CN220693169U - Core network architecture - Google Patents

Abstract

The present application discloses a core network architecture. It includes: a first data center module and a second data center module, wherein the first data center module is connected to the second data center module, and the first data center module and the second data center module have the same component units, both including: a network management server and a heartbeat network switch; the network management server is used to manage and monitor network equipment in the core network and provide business services to users; the heartbeat network switch is connected to the network management server, and the heartbeat network switch of the first data center module is connected to the heartbeat network switch of the second data center module, which is used to transmit control information, configuration information and synchronize data between the first data center module and the second data center module. The present application solves the technical problem that due to the poor security protection level of the network management network of the communication system in the related technology, it is easy to cause network security operation risks caused by abnormal communication equipment.

Description

Core network architecture

Technical field

This application relates to the field of network communication technology, specifically, to a core network architecture.

Background technique

With the acceleration of the construction of new power systems in the power grid, the scale of power communication networks is increasing day by day, and the power grid has put forward higher requirements for the security, stability and carrying capacity of power communication networks. The communication system network management network in related technologies has poor centralized monitoring capabilities and poor security protection levels, and is prone to network security operation risks caused by abnormal communication equipment.

To address the above-mentioned problems, no effective solution has been proposed yet.

Utility model content

Embodiments of the present application provide a core network architecture to at least solve the technical problem that due to the poor security protection level of the communication system network management network in related technologies, network security operation hazards caused by abnormal communication equipment are prone to occur.

According to one aspect of an embodiment of the present application, a core network architecture is provided, including: a first data center module and a second data center module, wherein the first data center module is connected to the second data center module, and the first data center module and the second data center module have the same component units, both including: a network management server and a heartbeat network switch; the network management server is used to manage and monitor network equipment in the core network and provide business services to users; the heartbeat network switch is connected to the network management server, and the heartbeat network switch of the first data center module is connected to the heartbeat network switch of the second data center module, for transmitting control information, configuration information and performing data synchronization between the first data center module and the second data center module.

Optionally, both the first data center module and the second data center module include client access switches, wherein the client access switches are simultaneously connected to the core switch of the first data center module and the second data center module. Core switch connection, client access switch is used to provide access services for network management clients.

Optionally, the network management client is connected to the client access switch, and is used to provide the target object with a front-end interactive interface for monitoring, managing, and configuring network equipment in the core network.

Optionally, the core switch is connected to the network management server through the service switch and is responsible for forwarding data traffic in the core network.

Optionally, the service switches in the first data center module and the second data center module are connected to the core switch of the first data center module and the core switch of the second data center module at the same time, and the service switches are used to implement different services. Traffic forwarding and switching.

Optionally, the core switch of the first data center module and the core switch of the second data center module are respectively connected to a load balancing device, and the core switch of the first data center module and the core switch of the second data center module are interconnected, wherein the load balancing device is used to evenly distribute network traffic to different servers or network devices in the core network.

Optionally, the core switch of the first data center module and the core switch of the second data center module are both connected to the egress route of the first data center module and the egress route of the second data center module at the same time, where the egress route is used for connectivity. Core network and external network.

Optionally, the egress route of the first data center module and the egress route of the second data center module are interconnected through bare optical fiber.

Optionally, a border firewall is connected to each link between the core switch and the egress route. The border firewall is used to monitor and filter network traffic in and out of the core network.

Optionally, each link connecting the core switch and the egress route is also connected to a vertical encryption device, where the vertical encryption device is used to encrypt and decrypt links transmitted in the link.

In the embodiment of the present application, a first data center module and a second data center module are used, wherein the first data center module is connected to the second data center module, and the constituent units of the first data center module and the second data center module are The same, including: network management server and heartbeat network switch; network management server, used to manage and monitor network equipment in the core network, and provide business services to users; heartbeat network switch is connected to the network management server, and the heartbeat of the first data center module The network switch is connected to the heartbeat network switch of the second data center module and is used to transmit control information, configuration information and data synchronization between the first data center module and the second data center module. The two data centers communicate with each other. Backup, two data centers share storage, network and server resources. Both data centers can provide services to the outside world, achieving the purpose of making the entire system have business load balancing and automatic failover functions, thus solving the communication problems in related technologies. The level of security protection of the system network management network is poor, which makes it prone to technical problems such as network security operation risks caused by abnormal communication equipment.

Description of drawings

The drawings described here are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation of the present application. In the attached picture:

FIG1 is a schematic diagram of a core network architecture according to an embodiment of the present application;

Figure 2 is a schematic diagram of a network management network core layer backup design provided according to an embodiment of the present application.

Detailed ways

In order to enable those in the technical field to better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only These are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by those of ordinary skill in the art without creative efforts should fall within the scope of protection of this application.

It should be noted that the terms "first", "second", etc. in the description and claims of this application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances so that the embodiments of the application described herein can be practiced in sequences other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, e.g., a process, method, system, product, or apparatus that encompasses a series of steps or units and need not be limited to those explicitly listed. Those steps or elements may instead include other steps or elements not expressly listed or inherent to the process, method, product or apparatus.

In the related art, the centralized monitoring capability and security protection level of the communication system network management network are poor, so there is a problem of network security operation hidden dangers caused by abnormal communication equipment. In order to solve this problem, the embodiments of the present application provide relevant solutions, which are described in detail below.

According to an embodiment of the present application, an embodiment of a core network architecture is provided. FIG. 1 is a structural diagram of a core network architecture provided according to an embodiment of the present application. As shown in FIG. 1 , the core network architecture includes: a first data center module and a second data center module, wherein:

The first data center module is connected to the second data center module, and the first data center module and the second data center module have the same components, including: a network management server and a heartbeat network switch;

Specifically, in order to ensure the reliability of the core network, the solution of this application uses two data center modules (the first data center module and the second data center module) to back up each other. The two data center modules share storage, network and server resources. Both data center modules can provide external services, and the entire system has business load balancing and automatic failover functions.

Network management server is used to manage and monitor network equipment in the core network and provide business services to users;

Among them, the network management server is a key device in the communication network, and its functions mainly include the following aspects: Network monitoring and management: The network management server can monitor and manage network equipment in the communication network, including switches, routers, firewalls, servers, etc. Through the network management server and gateway client, administrators can monitor the operating status and performance indicators of network equipment in real time, and promptly discover and solve network faults and problems. Configure and manage network devices: The network management server can centrally manage the configuration information of network devices, including IP addresses, routing tables, access control lists, etc. Administrators can centrally configure and manage network devices through the network management server to improve configuration consistency and reliability. Security management and protection: The network management server can implement network security policies, including access control, intrusion detection and prevention, traffic monitoring and restrictions, etc. Through the network management server, administrators can safely manage and protect network equipment to ensure the security and reliability of the communication network. Performance optimization and troubleshooting: The network management server can collect and analyze performance data of network equipment, including bandwidth utilization, delay, packet loss rate, etc. Administrators can optimize the performance of network equipment through the network management server to improve network availability and performance. At the same time, the network management server can also help administrators locate and eliminate network faults and shorten fault recovery time. Resource management and optimization: The network management server can manage and optimize the resources of network equipment, including port utilization, bandwidth allocation, load balancing, etc. Through the network management server, administrators can effectively configure and manage network resources to improve resource utilization efficiency and network reliability. In short, the network management server plays an important role in monitoring, management, configuration, security, performance optimization and troubleshooting in the communication network. It is crucial to ensure the normal operation of the communication network and improve network performance.

Specifically, multiple network management server devices are deployed in the two data center modules respectively. A network management system is deployed in each of the first data center module and the second data center module to form a cluster, which provides read and write services for the host services of the two data centers at the same time; in order to achieve unified management of the network management server devices of the two data center modules, unified disaster recovery management software can also be deployed to achieve visual management of the two centers through the unified disaster recovery management software, and intuitively display the physical topology of the active-active service through the management software.

The heartbeat network switch is connected to the network management server, and the heartbeat network switch of the first data center module is connected to the heartbeat network switch of the second data center module for transmitting control information between the first data center module and the second data center module. Configuration information and data synchronization.

Among them, the main functions of the heartbeat network switch are as follows: Heartbeat monitoring: The heartbeat network switch will regularly send heartbeat signals to other nodes in the network to monitor the survival status of each node. If a node does not receive a heartbeat signal for a long time, it can be determined that the node may be faulty or disconnected, and corresponding measures can be taken. Data transmission: Heartbeat network switches can realize data transmission between nodes. When a node needs to send data to other nodes, routing and forwarding can be performed through the heartbeat network switch to ensure efficient transmission of data in the network. Data synchronization: Heartbeat network switches can achieve data synchronization between nodes. When a node needs to synchronize data with other nodes, the data can be copied and transmitted through the heartbeat network switch to ensure data consistency between each node. In short, heartbeat network switches play an important role in monitoring node status, transmitting data, and synchronizing data in the heartbeat network, improving the reliability and availability of the network.

In this application solution, the principle of separate design of data transmission links and heartbeat links is adopted. Isolate end-to-end traffic through VLAN (Virtual Local Area Network, virtual LAN) or VRF (Virtual Routing and Forwarding, virtual routing and forwarding), and allocate independent physical interconnection links to separate business traffic and cluster heartbeat traffic. They do not affect each other. Layer 2 Ethernet is used to realize the heartbeat and synchronous interconnection link communication of the host application cluster between the two centers.

The core network architecture of the embodiment of the present application is further introduced below.

FIG2 is a schematic diagram of a network management network core layer backup design provided according to an embodiment of the present application, as shown in FIG2 .

This application plan divides the core network into the access layer, the core layer and the egress layer. The structure of each layer is introduced below.

Among them, the access layer includes: multiple client access switches, service switches, heartbeat network switches, etc. In this embodiment, 2 client access switches, 2 service switches, and Two heartbeat network switches are used as an example for explanation.

In this embodiment, the two heartbeat network switches in the first data center module are virtualized into one device through stacking, and are interconnected with the heartbeat network switches in the opposite data center (the second data center module). The same applies to heartbeat network switches.

Four heartbeat network service switches can be cascaded through 10GE through bare optical fiber to transmit control information, configuration information and data synchronization.

In some embodiments of the present application, both the first data center module and the second data center module include client access switches, wherein the client access switches are simultaneously connected to the core switch of the first data center module, and the third data center module The core switch of the second data center module is connected, and the client access switch is used to provide access services for network management clients.

In some embodiments of the present application, the network management client is connected to the client access switch and is used to provide the target object with a front-end interactive interface for monitoring, managing, and configuring network equipment in the core network.

Specifically, the client access switch is stacked through 10GE dual links to simplify configuration and management. A gigabit single link is used to connect down to the network management client, and a 10GE dual link is used to connect to the first data center module and the second data center respectively. The core switch of the central module improves redundancy and reliability while providing access needs for client users.

In some embodiments of this application, the core switch is connected to the network management server through the service switch and is responsible for forwarding data traffic in the core network.

In some embodiments of the present application, the service switches in the first data center module and the second data center module are both connected to the core switch of the first data center module and the core switch of the second data center module at the same time. The service switches use To realize the forwarding and exchange of different business traffic.

Specifically, the service switches also use stacking to simplify network structure and protocol deployment, and are connected down to the network management server through 10GE optical fiber, and uplinked to the core switches of the first data center module and the second data center module through 10GE optical fiber.

The core layer is further introduced below.

In some embodiments of the present application, the core switch of the first data center module and the core switch of the second data center module are respectively connected to a load balancing device, and the core switch of the first data center module is connected to the core switch of the second data center module. Core switches are connected to each other, and load balancing devices are used to evenly distribute network traffic to different servers or network devices in the core network.

In this embodiment, one core switch is deployed at the core layer of the first data center module and the second data center module in the core network. Downlink client access switches and service switches are connected to the load balancing equipment. Uplink boundary security Equipment (for example, border firewall, etc.) forwards network traffic in the core network and is responsible for high-speed interconnection of the entire network management network.

Among them, load balancing equipment is mainly used to distribute and manage network traffic to ensure efficient utilization of network resources and load balancing. In this embodiment, the load balancing device in the core network may include but is not limited to at least one of: Load Balancer: A load balancer is a device that can distribute traffic to multiple servers or network devices. It evenly distributes traffic to different servers based on preset load balancing algorithms, such as round-robin, weighted round-robin, minimum connection, etc., to avoid overloading a single server. Link Load Balancer: Link load balancer is used to distribute traffic to different network links to achieve load balancing of network links. It can select appropriate links to distribute traffic based on link load conditions and performance indicators to improve network reliability and performance. Server Load Balancer: Server Load Balancer is used to distribute traffic to multiple servers to balance the load of the server. It can select appropriate servers to distribute traffic based on the server's load, performance indicators and health status to improve server availability and performance. DNS Load Balancer: DNS load balancer distributes traffic to multiple servers by load balancing the results of domain name resolution. It can select the appropriate server IP address and return it to the client based on the server's load condition and performance indicators to achieve traffic load balancing.

Load balancing equipment can adjust load balancing policies and monitor traffic through configuration, monitoring and management software. They play a key role in the core network and can improve the performance, reliability and scalability of the network.

Two core switches can be cascaded using 10GE to back up the egress network through two pairs of bare optical fibers.

As an optional implementation, the communication management system (SG-TMS) can also be interconnected with the core switches of the first data center module and the second data center module through horizontal isolation. Specifically, the SG-TMS system uses bare The optical fiber is interconnected with the core switches of the first data center module and the second data center module. The SG-TMS system is reachable by route to each network management system. It collects data and issues instructions through the northbound interface to provide normalized management of resource data. Provide real-time monitoring of equipment from multiple manufacturers at the same time;

Among them, the communication management system (SG-TMS) is a software system used to manage and monitor communication networks. It helps effectively manage and maintain their communications equipment and networks. SG-TMS has the following functions: Device management: SG-TMS can monitor and manage communication devices, such as routers, switches, firewalls, etc. It detects the status, performance, and health of your device and provides real-time alerts and notifications. Network monitoring: SG-TMS can monitor the performance and traffic of the entire communication network. It can monitor network throughput, latency, and packet loss in real time and generate reports and statistics. Fault management: SG-TMS can help identify and resolve faults in communication networks. It automatically detects faults and sends alerts, while providing guidance on troubleshooting and recovery. Configuration management: SG-TMS can centrally manage and configure the settings of communication devices. It helps administrators configure devices remotely, backup and restore configurations, and ensure consistency across devices. Security management: SG-TMS can monitor and manage the security of communication networks. It detects and blocks potential security threats and provides security auditing and logging capabilities. By using SG-TMS, the reliability, performance and security of communication networks can be improved, faults and downtime can be reduced, and operation and maintenance efficiency can be improved.

The export layer is further introduced below. The egress layer is the boundary from the core network (internal network) to the external network. In this embodiment, egress routers, vertical encryption devices, border firewalls, etc. are deployed in each data center module of the egress layer.

In some embodiments of the present application, the core switch of the first data center module and the core switch of the second data center module are both connected to the egress route of the first data center module and the egress route of the second data center module at the same time, wherein, Egress routing is used to connect the core network and external networks.

In some embodiments of the present application, the egress route of the first data center module and the egress route of the second data center module are interconnected via a bare optical fiber.

In some embodiments of the present application, a border firewall is connected to each link connecting the core switch and the egress router, wherein the border firewall is used to monitor and filter network traffic entering and leaving the core network.

In some embodiments of the present application, each link connecting the core switch and the egress route is also connected to a vertical encryption device, where the vertical encryption device is used to encrypt and encrypt the links transmitted in the link. Decrypt.

Among them, egress routing is used to solve the problem of interconnection between internal and external networks. Specifically, the role of the egress router in the core network is to transmit data packets from the local network to the target network. The egress router is responsible for finding the best path and forwarding the packet to the next network node according to the routing table until it finally reaches the destination network. The egress router can also perform functions such as network address translation (NAT) and network packet filtering to increase network security and optimize network performance.

Vertical encryption devices and firewalls are used to provide boundary security protection capabilities. Specifically, the role of vertical encryption devices in the core network is to encrypt data to protect the confidentiality and integrity of the data. By encrypting data, you can prevent unauthorized individuals or organizations from obtaining sensitive information and ensure that data is not tampered with or stolen during transmission. The function of the border firewall is to protect the boundary between the core network and the external network to prevent unauthorized access and attacks. The border firewall can monitor and filter network traffic in and out of the core network, block potential threats and malicious activities according to the set security policy, and improve the security and stability of the core network.

In summary, the role of vertical encryption devices and border firewalls in the core network is to enhance data security and protect the core network from network attacks.

Specifically, the egress routers of the two data center modules are interconnected through bare optical fiber; the core switch of the first data center module is connected to the border firewall and vertical encryption device, and is interconnected with the egress router of the second data center module; The core switch of the data center module is connected to the border firewall and vertical encryption equipment, and is interconnected with the egress router of the first data center module to transmit business data.

Through the above solution, the two data centers back up each other. The two data centers share storage, network and server resources. Both data centers can provide services to the outside world, achieving the goal of enabling the entire system to have business load balancing and automatic failover functions. The purpose is to improve the centralized monitoring capabilities and security protection level of the communication system, improve the reliability and security of communication equipment monitoring, and then solve the problem of easy occurrences caused by abnormal communication equipment due to the poor security protection level of the communication system network management network in related technologies. Technical issues with hidden dangers in network security operations.

The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are only illustrative. For example, the division of the units may be a logical functional division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or may be Integrated into another system, or some features can be ignored, or not implemented. On the other hand, the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the units or modules may be in electrical or other forms.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit. The above integrated units can be implemented in the form of hardware or software functional units.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or CD-ROM and other media that can store program codes.

The above are only the preferred embodiments of the present application. It should be pointed out that for those of ordinary skill in the art, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications can also be made. should be regarded as the scope of protection of this application.

Claims (10)

1. A core network architecture, comprising: a first data center module and a second data center module, wherein: The first data center module is connected to the second data center module, and the first data center module and the second data center module have the same component units, both including: a network management server and a heartbeat network switch; The network management server is used to manage and monitor network equipment in the core network, and provide business services to users; The heartbeat network switch is connected to the network management server, and the heartbeat network switch of the first data center module is connected to the heartbeat network switch of the second data center module for controlling the first data Control information, configuration information and data synchronization are transmitted between the central module and the second data center module. 2. The core network architecture according to claim 1, wherein the first data center module and the second data center module each include a client access switch, wherein, The client access switches are connected to the core switch of the first data center module and the core switch of the second data center module at the same time, and the client access switches are used to provide access services for the network management client. 3. According to the core network architecture described in claim 2, it is characterized in that the network management client is connected to the client access switch to provide a front-end interactive interface for the target object to monitor, manage and configure the network equipment in the core network. 4. The core network architecture according to claim 3, wherein the core switch is connected to the network management server through a service switch and is responsible for forwarding data traffic in the core network. 5. The core network architecture according to claim 4, characterized in that the service switches in the first data center module and the second data center module are simultaneously connected to the core of the first data center module. The switch is connected to the core switch of the second data center module, and the service switch is used to forward and switch different service traffic. 6. The core network architecture according to claim 3, wherein the core switch of the first data center module and the core switch of the second data center module are respectively connected to a load balancing device, And the core switch of the first data center module and the core switch of the second data center module are connected to each other, wherein the load balancing device is used to evenly distribute network traffic to the core network. Different servers or network devices. 7. The core network architecture according to claim 6, characterized in that, the core switch of the first data center module and the core switch of the second data center module all communicate with the first data center module at the same time. The egress route of the central module is connected to the egress route of the second data center module, where the egress route is used to connect the core network and the external network. 8. The core network architecture according to claim 7 is characterized in that the export route of the first data center module and the export route of the second data center module are interconnected through bare optical fiber. 9. The core network architecture according to claim 7, characterized in that each link connecting the core switch and the egress route is connected to a border firewall, wherein the border firewall is used to Monitor and filter network traffic to and from the core network. 10. The core network architecture according to claim 9, characterized in that each link connecting the core switch and the egress route is also connected to a vertical encryption device, wherein the vertical encryption The device is used to encrypt and decrypt data transmitted over the link.