WO2025051027A1 - Traffic policy determination method, electronic device, and storage medium - Google Patents

Abstract

The present application discloses a traffic policy determination method, an electronic device, and a storage medium. The method is applied to a policy execution node and comprises: acquiring first information, wherein the first information corresponds to a first packet from a gateway, and the first information indicates a first correspondence between an Internet protocol version 6 (IPv6) address of a terminal and a media access control (MAC) address of the terminal; acquiring a first mapping relationship, wherein the first mapping relationship indicates a relationship among an Internet protocol version 4 (IPv4) address of the terminal, the MAC, and a traffic policy corresponding to the IPv4 address of the terminal; and on the basis of the first information and the first mapping relationship, determining a traffic policy corresponding to the IPv6 address of the terminal.

Description

Traffic strategy determination method, electronic device and storage medium

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the priority of the Chinese patent application filed with the State Intellectual Property Office of China on September 7, 2023, with application number 202311149908.4 and invention name “A strategic accompanying method, device and electronic device”, all contents of which are incorporated by reference in this application.

Technical Field

The present application relates to the field of communication technology, and in particular to a traffic strategy determination method, an electronic device, and a storage medium.

Background Art

In the campus network, network administrators need to uniformly manage users' network access rights and require users to access the network according to pre-planned network segments and locations. At present, as enterprise networks continue to be built and developed, users' access locations will move over a large range. Network administrators often need to reassign network access rights to users, which brings great inconvenience to network management and maintenance.

Therefore, in order to solve the above problems, an effective network management and enterprise network security protection method is proposed, that is, policy mobility. Policy mobility means that no matter where the user moves, the user experience remains unchanged, which breaks the limitation of the traditional network access location and truly embodies the characteristic of network moving with people.

Summary of the invention

The present application provides a traffic strategy determination method, an electronic device, and a storage medium.

In a first aspect, the present application provides a method for determining a traffic policy, wherein the method is applied to a policy execution node, and the method includes: obtaining first information, wherein the first information corresponds to a first message from a gateway, and the first information indicates a first correspondence between an Internet Protocol version 6 IPv6 address of a terminal and a media access control MAC address of the terminal; obtaining a first mapping relationship, wherein the first mapping relationship indicates a relationship between an Internet Protocol version 4 IPv4 address of the terminal, the MAC, and a traffic policy corresponding to the IPv4 address of the terminal; and determining the traffic policy corresponding to the IPv6 address of the terminal based on the first information and the first mapping relationship.

In one possible design, the traffic policy corresponding to the IPv6 address of the terminal is determined based on the first information and the first mapping relationship, including: determining the traffic policy corresponding to the IPv6 address of the terminal based on the traffic policy corresponding to the IPv4 address of the terminal; wherein the traffic policy corresponding to the IPv6 address of the terminal is the same as the traffic policy corresponding to the IPv4 address of the terminal.

In one possible design, obtaining the first mapping relationship includes: obtaining the first mapping relationship from a controller through a network configuration protocol NETCONF interface.

In a possible design, the obtaining of the first mapping relationship includes: obtaining second information, wherein the second information corresponds to a second message from the gateway, and the second information indicates a second correspondence between the IPv4 address of the terminal and the MAC address of the terminal; obtaining third information, The third information indicates the correspondence between the IPv4 address of the terminal and the traffic policy corresponding to the IPv4 address of the terminal; and based on the second information and the third information, the first mapping relationship is obtained.

In one possible design, obtaining the second information includes: obtaining the second information from the gateway through an Ethernet-based virtual private network EVPN; wherein the gateway and the policy execution node are in a Border Gateway Protocol BGP neighbor relationship, and the second message is one of the following messages: an Address Resolution Protocol ARP message, an ARP table entry, a Dynamic Host Configuration Protocol snooping DHCP Snooping message, or a DHCP Snooping table entry.

In one possible design, obtaining the second information includes: obtaining the second information from the controller through a network configuration protocol NETCONF interface; wherein the second message is an ARP message or an ARP table entry.

In one possible design, obtaining the second information includes: directly obtaining the second information from the gateway, wherein the policy execution node is set on the gateway, and the second message is an ARP message or an ARP table entry.

In one possible design, obtaining the first information includes: obtaining the first information from the gateway through an Ethernet-based virtual private network EVPN; wherein the gateway and the policy execution node are in a Border Gateway Protocol BGP neighbor relationship, and the first message is one of the following messages: a neighbor discovery ND message, an ND table entry, a neighbor discovery snooping ND Snooping message, or an ND Snooping table entry.

In one possible design, obtaining the first information includes: obtaining the first information from the controller through a network configuration protocol NETCONF interface; wherein the first message is an ND message or an ND table entry.

In one possible design, obtaining the first information includes: directly obtaining the first information from the gateway, wherein the policy execution node is set on the gateway, and the first message is an ND message or an ND table entry.

In a second aspect, a method for determining a traffic policy is provided, wherein the method is applied to a gateway, and the method comprises: sending a first message, wherein the first message allows a policy execution node to determine a traffic policy corresponding to an IPv6 address of a terminal based on first information and a first mapping relationship; wherein the first information corresponds to a first message from a gateway, and the first information indicates a first correspondence between an IPv6 address of a terminal and a MAC address of the terminal; and the first mapping relationship is a relationship between an Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal.

In one possible design, sending the first message includes: sending the first message through an Ethernet-based virtual private network EVPN; wherein the gateway and the policy execution node are in a Border Gateway Protocol BGP neighbor relationship, and the first message is one of the following messages: a neighbor discovery ND message, an ND table entry, a neighbor discovery snooping ND Snooping message, or an ND Snooping table entry.

In one possible design, sending the first message includes: sending the first message to the controller through a remote procedure call protocol GRPC interface or a NETCONF interface to allow The controller sends the first message to the policy execution node; wherein the first message is a neighbor discovery ND message or an ND table entry.

In one possible design, sending the first message includes: directly sending the first message to the policy execution node; wherein the policy execution node is set on the gateway, and the first message is an ND message or an ND table entry.

In one possible design, before sending the first message and the second message, the method also includes: learning the first message and the second message from the terminal.

In a third aspect, the present application provides a method for determining a traffic policy, wherein the method is applied to a controller, and the method includes: receiving a first message sent by a gateway; and sending the first message to a policy execution node, wherein the first message allows the policy execution node to determine the traffic policy corresponding to the IPv6 address of the terminal based on first information and a first mapping relationship; wherein the first information corresponds to a first message from the gateway, and the first information indicates a first correspondence between the IPv6 address of the terminal and the MAC address of the terminal; and the first mapping relationship is the relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal.

In one possible design, the method further includes: sending the first mapping relationship to the policy execution node through a network configuration protocol NETCONF interface.

In one possible design, the method also includes: receiving a second message sent by the gateway; sending second information and third information to the policy execution node; wherein the second information and the third information allow the policy execution node to determine the first mapping relationship; the second information corresponds to a second message from the gateway, the second information indicates a second correspondence between the IPv4 address of the terminal and the MAC address of the terminal; and the third information indicates a correspondence between the IPv4 address of the terminal and the traffic policy corresponding to the IPv4 address of the terminal.

In a fourth aspect, the present application provides a method for determining a traffic policy, wherein the method is applied to a policy execution node, and the method includes: receiving fourth information, wherein the fourth information indicates the traffic policy corresponding to the IPv6 address of the terminal; the fourth information is determined based on first information and a first mapping relationship, the first information corresponds to a first message from a gateway, and the first information indicates a first correspondence between the IPv6 address of the terminal and the MAC address of the terminal; the first mapping relationship indicates the relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal; and based on the fourth information, determining the traffic policy corresponding to the IPv6 address of the terminal.

In a fifth aspect, the present application provides a method for determining a traffic policy, wherein the method is applied to a gateway, and the method includes: sending a first message, wherein the first message allows a controller to determine the traffic policy corresponding to the IPv6 address of the terminal based on first information and a first mapping relationship, and send the traffic policy corresponding to the IPv6 address of the terminal to a policy execution node; wherein the first information corresponds to a first message from a gateway, and the first information indicates a first correspondence between the IPv6 address of the terminal and the MAC address of the terminal; and the first mapping relationship is the relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal.

In a sixth aspect, the present application provides a method for determining a traffic strategy, wherein the method is applied to Controller, the method includes: receiving a first message sent by a gateway; the first message allows the controller to determine fourth information based on the first information and the first mapping relationship; wherein the first information corresponds to the first message from the gateway, and the first information indicates a first correspondence between the IPv6 address of the terminal and the MAC address of the terminal; the first mapping relationship is the relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC and the traffic policy corresponding to the IPv4 address of the terminal; the fourth information indicates the traffic policy corresponding to the IPv6 address of the terminal; and sending the fourth information to the policy execution node.

In a seventh aspect, the present application provides a traffic policy determination device, wherein the device includes: an acquisition module, used to obtain first information and a first mapping relationship, wherein the first information corresponds to a first message from a gateway, and the first information indicates a first correspondence between an IPv6 address of a terminal and a MAC address of the terminal; the first mapping relationship indicates a relationship between an Internet Protocol version 4 IPv4 address of the terminal, the MAC, and a traffic policy corresponding to the IPv4 address of the terminal; and

A traffic policy determination module is used to determine the traffic policy corresponding to the IPv6 address of the terminal based on the first information and the first mapping relationship.

In an eighth aspect, the present application provides a policy accompanying method, the method is applied to a software defined network SDN, the method comprising:

In response to a user operation of selecting a target identification mode, obtaining a first mapping relationship and a message of a terminal, wherein the first mapping relationship represents a relationship between MAC address information, IPv4 address information and a user group of the terminal;

Generate a second mapping relationship between the IPv6 address information of the terminal and the user group according to the first mapping relationship and the message;

Determine a traffic policy for the IPv6 address information according to the second mapping relationship.

Through the above method, a second mapping relationship between IPv6 address information and user groups is generated, and the traffic policy of IPv6 address information is determined according to the second mapping relationship, so as to realize policy following of terminal IPv6 service traffic.

In one possible design, the target identification mode is any one of a controller identification mode, a local Ethernet virtual private network EVPN identification mode, and a local gateway identification mode.

In a possible design, in response to a user operation of selecting a target recognition mode, obtaining a first mapping relationship and a message of the terminal includes:

In response to a user operation of selecting the controller identification mode, acquiring a first mapping relationship of the terminal and the message based on a controller in the SDN;

The generating, according to the first mapping relationship and the message, a second mapping relationship between the IPv6 address information of the terminal and the user group includes:

Parsing the message based on the controller to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

Based on the controller, the third mapping relationship is compared with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group, so that the policy execution node in the SDN determines the traffic policy of the IPv6 address information according to the second mapping relationship.

Through the above method, in response to the user operation of selecting the controller identification mode, a second mapping relationship between the IPv6 address information and the user group is generated based on the controller, and the second mapping relationship is sent to the policy execution node, thereby realizing policy-based mobility of the terminal IPv6 service traffic without relying on the authentication device to report the IPv6 address information.

In a possible design, in response to a user operation of selecting a target recognition mode, obtaining a first mapping relationship and a message of the terminal includes:

In response to a user operation of selecting the local EVPN identification mode, acquiring a first mapping relationship of the terminal based on a controller in the SDN, and acquiring a message of the terminal based on a policy execution node in the SDN;

The generating, according to the first mapping relationship and the message, a second mapping relationship between the IPv6 address information of the terminal and the user group includes:

The controller sends the first mapping relationship to the policy execution node, and the policy execution node parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

The third mapping relationship is compared with the first mapping relationship based on the policy execution node to generate a second mapping relationship between the IPv6 address information and the user group.

Through the above method, in response to the user operation of selecting the local EVPN identification mode, a second mapping relationship between the IPv6 address information and the user group is generated based on the policy execution node, thereby eliminating the need for the controller to separately send down the traffic policy of the IPv6 address information, thereby improving the performance of policy delivery.

In a possible design, in response to a user operation of selecting a target recognition mode, obtaining a first mapping relationship and a message of the terminal includes:

In response to a user operation of selecting the local gateway identification mode, acquiring a first mapping relationship of the terminal based on a controller in the SDN, and acquiring a message of the terminal based on a gateway in the SDN;

The generating, according to the first mapping relationship and the message, a second mapping relationship between the IPv6 address information of the terminal and the user group includes:

The controller sends the first mapping relationship to the gateway, and the gateway parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

The gateway compares the third mapping relationship with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group.

Through the above method, in response to the user operation of selecting the local gateway identification mode, the second mapping relationship between the IPv6 address information and the user group can be directly generated based on the gateway.

In a ninth aspect, the present application provides a policy accompanying device, which is applied to a software defined network (SDN), and the device includes:

An acquisition module, configured to acquire a first mapping relationship and a message of a terminal in response to a user operation of selecting a target recognition mode, wherein the first mapping relationship represents a relationship between the MAC address information, the IPv4 address information and the user group of the terminal;

A generating module, configured to generate an IPv6 address of the terminal according to the first mapping relationship and the message. a second mapping relationship between address information and the user group;

A policy accompanying module is used to determine the traffic policy of the IPv6 address information according to the second mapping relationship.

In one possible design, the target identification mode is any one of a controller identification mode, a local Ethernet virtual private network EVPN identification mode, and a local gateway identification mode.

In a possible design, the acquisition module is specifically used for:

In response to a user operation of selecting the controller identification mode, acquiring a first mapping relationship of the terminal and the message based on a controller in the SDN;

The generation module is specifically used for:

Parsing the message based on the controller to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

Based on the controller, the third mapping relationship is compared with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group, so that the policy execution node in the SDN determines the traffic policy of the IPv6 address information according to the second mapping relationship.

In a possible design, the acquisition module is further used for:

In response to a user operation of selecting the local EVPN identification mode, acquiring a first mapping relationship of the terminal based on a controller in the SDN, and acquiring a message of the terminal based on a policy execution node in the SDN;

The generation module is also used for:

The controller sends the first mapping relationship to the policy execution node, and the policy execution node parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

The third mapping relationship is compared with the first mapping relationship based on the policy execution node to generate a second mapping relationship between the IPv6 address information and the user group.

In a possible design, the acquisition module is further used for:

In response to a user operation of selecting the local gateway identification mode, acquiring a first mapping relationship of the terminal based on a controller in the SDN, and acquiring a message of the terminal based on a gateway in the SDN;

The generation module is also used for:

The controller sends the first mapping relationship to the gateway, and the gateway parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal;

The gateway compares the third mapping relationship with the first mapping relationship to generate a second mapping relationship between the IPv6 address information and the user group.

In a tenth aspect, the present application provides an electronic device, including:

Memory, used to store computer programs;

The processor is used to implement the above-mentioned traffic policy determination method steps or policy following method steps when executing the computer program stored in the memory.

In an eleventh aspect, the present application provides a computer-readable storage medium, wherein the computer-readable The storage medium stores a computer program, which, when executed by a processor, implements the above-mentioned traffic policy determination method steps or policy following method steps.

In the twelfth aspect, the present application provides a computer program product, which includes: computer program code (or instructions), when the computer program code is executed by one or more processors, it enables the device including the processor to perform the above-mentioned traffic policy determination method steps or policy following method steps.

In an implementation manner of the present application, a first message is obtained from a gateway, and first information is determined based on the first message to determine a first correspondence between the IPv6 address of the terminal and the MAC address of the terminal, and a flow policy corresponding to the IPv6 address of the terminal is determined based on the first information and the first mapping relationship. In this implementation manner, there is no need for the authentication device to support IPv6 authentication and audit functions, nor is there a need to set a private message in the authentication message to carry IPv6-related information, thereby achieving decoupling of the flow policy determination process of the IPv6 address information of the terminal from the authentication device, reducing the burden on the authentication device.

The technical effects that can be achieved in each of the above-mentioned second to twelfth aspects and each of the above-mentioned aspects refer to the technical effects that can be achieved in the above-mentioned first aspect or various possible schemes in the first aspect, and will not be repeated here.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the following briefly introduces the drawings required for use in the embodiments or traditional technical descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, drawings of other embodiments can also be obtained based on these drawings without creative work. The drawings herein are incorporated into the specification and constitute a part of this specification, showing embodiments that conform to the present application, and together with the specification, are used to explain the principles of the present application.

FIG1 is a flow chart of a method for determining a traffic strategy provided in an embodiment of the present application.

FIG. 2 is a schematic diagram of signaling interaction of a controller identification mode provided in an embodiment of the present application.

FIG3 is a schematic diagram of signaling interaction in a local EVPN identification mode provided in an embodiment of the present application.

FIG4 is a schematic diagram of signaling interaction in a local gateway identification mode provided in an embodiment of the present application.

FIG5 is a flow chart of a method for determining a traffic strategy provided in an embodiment of the present application.

FIG6 is a schematic diagram of the structure of a traffic strategy determination device provided in an embodiment of the present application.

FIG. 7 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

FIG8 is a schematic diagram of the structure of a traffic strategy determination device provided in an embodiment of the present application.

DETAILED DESCRIPTION

In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings. The specific operating method in the method embodiment can also be applied to the device embodiment or the system embodiment. It should be noted that in the description of the present application, "multiple" is understood as "at least two". "And/or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and/or B can represent the following three situations: A exists alone, and A and B exist, and B exists alone. A is connected to B, which can represent the following two situations: A is directly connected to B and A is connected to B through C. In addition, in the description of the present application, words such as “first” and “second” are only used for the purpose of distinguishing the description and cannot be understood as indicating or implying relative importance or order.

In order to facilitate understanding by those skilled in the art, the technical terms involved in the embodiments of the present application are first explained.

(1) Software Defined Network (SDN) is a way to implement network virtualization, which can separate the control plane and data plane of network devices, and there is a unified open interface between the control plane and the data plane. The controller is the brain of SDN, which not only provides different levels of programmability to upper-layer network applications through the northbound interface, but also uniformly configures, manages and controls the data plane through the southbound interface.

(2) Lightweight Directory Access Protocol (LDAP) is a protocol for accessing online directory services. LDAP servers provide global directory services for sharing component information (for example, server names and connection properties).

(3) Office Automation (OA) is a new way of working that combines modern office and computer technology. OA server is a cloud server used to store various OA office software.

(4) Ethernet Virtual Private Network (EVPN) is a VPN technology used for Layer 2 network interconnection. EVPN extends the BGP protocol to transfer the learning and publishing process of MAC address information between Layer 2 networks from the data plane to the control plane.

(5) An autonomous system (AS) is a group of routers managed by the same technical management organization and running the same dynamic routing protocol.

(6) Border Gateway Protocol (BGP) is an AS-based protocol. BGP neighbor relationships are manually configured to enable two parties running BGP to find each other and establish connections.

(7) Remote Authentication Dial In User Service (RADIUS) is used to authenticate and bill dial-up users.

(8) Address Resolution Protocol (APR) is a protocol that obtains MAC address information based on IP address information.

(9) Neighbor Discovery Protocol (ND) is mainly responsible for discovering the corresponding address information of other nodes on the link, determining available routes, and maintaining information about available paths and other active nodes. ND defines five types of messages.

Neighbor Solicitation (NS): An IPv6 node (a terminal using the IPv6 protocol) can obtain the link layer address information of its neighbors through NS messages and check whether the neighbors are reachable.

Neighbor Advertisement (NA), NA message is the response of IPv6 node to NS message.

Router Solicitation (RS) is a message sent by an IPv6 node to the router after it is started, requesting the network prefix and other configuration information for automatic configuration of the IPv6 node address information.

Router Advertisement (RA) is a message sent periodically by a router, which includes key information about the network configuration, such as the network prefix, or the router responds to an RS message with a RA message.

Redirect message: When the router finds that the incoming interface and outgoing interface of the message are the same, it can notify the terminal through the redirect message to select another better next hop address information for sending subsequent messages.

(10) Network Configuration Protocol (NETCONF) is a network management protocol based on Extensible Markup Language. It provides a programmable method for the controller to configure and manage the gateway and obtain the gateway data.

(11) Remote Procedure Call Protocol (RPC) is a protocol that requests services from a remote computer program over the network without having to understand the underlying network technology. That is, the controller can remotely call the gateway's data through RPC. GRPC refers to the RPC framework developed by Google.

(12) Telemetry technology is a comprehensive technology that uses sensor technology, communication technology, and data processing technology to transmit short-range measurement values of object parameters to a distant measurement station to achieve long-distance measurement.

(13) Type 2 routing, also known as MAC/IP routing, is used to advertise MAC and IP address information.

(14) A host table is a mapping table used in computer networks to associate IP address information with corresponding host names.

(15) The southbound interface is the communication protocol between the controller and the switch (gateway, policy execution node, terminal).

Strategy mobility means that no matter where the user moves, the user experience remains unchanged. It breaks the limitation of traditional network access location and truly embodies the characteristic of network following people.

Traditional policy-based mobility solutions are mainly used in Internet Protocol version 4 (IPv4) networks. They achieve policy-based mobility of terminal IPv4 service traffic by obtaining the relationship between terminal IPv4 address information and user groups, and then sending the relationship between IPv4 address information and user groups to policy execution nodes.

However, with the advent of Internet Protocol version 6 (IPv6), how to determine the traffic strategy for terminal IPv6 services has become an urgent problem to be solved.

The embodiment of the present application provides a method for determining a traffic strategy, which can realize the policy accompanying the terminal IPv6 service traffic by generating a second mapping relationship between IPv6 address information and a user group, and determining the traffic strategy of the IPv6 address information according to the second mapping relationship. Among them, the method and device described in the embodiment of the present application are based on the same technical concept. Since the principles of the problems solved by the method and the device are similar, the embodiments of the device and the method can refer to each other, and the repeated parts will not be repeated.

To further illustrate the technical solution provided by the embodiment of the present application, the following is a detailed description of the technical solution in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps shown in the following embodiments or drawings, the method may include more or fewer operation steps based on routine or no creative labor. In the steps that do not logically have a necessary causal relationship, the execution order of these steps is not limited to the execution order provided by the embodiment of the present application. The method is actually During the processing or when the device is executed, the methods shown in the embodiments or drawings may be executed sequentially or in parallel.

FIG1 is a flow chart of a method for determining a traffic strategy provided by an embodiment of the present application. The method is applied to a traffic strategy determination system. The process can be executed by a policy accompanying device, which can be implemented by software, hardware, or a combination of software and hardware to ensure the normal operation of the system. As shown in FIG1 , the process includes the following steps.

S11, in response to a user operation of selecting a target recognition mode, obtaining a first mapping relationship and a message of a terminal.

S12: Generate a second mapping relationship between the IPv6 address information of the terminal and the user group according to the first mapping relationship and the message.

S13: Determine a traffic policy for the IPv6 address information according to the second mapping relationship.

In the implementation manner of the present application, the traffic policy of the IPv6 address of the same terminal may be the same as the traffic policy of the IPv4 address of the terminal, which will not be described in detail below.

A user group is a collection of multiple user devices. Traffic policies can be set for user groups through the controller to ensure that network resources are not illegally used or accessed. Traffic policies are access control policies. Traffic policies can be permission and rejection, as well as full access, partial access, speed-limited access, or time-limited access. Ordinary technicians in this field should be aware of the various types of traffic policies, which will not be described in detail in this article. Each user group can correspond to a traffic policy. When the policy execution node determines the user group corresponding to the terminal IPv4 address or IPv6 address, the traffic policy corresponding to the terminal IPv4 address or IPv6 address can be determined. When the terminal devices in the user group access the network at any location, the access control policy of the user device is the same, realizing business mobility.

The user operation of selecting the target identification mode may refer to determining the traffic policy determination method of the device through device configuration according to requirements during the device deployment stage or the operation stage.

In the embodiment of the present application, when configuring the network, the SDN controller will obtain the organizational relationship (user group) within the organization from the LDAP, OA and other servers, and send the user group and its corresponding traffic policy to the policy execution node. For the convenience of description, the controller is used to refer to the SDN controller below.

In addition, for devices that do not have corresponding specific user groups in the organizational relationship, such as printers or monitoring devices, they can also be individually set up as user groups corresponding to one or more user groups (for example, shared user groups), and the user groups corresponding to these devices and the traffic policies corresponding to the user groups can be sent to the policy execution node.

The policy execution node is used to store the IP address of the terminal device and the corresponding traffic policy. In one embodiment, the policy execution node can store the IP address of the terminal device and the corresponding user group information, wherein the user group information corresponds to the traffic policy. When the policy execution node receives a message sent by the terminal device, it queries the source IP address corresponding to the message and the user group information to which it belongs, and executes the traffic policy corresponding to the user group. When the policy execution node receives a message sent to the terminal device, it queries the destination IP address corresponding to the message and the user group information to which it belongs, and executes the traffic policy corresponding to the user group.

Optionally, the target identification mode is any one of a controller identification mode, a local Ethernet virtual private network EVPN identification mode, and a local gateway identification mode.

In some possible implementations, the controller identification mode is used in the following scenarios: When configured as a policy execution node, and there is no Border Gateway Protocol BGP neighbor relationship configured between the gateway and the policy execution node. As shown in Figure 2, a signaling interaction diagram of a controller identification mode provided in an embodiment of the present application includes: obtaining a first mapping relationship of a terminal based on a controller, wherein the first mapping relationship represents the relationship between the MAC address information, IPv4 address information and user group of the terminal.

The specific method for obtaining the first mapping relationship may be: the terminal initiates an authentication request to the authentication device, and after receiving the authentication request, the authentication device sends the authentication request and the billing message to the controller through RADIUS. After receiving the authentication request and the billing message, the controller performs proxy authentication, for example, sends the authentication request to the authentication server, and after the authentication is successful, the authentication server returns the authentication pass information to the controller, so that the controller returns the authentication pass information to the terminal via the authentication device, and the terminal authentication is successful. Under the control of the administrator, the controller can bind the IPv4 address information, MAC address information and user identity information of the terminal carried in the billing message, determine the user group to which the user belongs through the user identity information, and generate the first mapping relationship between the terminal's MAC address information, IPv4 address information and user group.

In some embodiments, the controller obtains a message corresponding to the terminal, such as an ARP message and an ND message, wherein the ARP message includes the correspondence between the MAC address of the terminal and the IPv4 address of the terminal, and the ND message includes the correspondence between the MAC address of the terminal and the IPv6 address of the terminal. In the exemplary embodiments of the present application, messages are used as examples for explanation. It can be understood by those skilled in the art that the message corresponding to the terminal can also be replaced by a table item corresponding to the terminal, such as an ARP table item and an ND table item, wherein the ARP table item includes the correspondence between the MAC address of the terminal and the IPv4 address of the terminal, and the ND table item includes the correspondence between the MAC address of the terminal and the IPv6 address of the terminal. Generally speaking, a message contains more data information, and the table item is information extracted from the message. If the table item is used to transmit the correspondence between the IP address and the MAC address, the transmission efficiency can be improved.

Specifically, the gateway learns the message or table entry of the terminal and sends the message or table entry to the controller, for example, through NETCONF, GRPC or telemetry technology.

In some embodiments, after receiving the message or table entry, the controller parses the message or table entry to obtain a third mapping relationship between the terminal's MAC address information and the IPv6 address information, and based on the third mapping relationship and the first mapping relationship, generates a second mapping relationship between the IPv6 address information and the above-mentioned user group.

The controller can send the second mapping relationship to the policy execution node through, for example, the network configuration protocol NETCONF, so that the policy execution node determines the traffic policy of the IPv6 address information according to the second mapping relationship. For example, the policy execution node notifies the second mapping relationship to the solution application component of the policy companion to perform policy association. At the same time, the policy execution node will also install the second mapping relationship into the host table.

In some implementations, after receiving the above message or table entry, the controller may send the message or table entry to the policy execution node. The policy execution node parses the message or table entry to obtain the third mapping relationship between the MAC address information and the IPv6 address information of the terminal.

The policy execution node obtains a first mapping relationship from the controller, where the first mapping relationship includes a mapping relationship between MAC address information of the terminal, IPv4 address information, and a user group.

The policy execution node generates the IPv6 address information based on the first mapping relationship and the third mapping relationship. and a second mapping relationship between the terminal and the user group, and determining a traffic policy corresponding to the IPv6 address of the terminal based on the second mapping relationship.

In some implementations, after receiving the above message or table entry, the controller may send the message or table entry to the policy execution node. The policy execution node parses the message or table entry to obtain the third mapping relationship between the MAC address information and the IPv6 address information of the terminal.

Additionally or alternatively, when the controller sends the traffic policy corresponding to the IPv4 address, the controller can send the correspondence between the IPv4 address information and the user group to the policy execution node. The policy execution node can obtain the correspondence between the IPv4 address and the MAC address of the terminal based on the ARP message or ARP table entry, and then obtain the first mapping relationship in combination with the traffic policy corresponding to the IPv4 address.

The policy execution node may generate a second mapping relationship between the IPv6 address information and the user group based on the first mapping relationship and the third mapping relationship, and determine a traffic policy corresponding to the IPv6 address of the terminal based on the second mapping relationship.

Through the above method, the above message is sent to the controller based on the gateway. There is no need for the authentication device to support IPv6 authentication and audit functions, nor is there any need to set a private message in the authentication message to carry IPv6-related information, thereby achieving the decoupling of the traffic policy determination process of the terminal's IPv6 address information from the authentication device, reducing the burden on the authentication device.

In some possible implementations, the use scenario of the local EVPN identification mode is: the gateway is not configured as a policy execution node, and a BGP neighbor relationship is configured between the gateway and the policy execution node. As shown in Figure 3, a signaling interaction diagram of the local EVPN identification mode provided in an embodiment of the present application is shown.

Based on the policy execution node, the corresponding message or table item of the terminal is obtained, for example, an ARP message or table item, and an ND message or table item. In some embodiments, the message or table item corresponding to the terminal obtained by the policy execution node may also be a dynamic host configuration protocol snooping DHCP snooping message or table item, and a neighbor discovery snooping ND snooping message or table item.

Specifically, the gateway learns the terminal's message and sends the message to the policy execution node through BGP. For example, the gateway sends the message to the policy execution node through EVPN's Type 2 routing.

When receiving the message, the policy execution node parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal.

The first mapping relationship of the terminal is obtained through the controller, wherein the specific method for obtaining the first mapping relationship is consistent with the method for obtaining the first mapping relationship in the controller identification mode, and is not described repeatedly here. The controller sends the first mapping relationship to the policy execution node through the southbound interface.

When receiving the first mapping relationship, the policy execution node generates a second mapping relationship between the terminal's IPv6 address information and the user group based on the first mapping relationship and the above-mentioned third mapping relationship; determines the traffic policy of the IPv6 address information according to the second mapping relationship; and installs the second mapping relationship into the host table.

The policy execution node determines the traffic policy of the IPv6 address information according to the second mapping relationship. For example, the policy execution node notifies the second mapping relationship to the solution application component of the policy companion to perform policy association. At the same time, the policy execution node also installs the second mapping relationship into the host table.

In some implementations, when a policy execution node receives an ND message or an ND table entry, The message is analyzed to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal.

Additionally or alternatively, when the controller sends the traffic policy corresponding to the IPv4 address, the controller can send the correspondence between the IPv4 address information and the user group to the policy execution node. The policy execution node can obtain the correspondence between the IPv4 address and the MAC address of the terminal based on the ARP message or ARP table entry, and then obtain the first mapping relationship in combination with the traffic policy corresponding to the IPv4 address.

The policy execution node may generate a second mapping relationship between the IPv6 address information and the user group based on the first mapping relationship and the third mapping relationship, and determine a traffic policy corresponding to the IPv6 address of the terminal based on the second mapping relationship.

Through the above method, the above messages are synchronized based on EVPN, and the existing protocols are used. There is no need to add a new private protocol to transmit the binding relationship between IPv6 address information and MAC address information, which can reduce the performance consumption of the policy execution node. At the same time, the mapping association between IPv6 address information and user groups is performed at the policy execution node, and the traffic policy of the IPv4 address is determined. The traffic policy of the IPv6 address does not need to be determined through the controller, avoiding centralized management of the controller, which can reduce the burden on the controller and improve reliability. In addition, in the above scheme, there is no need for the authentication device to transmit IPv6 address information to the controller in real time through billing messages, which can reduce the interaction between the authentication device and the controller and reduce the burden on the authentication device and the controller.

In some implementations, the local gateway identification mode is used in a scenario where the gateway is configured as a policy execution node. As shown in FIG4 , a signaling interaction diagram of a local gateway identification mode provided in an embodiment of the present application is shown.

The controller obtains the first mapping relationship of the terminal, wherein the specific method for obtaining the first mapping relationship is consistent with the method for obtaining the first mapping relationship in the controller identification mode, and is not described again here. The controller sends the first mapping relationship to the policy execution node, i.e., the gateway, through the southbound interface.

At the same time, based on the gateway learning terminal's message or table entry, such as ARP message or table entry, and ND message or table entry, when the gateway obtains the message or table entry, it can obtain the third mapping relationship between the terminal's MAC address information and IPv6 address information by parsing the message or table entry.

Further, the gateway generates a second mapping relationship between the IPv6 address information and the user group based on the third mapping relationship and the first mapping relationship, and then the gateway determines the traffic policy of the IPv6 address information according to the second mapping relationship. For example, the gateway notifies the second mapping relationship to the solution application component of the policy companion to perform policy association. At the same time, the gateway also installs the second mapping relationship into the host table.

In some implementations, when receiving an ND message or an ND table entry, the policy execution node parses the message to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal.

Additionally or alternatively, when the controller sends the traffic policy corresponding to the IPv4 address, the controller can send the correspondence between the IPv4 address information and the user group to the policy execution node. The policy execution node obtains the correspondence between the IPv4 address and the MAC address of the terminal based on the received ARP message or ARP table entry, and then obtains the first mapping relationship in combination with the traffic policy corresponding to the IPv4 address.

The policy execution node generates a second mapping relationship between the IPv6 address information and the user group based on the first mapping relationship and the third mapping relationship, and determines the IPv6 address of the terminal based on the second mapping relationship. Corresponding traffic strategy.

Through the above method, when the gateway is configured as a policy execution node, there is no need to send messages or table entries to the controller. The IPv6 address information of the terminal is directly associated with the user group based on the gateway to achieve policy-based mobility of the terminal IPv6 service traffic.

Figure 5 is a flow chart of a method for determining a traffic strategy provided by an embodiment of the present application. The method for determining a traffic strategy is applied to a policy execution point. As shown in Figure 5, the process includes the following steps.

S51, obtaining first information, wherein the first information corresponds to a first message from a gateway, and the first information indicates a first corresponding relationship between an IPv6 address of a terminal and a MAC address of the terminal.

S52, obtaining a first mapping relationship, wherein the first mapping relationship indicates a relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and a traffic policy corresponding to the IPv4 address of the terminal.

S53: Determine a traffic policy corresponding to the IPv6 address of the terminal based on the first information and the first mapping relationship.

In this implementation, a first message is obtained from a gateway, and first information is determined based on the first message to determine a first correspondence between the IPv6 address of the terminal and the MAC address of the terminal, and a traffic policy corresponding to the IPv6 address of the terminal is determined based on the first information and the first mapping relationship. In this implementation, there is no need for the authentication device to support IPv6 authentication and audit functions, nor is there a need to set a private message in the authentication message to carry IPv6-related information, thereby achieving decoupling of the traffic policy determination process of the IPv6 address information of the terminal from the authentication device, reducing the burden on the authentication device.

In some implementations, the policy execution node obtains a first mapping relationship from the controller, wherein the first mapping relationship is a mapping relationship between the IPv4 address and MAC address of the terminal and the traffic policy corresponding to the IPv4 address of the terminal. The policy execution node determines the traffic policy corresponding to the IPv4 address of the terminal based on the first mapping relationship, and determines the traffic policy corresponding to the IPv6 address of the terminal based on the first corresponding relationship and the traffic policy corresponding to the IPv4 address of the terminal.

In some implementations, the policy execution node obtains second information, wherein the second information corresponds to a second message from the gateway, and the second information indicates a second correspondence between the IPv4 address of the terminal and the MAC address of the terminal. The policy execution node obtains third information from the controller, wherein the third information indicates a correspondence between the IPv4 address of the terminal and the traffic policy corresponding to the IPv4 address of the terminal. The policy execution node obtains the first mapping relationship based on the second information and the third information.

It should be noted that in the above embodiments, there is no restriction on the number of policy execution nodes and terminals. The terminals include but are not limited to: mobile phones, tablet computers, laptop computers, PDAs, mobile Internet devices (English: Mobile Internet Device, abbreviated as MID), wearable devices, virtual reality (English: Virtual Reality, abbreviated as VR) devices, augmented reality (English: Augmented Reality, abbreviated as AR) devices, wireless terminal devices in industrial control, wireless terminal devices in unmanned driving, wireless terminal devices in smart grids, wireless terminal devices in transportation safety, wireless terminal devices in smart cities, or wireless terminal devices in smart homes, etc.

Based on the same inventive concept, a traffic strategy determination device is also provided in an embodiment of the present application, as shown in FIG6 , which is a structural diagram of a traffic strategy determination device provided in an embodiment of the present application. The traffic strategy determination device may be a policy execution node.

The device comprises: an acquisition module 51, which is used to acquire a first mapping relationship and a message of a terminal in response to a user operation of selecting a target recognition mode, wherein the first mapping relationship represents the relationship between the MAC address information, IPv4 address information and user group of the terminal.

The generating module 52 is used to generate a second mapping relationship between the IPv6 address information of the terminal and the user group according to the first mapping relationship and the message.

The traffic policy determination module 53 is used to determine the traffic policy of the IPv6 address information according to the second mapping relationship.

In a possible implementation manner, the target identification mode is any one of a controller identification mode, a local Ethernet virtual private network EVPN identification mode, and a local gateway identification mode.

In a possible design, the acquisition module 51 is specifically used to: in response to a user operation of selecting the controller identification mode, acquire the first mapping relationship of the terminal and the message based on the controller.

The generating module 52 is specifically configured to: parse the message based on the controller to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal.

The controller generates a second mapping relationship between the IPv6 address information and the user group based on the third mapping relationship and the first mapping relationship, so that the policy execution node determines the traffic policy of the IPv6 address information according to the second mapping relationship.

In a possible design, the acquisition module 51 is further used to: in response to a user operation of selecting the local EVPN identification mode, acquire the first mapping relationship of the terminal based on the controller, and acquire the message of the terminal based on the policy execution node.

The generating module 52 is further configured to: send the first mapping relationship to the policy execution node based on the controller, and parse the message based on the policy execution node to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal.

The policy execution node generates a second mapping relationship between the IPv6 address information and the user group based on the third mapping relationship and the first mapping relationship.

In a possible implementation manner, the acquisition module 51 is further configured to: in response to a user operation of selecting the local gateway identification mode, acquire the first mapping relationship of the terminal based on the controller, and acquire the message of the terminal based on the gateway.

The generating module 52 is further configured to: send the first mapping relationship to the gateway based on the controller, and parse the message based on the gateway to obtain a third mapping relationship between the MAC address information and the IPv6 address information of the terminal.

The gateway generates a second mapping relationship between the IPv6 address information and the user group based on the third mapping relationship and the first mapping relationship.

The above-mentioned traffic strategy determination device generates a second mapping relationship between the IPv6 address information and the user group, and determines the traffic strategy of the IPv6 address information according to the second mapping relationship, thereby realizing the policy accompanying the terminal IPv6 service traffic.

Referring to Fig. 8, it is a schematic diagram of the structure of a traffic strategy determination device provided in an embodiment of the present application. The traffic strategy determination device may be a policy execution node.

The device includes: an acquisition module 71, used to obtain first information and a first mapping relationship, wherein the first information corresponds to a first message from a gateway, the first information indicates a first correspondence between an IPv6 address of a terminal and a MAC address of the terminal; and the first mapping relationship indicates a relationship between an Internet Protocol version 4 IPv4 address of the terminal, the MAC, and a traffic policy corresponding to the IPv4 address of the terminal.

The traffic policy determination module 72 is used to determine the traffic policy corresponding to the IPv6 address of the terminal based on the first information and the first mapping relationship.

Based on the same inventive concept, an electronic device is also provided in an embodiment of the present application, and the electronic device can realize the function of the aforementioned traffic strategy determination device. Referring to Figure 7, the electronic device includes: at least one processor 61, and a memory 62 connected to at least one processor 61. The specific connection medium between the processor 61 and the memory 62 is not limited in the embodiment of the present application. Figure 7 takes the connection between the processor 61 and the memory 62 through the bus 60 as an example. The bus 60 is represented by a thick line in Figure 7, and the connection method between other components is only for schematic illustration and is not limited. The bus 60 can be divided into an address information bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in Figure 7, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 61 can also be called a controller, and there is no restriction on the name.

In the embodiment of the present application, the memory 62 stores instructions that can be executed by at least one processor 61, and the at least one processor 61 can execute the traffic strategy determination method discussed above by executing the instructions stored in the memory 62. The processor 61 can implement the functions of each module in the device shown in Figures 6 and 8.

Among them, the processor 61 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 62 and calling data stored in the memory 62, the various functions of the device and processing data, the device can be monitored as a whole.

In a possible design, the processor 61 may include one or more processing units, and the processor 61 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 61. In some embodiments, the processor 61 and the memory 62 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

The processor 61 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and may implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the traffic policy determination method disclosed in the embodiments of the present application may be directly embodied as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

The memory 62 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs, and modules. The memory 62 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory, or a memory card. Machine access memory (English: Random Access Memory, abbreviated as RAM), static random access memory (English: Static Random Access Memory, abbreviated as SRAM), programmable read-only memory (English: Programmable Read Only Memory, abbreviated as PROM), read-only memory (English: Read Only Memory, abbreviated as ROM), electrically erasable programmable read-only memory (English: Electrically Erasable Programmable Read-Only Memory, abbreviated as EEPROM), magnetic storage, magnetic disk, optical disk, etc. The memory 62 is any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by the computer, but is not limited to this. The memory 62 in the embodiment of the present application can also be a circuit or any other device that can realize the storage function, used to store program instructions and/or data.

By designing and programming the processor 61, the code corresponding to the traffic policy determination method described in the above embodiment can be fixed into the chip, so that the chip can execute the steps of the traffic policy determination method of the embodiment shown in Figures 1 and 5 when running. How to design and program the processor 61 is a technology known to those skilled in the art and will not be described in detail here.

Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the traffic strategy determination method discussed above.

In some possible implementations, various aspects of the traffic policy determination method provided in the present application can also be implemented in the form of a program product, which includes a program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of the traffic policy determination method according to various exemplary embodiments of the present application described above in this specification.

Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

The present application is described with reference to the flowchart and/or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and/or box in the flowchart and/or block diagram, and the combination of the process and/or box in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one process or multiple processes in the flowchart and/or one box or multiple boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the flowchart. The steps of a process or multiple processes and/or the functions specified in one or more blocks of a block diagram.

Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims (20)

A method for determining a traffic strategy, wherein the method is applied to a policy execution node, and the method comprises: Acquire first information, wherein the first information corresponds to a first message from a gateway, and the first information indicates a first correspondence between an Internet Protocol version 6 IPv6 address of a terminal and a media access control MAC address of the terminal; Acquire a first mapping relationship, wherein the first mapping relationship indicates a relationship between an Internet Protocol version 4 IPv4 address of the terminal, the MAC, and a traffic policy corresponding to the IPv4 address of the terminal; and Based on the first information and the first mapping relationship, determine the traffic policy corresponding to the IPv6 address of the terminal. The method according to claim 1, wherein the determining, based on the first information and the first mapping relationship, a traffic policy corresponding to the IPv6 address of the terminal comprises: Based on the traffic policy corresponding to the IPv4 address of the terminal, determine the traffic policy corresponding to the IPv6 address of the terminal; wherein the traffic policy corresponding to the IPv6 address of the terminal is the same as the traffic policy corresponding to the IPv4 address of the terminal. The method according to claim 1 or 2, wherein obtaining the first mapping relationship comprises: The first mapping relationship is obtained from the controller through a network configuration protocol NETCONF interface. The method according to claim 1 or 2, wherein obtaining the first mapping relationship comprises: Acquire second information, wherein the second information corresponds to a second message from the gateway, and the second information indicates a second correspondence between the IPv4 address of the terminal and the MAC address of the terminal; Acquire third information, wherein the third information indicates a correspondence between the IPv4 address of the terminal and a traffic policy corresponding to the IPv4 address of the terminal; and The first mapping relationship is acquired based on the second information and the third information. The method according to claim 4, wherein the obtaining the second information comprises: The second information is obtained from the gateway through an Ethernet-based virtual private network EVPN; wherein the gateway and the policy execution node are in a Border Gateway Protocol BGP neighbor relationship, and the second message is one of the following messages: an Address Resolution Protocol ARP message, an ARP table entry, a Dynamic Host Configuration Protocol snooping DHCP Snooping message or a DHCP Snooping table entry. The method according to claim 4, wherein the obtaining the second information comprises: The second information is obtained from the controller through the network configuration protocol NETCONF interface; wherein, The second message is an ARP message or an ARP table entry. The method according to claim 4, wherein the obtaining the second information comprises: The second information is directly obtained from the gateway, wherein the policy execution node is set on the gateway, and the second message is an ARP message or an ARP table entry. The method according to any one of claims 1 to 7, wherein the obtaining the first information comprises: The first information is obtained from the gateway through an Ethernet-based virtual private network EVPN; wherein the gateway and the policy execution node are in a Border Gateway Protocol BGP neighbor relationship, and the first message is one of the following messages: a neighbor discovery ND message, an ND table entry, a neighbor discovery snooping ND Snooping message or an ND Snooping table entry. The method according to any one of claims 1 to 7, wherein the obtaining the first information comprises: The first information is obtained from the controller through a network configuration protocol NETCONF interface; wherein the first message is an ND message or an ND table entry. The method according to any one of claims 1 to 7, wherein the obtaining the first information comprises: The first information is directly obtained from the gateway, wherein the policy execution node is set on the gateway, and the first message is an ND message or an ND table entry. A method for determining a traffic strategy, wherein the method is applied to a gateway, and the method comprises: A first message is sent, wherein the first message allows a policy execution node to determine a traffic policy corresponding to the IPv6 address of the terminal based on first information and a first mapping relationship; wherein the first information corresponds to a first message from a gateway, the first information indicates a first correspondence between the IPv6 address of the terminal and the MAC address of the terminal; and the first mapping relationship is a relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal. The method according to claim 11, wherein the sending the first message comprises: A first message is sent through an Ethernet-based virtual private network EVPN; wherein the gateway and the policy execution node are in a Border Gateway Protocol BGP neighbor relationship, and the first message is one of the following messages: a neighbor discovery ND message, an ND table entry, a neighbor discovery snooping ND Snooping message or an ND Snooping table entry. The method according to claim 11, wherein the sending the first message comprises: The first message is sent to the controller through a remote procedure call protocol GRPC interface or a NETCONF interface to allow the controller to send the first message to the policy execution node; wherein the first message is a neighbor discovery ND message or an ND table entry. The method according to claim 11, wherein the sending the first message comprises: The first message is directly sent to the policy execution node; wherein the policy execution node is set on the gateway, and the first message is an ND message or an ND table entry. The method according to any one of claims 11 to 14, wherein before sending the first message and the second message, the method further comprises: The first message and the second message are learned from the terminal. A method for determining a traffic strategy, wherein the method is applied to a controller, and the method comprises: receiving a first message sent by the gateway; and The first message is sent to a policy execution node, wherein the first message allows the policy execution node to determine a traffic policy corresponding to the IPv6 address of the terminal based on first information and a first mapping relationship; wherein the first information corresponds to a first message from a gateway, wherein the first information indicates a first correspondence between the IPv6 address of the terminal and the MAC address of the terminal; and the first mapping relationship is a relationship between the Internet Protocol version 4 IPv4 address of the terminal, the MAC, and the traffic policy corresponding to the IPv4 address of the terminal. The method according to claim 16, wherein the method further comprises: The first mapping relationship is sent to the policy execution node through a network configuration protocol NETCONF interface. The method according to claim 16, wherein the method further comprises: receiving a second message sent by the gateway; Sending second information and third information to the policy execution node; wherein the second information and the third information allow the policy execution node to determine the first mapping relationship; the second information corresponds to a second message from the gateway, and the second information indicates a second correspondence between the IPv4 address of the terminal and the MAC address of the terminal; and the third information indicates a correspondence between the IPv4 address of the terminal and the traffic policy corresponding to the IPv4 address of the terminal. An electronic device, comprising: Memory, used to store computer programs; A processor, for implementing the method steps of any one of claims 1 to 10, claims 11 to 15, or claims 16 to 18 when executing the computer program stored in the memory. A computer-readable storage medium, characterized in that a computer program is stored in the computer-readable storage medium, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 10 or claims 11 to 15 or claims 16 to 18 are implemented.