configured to perform slice processing on the changed IPv6 address segment according to the slice granularity, to obtain a plurality of changed address segment slices;

The second allocation module is configured to allocate corresponding firewalls to the plurality of address segment slices after the change according to the number of the firewalls, and obtain the changed address segment slice information.

In one embodiment, the apparatus further includes:

A command receiving module, configured to receive a slice command, wherein the slice command carries the slice granularity;

an obtaining module, configured to obtain the IPV6 address segment and the number of the firewalls.

According to another embodiment of the present disclosure, a service chain address pool slice processing apparatus is also provided, which is applied to a firewall. FIG. 11 is a block diagram 2 of the service chain address pool slice processing apparatus according to this embodiment, as shown in FIG. 11 . , the device includes:

The receiving slice module 112 is configured to receive the address segment slice sent by the gateway, wherein the address segment slice is that the gateway performs slice processing on the IPV6 address segment according to the slice granularity to obtain a plurality of address segment slices, which are determined according to the number of firewalls. obtained after the multiple address segment slices are assigned to corresponding firewalls, and the address segment slice information includes the correspondence between address segment slices and firewalls;

The distribution module 114 is configured to publish a first BGP dynamic route according to the address segment slice, wherein the first BGP dynamic route is used by a router to obtain first route information including the address segment slice information, and the first route The information is used by the router to forward service data.

In one embodiment, the apparatus further includes:

The second receiving data module is configured to receive the uplink service data forwarded by the target network element of the previous hop according to the address segment slice;

The third sending module is configured to send the uplink service data to a router according to the address segment slice, wherein the router forwards the uplink service traffic according to the first routing information.

In one embodiment, the apparatus further includes:

a third data receiving module, configured to receive downlink service data forwarded by the router according to the first routing information;

The forwarding module is configured to forward the downlink service data according to the address segment slice.

It should be noted that the above modules can be implemented by software or hardware, and the latter can be implemented in the following ways, but not limited to this: the above modules are all located in the same processor; or, the above modules can be combined in any combination The forms are located in different processors.

Embodiments of the present disclosure also provide a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, wherein the computer program is configured to execute the steps in any one of the above method embodiments when running.

In an exemplary embodiment, the above-mentioned computer-readable storage medium may include, but is not limited to, a USB flash drive, a read-only memory (Read-Only Memory, referred to as ROM for short), and a random access memory (Random Access Memory, referred to as RAM for short) , mobile hard disk, magnetic disk or CD-ROM and other media that can store computer programs.

An embodiment of the present disclosure also provides an electronic device, including a memory and a processor, where a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

In an exemplary embodiment, the above-mentioned electronic device may further include a transmission device and an input-output device, wherein the transmission device is connected to the above-mentioned processor, and the input-output device is connected to the above-mentioned processor.

For specific examples in this embodiment, reference may be made to the examples described in the foregoing embodiments and exemplary implementation manners, and details are not described herein again in this embodiment.

Obviously, those skilled in the art should understand that the above-mentioned modules or steps of the present disclosure can be implemented by a general-purpose computing device, and they can be centralized on a single computing device or distributed in a network composed of multiple computing devices On the other hand, they can be implemented in program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, can be performed in a different order than shown here. Or the described steps, or they are respectively made into individual integrated circuit modules, or a plurality of modules or steps in them are made into a single integrated circuit module to realize. As such, the present disclosure is not limited to any particular combination of hardware and software.

The above descriptions are only preferred embodiments of the present disclosure, and are not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the principles of the present disclosure shall be included within the protection scope of the present disclosure.

Claims

A service chain address pool slice processing method, applied to a gateway, the method includes:

Perform slicing processing on the IPV6 address segment of the Internet Protocol version 6 according to the slicing granularity to obtain multiple address segment slices;

Assign corresponding firewalls to the plurality of address segment slices according to the number of firewalls, and obtain address segment slice information, wherein the address segment slice information includes the correspondence between address segment slices and firewalls, and the address segment slice information is used for the The firewall publishes a first border gateway protocol BGP dynamic route, where the first BGP dynamic route is used by the router to obtain first route information including the address segment slice information, and the first route information is used by the router to forward service data.
The method according to claim 1, wherein after slicing the IPV6 address segment according to the slicing granularity to obtain the plurality of address segment slices, the method further comprises:

storing the address segment slice information in a database;

Send the address segment slice information to the network element and the firewall.
The method according to claim 2, wherein after assigning corresponding firewalls to the plurality of address segment slices according to the number of firewalls and obtaining address segment slice information, the method further comprises:

receiving uplink service data, wherein the uplink service data carries an IPV6 address;

Send the uplink service data to the target network element, wherein, if the next hop of the target network element is a firewall, the target network element is configured to send the uplink service data to the target network element according to the address segment slice. firewall.
The method according to any one of claims 1 to 3, wherein after assigning corresponding firewalls to the plurality of address segment slices according to the number of firewalls, and obtaining the address segment slice information, the method further comprises: :

Receive a notification message of an IPV6 address segment change, wherein the IPV6 address segment change includes adding one or more IPV6 address segments and deleting part of the IPV6 address segment;

Perform slicing processing on the changed IPV6 address segment according to the slicing granularity, to obtain a plurality of changed address segment slices;

According to the number of firewalls, corresponding firewalls are allocated to the multiple address segment slices after the change, and the changed address segment slice information is obtained.
The method according to any one of claims 1 to 3, wherein before slicing the IPV6 address segment according to the slicing granularity to obtain multiple address segment slices, the method further comprises:

receiving a slicing command, wherein the slicing command carries the slicing granularity;

Obtain the IPV6 address segment and the number of firewalls.
A service chain address pool slice processing method is applied to a firewall, and the method includes:

Receive the address segment slice sent by the gateway, wherein the address segment slice is that the gateway performs slice processing on the IPV6 address segment of the Internet Protocol version 6 according to the slice granularity, and obtains multiple address segment slices. Obtained after each address segment slice is allocated to the corresponding firewall, the address segment slice information includes the correspondence between the address segment slice and the firewall;

The first BGP dynamic route is published according to the address segment slice, wherein the first BGP dynamic route is used by the router to obtain first route information including the address segment slice information, and the first route information is used for The router forwards the service data.
The method according to claim 6, wherein after the first BGP dynamic route is advertised according to the address segment slice, the method further comprises:

Receive the uplink service data forwarded by the target network element of the previous hop according to the address segment slice;

The uplink service data is sent to the router according to the address segment slice, wherein the router forwards the uplink service traffic according to the first routing information.
The method according to claim 6, wherein after publishing the first BGP dynamic route according to the address segment slice, the method further comprises:

receiving downlink service data forwarded by the router according to the first routing information;

The downlink service data is forwarded according to the address segment slice.
A service chain address pool slice processing device, applied to a gateway, the device includes:

The first slice processing module is configured to perform slice processing on the IPV6 address segment of the Internet Protocol Version 6 according to the slice granularity to obtain a plurality of address segment slices;

The first allocation module is configured to allocate corresponding firewalls for the plurality of address segment slices according to the number of firewalls, and obtain address segment slice information, wherein the address segment slice information includes a correspondence between address segment slices and firewalls, and the address segment slices The segment slice information is used by the firewall to advertise the first BGP dynamic route, and the first BGP dynamic route is used by the router to obtain the first route information including the address segment slice information, and the first route information is used to The router forwards the service data.
A service chain address pool slice processing device, applied to a firewall, the device includes:

The receiving slice module is configured to receive the address segment slice sent by the gateway, wherein the address segment slice is that the gateway performs slice processing on the IPV6 address segment of the Internet Protocol Version 6 according to the slice granularity, and obtains multiple address segment slices, which are processed according to the slice granularity. The number of firewalls is obtained after the multiple address segment slices are assigned to corresponding firewalls, and the address segment slice information includes the correspondence between the address segment slices and the firewalls;

A distribution module, configured to publish a first BGP dynamic route according to the address segment slice, wherein the first BGP dynamic route is used by a router to obtain first route information including the address segment slice information, and the first route information for the router to forward service data.
A service chain address pool slice processing system, the system at least includes: a gateway, a firewall, and a router, wherein,

The gateway is configured to perform slicing processing on the IPV6 address segment according to the slicing granularity to obtain multiple address segment slices, allocate corresponding firewalls to the multiple address segment slices according to the number of firewalls, and obtain address segment slice information, wherein the The address segment slice information includes the correspondence between address segment slices and firewalls;

the firewall, configured to publish the first border gateway protocol BGP dynamic route according to the address segment slice information;

The router is configured to acquire first routing information including the address segment slice information according to the first BGP dynamic route, and forward service data according to the first routing information.
The system of claim 11, wherein the system further comprises: a network element,

The gateway is further configured to store the address segment slice information in a database, and send the address segment slice information to the network element and the firewall;

the network element for storing the address segment slice information;

The firewall is further configured to store the address segment slice information.
The system of claim 12, wherein,

The gateway is further configured to receive uplink service data and send the uplink service data to a target network element, wherein the uplink service data carries an IPV6 address, and the target network element is one of the network elements ;

The target network element is configured to send the uplink service data to the firewall according to the address segment slice when the next hop of the target network element is a firewall;

The firewall is further configured to send the uplink service data to the router according to the address segment slice;

The router is further configured to forward the upstream service traffic according to the first routing information.
The system of claim 11, wherein,

The gateway is further configured to receive a notification message of an IPV6 address segment change, perform slice processing on the changed IPV6 address segment according to the slice granularity, and obtain multiple address segment slices after the change; The multiple address segment slices after the change are allocated corresponding firewalls, and the address segment slice information after the change is obtained, wherein, the IPV6 address segment change includes adding one or more IPV6 address segments, and deleting part of the IPv6 address segment;

The firewall is further configured to publish a second BGP dynamic route according to the changed address segment slice information;

The router is further configured to acquire second routing information including the updated address segment slice information according to the second BGP dynamic route, and forward service data according to the second routing information.
A computer-readable storage medium having a computer program stored in the computer-readable storage medium, wherein the computer program is configured to execute any one of the claims 1 to 5 and 6 to 8 when running. Methods.
An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute any one of the claims 1 to 5, 6 to 8 method described.