WO2013170698A1

WO2013170698A1 - Method for processing message after migration of virtual machine vm and device thereof

Info

Publication number: WO2013170698A1
Application number: PCT/CN2013/074854
Authority: WO
Inventors: 张大成
Original assignee: 华为技术有限公司
Priority date: 2012-05-16
Filing date: 2013-04-27
Publication date: 2013-11-21
Also published as: CN103428106B; CN103428106A

Abstract

Disclosed is a method for processing a message after the migration of a virtual machine VM, comprising: after the migration of a VM, applying a security policy corresponding to the VM to a network security device corresponding to the VM after the migration. Also provided are a corresponding network security device and network device. After the migration of a VM, by applying a security policy corresponding to the VM to a network security device corresponding to the VM after the migration, the technical solution of the embodiments of the present invention does not need to forward a message sent by the VM after the migration to the network security device corresponding to the VM before the migration for processing, thus improving the message forwarding efficiency of the VM.

Description

Method and device for processing message after virtual machine VM migration

This application claims the priority of the Chinese patent application filed on May 16, 2012, the Chinese Patent Office, the application number is 201210151792.3, and the invention name is "the method of processing the message after the migration of the virtual machine VM and its equipment". This is incorporated herein by reference. The present invention relates to the field of communications technologies, and in particular, to a packet processing method and device thereof after a virtual machine VM is migrated. BACKGROUND When a virtual machine (VM) migrates in a data center or across a data center, the network path through which the traffic sent or received by the migrated VM flows changes, and the migrated traffic may flow through different paths. Network security device. Thus, when a network security device (such as a firewall) receives a message from a VM newly migrated to the security domain, it may not be able to handle it properly due to the lack of a corresponding security policy corresponding to the VM.

For example, the data center has a first host and a second host, the first host is connected to the first firewall through the first switch, and the second host is connected to the second firewall through the second switch, where the first host is There is a first VM, and the packet traffic sent by the first VM is sent by the first firewall, and a security policy corresponding to the first VM is deployed on the first firewall, so that the first VM is configured. A VM can communicate with the outside world through the first firewall. After the first VM is migrated from the first host to the second host, the packet sent by the first VM is forwarded to the second firewall by the second switch, but the There is no security policy corresponding to the first VM on the firewall, which may cause the second firewall to fail to correctly process the packet sent by the first VM, and the first VM is disconnected from the outside world. The device forwards the packet sent by the VM to the network security device that deploys the security policy corresponding to the VM through a Layer 2 device (such as a switch). Taking the scenario mentioned above as an example, when the first VM migrates from the first host to the second host, and the packet sent by the first VM passes through the second switch, the The second switch forwards the packet to the first switch, and the first switch forwards the packet to the first firewall, so that the first VM can still communicate with the outside world. The packets sent by the migrated VMs are forwarded to the network security device that is deployed with the security policy corresponding to the VM. As a result, the number of network nodes that the packets sent by the migrated VMs passes increases. The efficiency of text forwarding is low. Summary of the invention

The embodiment of the present invention provides a method for processing a packet after a virtual machine VM is migrated, and a method for resolving a security policy after the virtual machine VM is migrated, and a device for forwarding the packet sent by the migrated VM to the VM The corresponding network security device is processed before the migration to improve the forwarding efficiency of the VM packet. The prior art can forward the packet sent by the migrated VM to the deployed VM. The network security device of the security policy is processed. As a result, the number of network nodes that the packets sent by the migrated VMs passes through, that is, the VM packet forwarding path is not the optimal path, and the VM packet forwarding efficiency is low.

On the one hand, the embodiment of the present invention provides a method for processing a packet after a virtual machine VM is migrated, including: after the VM is migrated, the corresponding network security device receives the extended port control protocol (Port) sent by the network device after the VM is migrated. a Control Protocol (PCP) policy update message, the extended PCP policy update message carrying an identifier type of the VM, an identifier of the VM, and a security policy corresponding to the VM, an identifier type of the VM, the VM And the security policy corresponding to the VM is pre-stored on the network device;

The network security device applies a security policy corresponding to the VM, and processes the received packet from the VM.

On the other hand, the embodiment of the present invention provides another method for processing a message after migration of a virtual machine VM, including: After the VM is migrated, the network device obtains the identifier type of the VM and the identifier of the VM, and the network device pre-stores the identifier type of the VM, the identifier of the VM, and a security policy corresponding to the VM.

The network device constructs an extended port control protocol (PCP) policy update message according to the identifier type of the VM and the identifier of the VM, where the extended PCP policy update message carries the identifier type of the VM and the identifier of the VM. And a security policy corresponding to the VM;

And sending, by the network device, the extended PCP policy update message to the corresponding network security device after the VM is migrated.

On the other hand, an embodiment of the present invention provides a network security device, including:

a receiving unit, configured to receive, after the VM is migrated, an extended port control protocol (PCP) policy update message sent by the network device, where the extended PCP policy update message carries an identifier type of the VM, an identifier of the VM, and the a security policy corresponding to the VM, the identifier type of the VM, the identifier of the VM, and the security policy corresponding to the VM are pre-stored on the network device;

An execution unit is configured to apply a security policy corresponding to the VM, and process the received packet from the VM.

On the other hand, an embodiment of the present invention provides a network device, including:

a receiving unit, configured to obtain an identifier type of the VM and an identifier of the VM after the VM is migrated, and a storage unit, configured to pre-store an identifier type of the VM, an identifier of the VM, and a security corresponding to the VM Strategy

Constructing an update message unit, configured to construct an extended PCP policy update message according to the identifier type of the VM and the identifier of the VM, where the extended PCP policy update message carries the identifier type of the VM, and the VM Identifying and a security policy corresponding to the VM;

And a sending unit, configured to send the extended PCP policy update message to the corresponding network security device after the VM migration. After the VM is migrated, the security policy corresponding to the VM is applied to the corresponding network security device after the VM migration, which is not required by the embodiment of the present invention. The packets sent by the migrated VM are forwarded to the network security device corresponding to the VM before the VM is migrated, so as to improve the forwarding efficiency of VM packets. BRIEF DESCRIPTION OF DRAWINGS FIG. 1 is a schematic diagram of networking of VM migration in an embodiment of the present invention;

2 is a schematic diagram of networking of VM migration in an embodiment of the present invention;

FIG. 3 is a flowchart of a method for processing a message after migration of a virtual machine VM according to an embodiment of the present invention; FIG. 4 is a flowchart of another method for processing a message after migration of a virtual machine VM according to an embodiment of the present invention; FIG. 5 is a schematic diagram of a network security device according to an embodiment of the present invention;

6 is a schematic diagram of still another network security device according to an embodiment of the present invention;

FIG. 7 is a schematic diagram of a network device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The technical solutions of the embodiments of the present invention are further described in detail below with reference to the accompanying drawings and embodiments. FIG. 1 is a schematic diagram of networking of VM migration in an embodiment of the present invention. The first host is connected to the first network security device through the first switch, and the second host is connected to the second network security device through the second switch. The first network security device and the second network security device are network devices with security functions, such as firewalls, routers, switches, and the like. Initially, there are two virtual machine VMs on the first host, which are respectively a first VM and a second VM, and the security policies corresponding to the first VM and the second VM are pre-stored and deployed in the first network security. Device, so that the first VM and the second VM can communicate with the outside world through the first network security device, and the second network security The security policy corresponding to the first VM and the second VM is not pre-stored and deployed on the entire device. Thereafter, the first VM is migrated to the second host. As shown in FIG. 2, a schematic diagram of the networking of VM migration in an embodiment of the present invention, the difference between FIG. 2 and FIG. 1 is that the security policy corresponding to the first VM and the second VM is stored in advance and deployed in the first network security. The device is also pre-stored on a third-party server, and the third-party server can communicate with the first network security device and the second network security device. As shown in FIG. 3, the embodiment of the present invention provides a method for resolving a security policy loss after a virtual machine VM is migrated. For example, the method may be applied to the second network security device shown in FIG. The second network security device shown in FIG. The method includes:

After the VM is migrated, the corresponding network security device receives the extended PCP policy update message sent by the network device, and the extended PCP policy update message carries the identifier type of the VM and the identifier of the VM. And the security policy corresponding to the VM, the identifier type of the VM, the identifier of the VM, and the security policy corresponding to the VM are pre-stored on the network device. For example, after the event that the first VM migrates to the second host occurs, the second network security device has at least two methods to receive the extended PCP policy update sent by the network device that pre-stores the first VM security policy. Message. The first method includes: the first host or the second host sends a migration notification message of the first VM to the network device that stores the first VM security policy, and triggers the network device to send the extended PCP policy update to the second network security device. Message. The second method includes: the first host or the second host sends a migration notification message of the first VM to the second network security device, and triggers the second network security device to send the extension to the network device that pre-stores the first VM security policy. a PCP policy request message; after receiving the extended PCP policy request message, the network device sends an extended PCP policy update message to the second network security device, where the extended PCP policy update message is the extended PCP policy request message. The response of the text. The network device in which the first VM security policy is pre-stored in the above two methods, in FIG. 1 is a first network security device, in FIG. 2 is a third-party server, or a first network security device, or a third-party server and a A network security device.

The execution process of the second method is as follows: After the first VM on the first host migrates to the second host, the first host or the second host sends the migration notification packet of the first VM to the second network security device. The migration notification message carries the identifier type of the first VM and the identifier of the first VM. When the identifier type of the first VM is a Media Access Control (MAC) address type, the identifier of the first VM is the MAC address of the first VM; when the identifier type of the first VM is an Internet Protocol (Internet Protocol, The first VM identifies the IP address of the first VM. The second network security device receives the migration notification message, and constructs an extended PCP policy request packet, where the extended PCP policy request packet is carried. a packet type identifier, the identifier is used to identify the PCP packet that is a security policy of the requesting/confirming VM, and further includes an identifier type of the first VM and an identifier of the first VM. After the extended PCP policy request message is configured, the extended PCP policy is sent to a device that pre-stores the first VM security policy, such as a third-party server or a first network security device, or a third-party server and a first network security device. And the device that pre-stores the first VM security policy determines the report after receiving the extended PCP policy request message sent by the second network security device. The message is a packet requesting the VM security policy, and the security policy corresponding to the first VM is queried according to the identifier type of the first VM and the identifier of the first VM that are carried in the extended PCP policy request packet. Constructing an extended PCP policy update message, where the extended PCP policy update message is The response of the extended PCP policy request message is described. The extended PCP policy update packet carries a packet type identifier, where the identifier is used to identify the PCP packet that is the security policy of the requesting/updating VM, and further carries the identifier type of the first VM, The identifier of the first VM and the security policy corresponding to the first VM. Sending the extended PCP policy update message to the second network security device. The following describes how to extend an existing PCP packet to an extended PCP policy request packet and an extended PCP policy update packet. This is merely an example and is not specifically limited. The existing PCP Request (Request) message format is defined as follows:

0 1 2 3

01234567890123456789012345678901

Requested Lifetime (32 bits)

PCP Client's IP Address (128 bits) (optional) Opcode-specific information

(optional) PCP Options

NOTE: The structure of the PCP response (Response) message is similar, and is not mentioned here. Where: Opcode field: indicates the classification of the action performed by the PCP message. The Opcode-specific information field is the payload corresponding to the Opcode field and is an optional field.

PCP Options field: is an extension field corresponding to the Opcode field and is an optional field. In the embodiment of the present invention, the existing PCP packet format is extended to the extended PCP policy request message and the extended PCP policy update message by the following method:

(1) For extended PCP policy request messages

Opcode takes a new enumeration value (unlike the enumeration value of Opcode in the existing PCP), indicating the security policy for requesting/confirming the VM. Define a new Opcode-specific information as follows: 0 1 2 3 01234567890123456789012345678901

Protocol Reserved (24 bits)

Length | ID Type

ID

The a) protocol sub-field and the reserved (reserved) sub-field are used to match the PCP packet definition style, and the value may be any value. b) Length field, used to indicate the length of the subsequent ID Type subfield and ID (ID) subfield. c) ID Type subfield, which is used to identify the identification type of the VM. The identifier type of the VM, which can be a MAC address type, or an IP address type, or other types. d) Identification (ID) subfield for identifying the VM, related to the ID Type. For example, when the value of the ID Type is a MAC address type, the value of the ID is the MAC address of the VM. PCP Options is empty, ie PCP Options are not included. (2) For extended PCP policy update messages

Opcode takes a new enumeration value (unlike the enumeration value of Opcode in the existing PCP), indicating that the security policy for requesting/updating the VM can be the same as or different from the value of Opcode in the extended PCP policy request.

Opcode-specific information, which is the same as the content in the extended PCP policy request message. Define a new PCP Options as follows: 0 1 2 3

01234567890123456789012345678901

Protocol | Reserved | Length

Policy

The a) protocol sub-field and the reserved (reserved) sub-field are used to match the PCP packet definition style, and the value may be any value. b) Length field, used to indicate the length of the Policy subfield. c) Policy subfield, which is used to carry the security policy of the VM. For example, there may be multiple ways to distinguish between an extended PCP policy request message and an extended PCP policy update message. For example, the value of Opcode in the extended PCP policy request message and the extended PCP policy update message may be different. The value of the packet can also be determined by the PCP Options field in the packet. When there is a PCP Options field in the packet, the PCP policy update packet is extended for the extended PCP policy update packet. Otherwise, the PCP policy request packet is extended. The extended PCP policy request packet can be extended from the PCP request request packet. The extended PCP policy update packet can be extended from the PCP request Request packet or extended from the PCP response Response packet. The execution process of the first method is described in detail as follows: After the first VM migrates from the first host to the second host, the first host or the second host goes to a device that pre-stores the VM security policy, for example, The first network security device, or the third-party server, or the first network security device and the third-party server, send the migration notification message of the first VM. And after the device that pre-stores the VM security policy receives the migration notification message of the first VM, according to the identifier type of the first VM carried in the migration notification message of the first VM, and the The identifier of the first VM is queried to the security policy corresponding to the first VM, the extended PCP policy update message is configured, and the extended PCP policy update message is sent to the second network security device. The method for constructing the extended PCP policy update message is the same as the method for constructing the extended PCP policy update message in the second method, and details are not described herein again.

302. The network security device applies a security policy corresponding to the VM, and processes the received packet from the VM. For example, the second network security device determines, according to the security policy corresponding to the first VM, whether it conflicts with the locally configured security policy, and if there is a conflict, adjusts the local according to the security policy corresponding to the first VM. The configured security policy; if there is no conflict, keep the locally configured security policy unchanged. The second network The security device performs corresponding processing on the received packet from the first VM according to the security policy after the security policy corresponding to the first VM is applied. For example, if the security policy locally configured by the second network security device does not allow the video stream message sent by any virtual machine to pass, the security policy corresponding to the first VM is to allow the video stream sent by the first VM to be sent. If the security policy locally configured by the second network security device allows the video stream message sent by any virtual machine to pass, the security policy corresponding to the first VM is to allow the first VM to send The video stream packets pass without conflict. After the VM is migrated, the method for processing the packet after the virtual machine VM is migrated is used to receive the extended PCP policy update packet sent by the network device, and the security policy corresponding to the VM is applied to the VM after the VM migration. The network security device does not need to forward the packets sent by the migrated VM to the corresponding network security device before the VM migration, so that the network node that the packet sent by the migrated VM passes can be reduced, and the VM is improved. Packet forwarding efficiency.

As shown in FIG. 4, the embodiment of the present invention provides a method for processing a message after a virtual machine VM is migrated, which can be applied to the first network security device shown in FIG. 1, and can also be applied to the first device shown in FIG. A network security device and/or a third server, including:

401. After the VM is migrated, the network device obtains the identifier type of the VM and the identifier of the VM, where the network device pre-stores the identifier type of the VM, the identifier of the VM, and a security policy corresponding to the VM. In the foregoing 401, the identifier type of the VM, the identifier of the VM, and the security policy corresponding to the VM are pre-stored on the network device, such as the second network security device shown in FIG. 1, or in FIG. The second network security device and/or the third server are shown. As shown in FIG. 1 and FIG. 2, when the first VM is migrated from the first host to the second host, refer to the first method and the second method described in FIG. 3 in the embodiment shown in FIG. The device receives the migration notification message of the first VM sent by the first host or the second host, or receives the extension sent by the second network security device. The identifier type of the first VM and the identifier of the first VM carried in the PCP policy request packet, the migration notification packet of the first VM, or the extended PCP policy request packet.

402. The network device constructs an extended PCP policy update packet according to the identifier type of the VM and the identifier of the VM, where the extended PCP policy update packet carries an identifier type of the VM, an identifier of the VM, and The security policy corresponding to the VM. For example, the network device queries the security policy corresponding to the first VM according to the identifier type of the first VM and the identifier of the first VM, and constructs an extended PCP policy update packet, and the extended PCP policy update packet carries the first The identification type of the VM, the identifier of the first VM, and the security policy corresponding to the first VM. For the detailed process and the method for extending the PCP, refer to the first method, the second method, and the method for extending the PCP described in the embodiment shown in FIG. 3, and details are not described herein again.

403. The network device sends the extended PCP policy update packet to a corresponding network security device after the VM is migrated. For example, the network device sends an extended PCP policy update message to the second network security device. After the VM is migrated, the method for processing the packet after the virtual machine VM is migrated is sent to the corresponding network security device after the VM is migrated, so that the VM is migrated after the VM is migrated. The network security device can obtain the security policy corresponding to the VM, so the corresponding network security device can apply the security policy corresponding to the VM to process the packet from the VM, and the migration does not need to be performed after the migration. The packets sent by the VM are forwarded to the corresponding network security device before the VM migration, so as to improve the forwarding efficiency of the VM packets.

Referring to FIG. 5, an embodiment of the present invention provides a network security device, including: The receiving unit 501 is configured to receive, after the VM is migrated, an extended PCP policy update message sent by the network device, where the extended PCP policy update message carries an identifier type of the VM, an identifier of the VM, and a corresponding to the VM. The security policy, the identifier type of the VM, the identifier of the VM, and the security policy corresponding to the VM are pre-stored on the network device. The executing unit 502 is configured to apply a security policy corresponding to the VM, and process the received packet from the VM. For example, the PCP policy update message includes: a first opcode (Opcode) field, an first opcode-specific information field, and a PCP option field, the first Opcode field. And a packet type of the extended PCP, where the first Opcode-specific information field carries an identifier type of the VM and an identifier of the VM, and the PCP Options field carries a security policy corresponding to the VM. For example, as shown in FIG. 6, the receiving unit 501 is further configured to receive a migration notification message of the VM, where the migration notification message carries an identifier type of the VM and an identifier network security device of the VM. The network security device may further include: a configuration request message unit 503, configured to construct an extended PCP policy request message according to the migration notification message, where the extended PCP policy request message includes a second Opcode field and a second Opcode-specific information field, the second Opcode field is used to identify a packet type of the extended PCP, and the second Opcode-specific information field carries an identifier type of the VM and an identifier of the VM. The sending unit 504 is configured to send the extended PCP policy request message to the network device. Correspondingly, the extended PCP policy update message is a response to the extended PCP policy request message. The network security device provided by the embodiment of the present invention applies the extended PCP policy update message sent by the network device to the network security device corresponding to the VM after the VM is migrated. The packets sent by the migrated VM are forwarded to the corresponding network security device before the VM is migrated, so that the forwarding efficiency of VM packets can be improved.

Referring to FIG. 7, an embodiment of the present invention provides a network device, including: a receiving unit 702, configured to obtain an identifier type of the VM and an identifier of the VM after the VM is migrated, and a storage unit 701, configured to: The identifier type of the VM, the identifier of the VM, and a security policy corresponding to the VM are pre-stored. The configuration update message unit 703 is configured to construct an extended PCP policy update message according to the identifier type of the VM and the identifier of the VM and the security policy corresponding to the VM, where the extended PCP policy update message carries the The identification type of the VM, the identifier of the VM, and the security policy corresponding to the VM. The sending unit 704 is configured to send the extended PCP policy update message to the corresponding network security device after the VM migration. For example, the extended PCP policy update message carries the identifier type of the VM, the identifier of the VM, and the security policy corresponding to the VM, including: the extended PCP policy update message includes a first operation code Opcode. a field, a first opcode specific information Opcode-specific information field, and a PCP option Options field, the first Opcode field is used to identify a packet type of the extended PCP, and the first Opcode-specific information field carries an identifier of the VM A type and an identifier of the VM, where the PCP Options field carries a security policy corresponding to the VM. For example, the receiving unit 702 is specifically configured to: Receiving a migration notification message of the VM, where the migration notification message carries an identifier type of the VM and an identifier of the VM. For example, the receiving unit 702 is specifically configured to: receive an extended PCP policy request message sent by the corresponding network security device after the VM migration, where the extended PCP policy request message includes a second Opcode field and a An Opcode-specific information field, the second Opcode field is used to identify a packet type of the extended PCP, and the second Opcode-specific information field carries an identifier type of the VM and an identifier of the VM. The network device provided by the embodiment of the present invention, after the VM is migrated, sends an extended PCP policy update message to the corresponding network security device after the VM is migrated, so that the corresponding network security device after the VM migration can obtain the VM. Corresponding security policy. Therefore, the corresponding network security device after the VM migration can apply the security policy corresponding to the VM to process the packet from the VM. Therefore, the packet sent by the migrated VM does not need to be forwarded to the network. The corresponding network security device is processed before the VM is migrated, so that the efficiency of VM packet forwarding can be improved. For example, the units in the embodiments shown in Figures 5-7 can be combined into one or more units. Also for example, the units can all be implemented in hardware. One of ordinary skill in the art can understand that all or part of the various methods of the above embodiments can be completed by a program to instruct related hardware, and the program can be stored in a computer readable storage medium, for example, storage. The medium may include: a read only memory, a read-only memory, a magnetic disk or an optical disk, and the like. The method and device for processing the message after the migration of the virtual machine VM provided by the embodiment of the present invention are described in detail above, but the above embodiments are not to be construed as limiting the present invention. It is to be understood by those skilled in the art that the scope of the present invention is intended to be included within the scope of the present invention.

Claims

Rights request

1. A method for processing packets after virtual machine VM migration, which is characterized by including:

After the VM is migrated, the network security device corresponding to the VM migration receives an extended Port Control Protocol PCP policy update message sent from the network device. The extended PCP policy update message carries the identification type of the VM, the The identification and the security policy corresponding to the VM, the identification type of the VM, the identification of the VM, and the security policy corresponding to the VM are pre-stored on the network device;

The network security device applies the security policy corresponding to the VM to process the received message from the VM.

2. The method according to claim 1, the extended PCP policy update message carries the identification type of the VM, the identification of the VM and the security policy corresponding to the VM, including:

The extended PCP policy update message includes a first opcode field, a first opcode-specific information field and a PCP options Options field. The first Opcode field is used to identify the message type of the extended PCP, so The first Opcode-specific information field carries the identification type of the VM and the identification of the VM, and the PCP Options field carries the security policy corresponding to the VM.

3. The method according to claim 2, characterized in that, before receiving the extended PCP policy update message sent by the network device, the method further includes:

The network security device receives a migration notification message of the VM, where the migration notification message carries the identification type of the VM and the identification of the VM;

The network security device constructs an extended PCP policy request message according to the migration notification message. The extended PCP policy request message includes a second Opcode field and a second Opcode-specific information field. The second Opcode field is In order to identify the message type of the extended PCP, the second Opcode-specific information field carries the identification type of the VM and the identification of the VM; The network security device sends the extended PCP policy request message to the network device; accordingly, the extended PCP policy update message is a response to the extended PCP policy request message.

4. A method for processing packets after virtual machine VM migration, which is characterized by including:

After the VM is migrated, the network device obtains the identification type of the VM and the identification of the VM, and the network device pre-stores the identification type of the VM, the identification of the VM, and the security policy corresponding to the VM;

The network device constructs an extended port control protocol PCP policy update message according to the identification type of the VM and the identification of the VM, and the extended PCP policy update message carries the identification type of the VM and the identification of the VM. and the security policy corresponding to the VM;

The network device sends the extended PCP policy update message to the corresponding network security device after the VM is migrated.

5. The method according to claim 4, the extended PCP policy update message carries the identification type of the VM, the identification of the VM and the security policy corresponding to the VM, including:

6. The method according to claim 5, wherein the network device obtains the identification type of the VM and the identification of the VM, including:

The network device receives a migration notification message of the VM, and the migration notification message carries the identification type of the VM and the identification of the VM.

7. The method according to claim 5, wherein the network device obtains the identification type of the VM and the identification of the VM, including: The network device receives an extended PCP policy request message sent by the corresponding network security device after the VM is migrated. The extended PCP policy request message includes a second Opcode and a second Opcode-specific information field. The second The Opcode field is used to identify the message type of the extended PCP, and the second Opcode-specific information field carries the identification type of the VM and the identification of the VM.

8. A network security device, characterized by including:

A receiving unit configured to receive an extended port control protocol PCP policy update message sent by the network device after the VM is migrated. The extended PCP policy update message carries the identification type of the VM, the identification of the VM and the The security policy corresponding to the VM, the identification type of the VM, the identification of the VM, and the security policy corresponding to the VM are pre-stored on the network device;

An execution unit is used to apply the security policy corresponding to the VM and process the received message from the VM.

9. The network security device according to claim 8, wherein the PCP policy update message includes:

The first Opcode field, the first Opcode-specific information field and the PCP Options Options field. The first Opcode field is used to identify the message type of extended PCP. The -Opcode-specific information field carries The identification type of the VM and the identification of the VM, and the PCP Options field carries the security policy corresponding to the VM.

10. The network security device according to claim 9, wherein the receiving unit is further configured to receive a migration notification message of the VM, and the migration notification message carries the identification type of the VM and the VM identification;

The network security device further includes a construction request message unit, configured to construct an extended PCP policy request message according to the migration notification message. The extended PCP policy request message includes a second Opcode field and a second Opcode-specific information field, the second Opcode field is used to identify the message type of extended PCP Type, the second Opcode-specific information field carries the identification type of the VM and the identification of the VM;

The network security device further includes a sending unit configured to send the extended PCP policy request message to the network device; accordingly, the extended PCP policy update message is a response to the extended PCP policy request message. .

11. A network device, characterized by including:

A receiving unit, used to obtain the identification type of the VM and the identification of the VM after the VM is migrated; A storage unit, used to pre-store the identification type of the VM, the identification of the VM and the security information corresponding to the VM. Strategy;

Construct an update message unit, configured to construct an extended port control protocol PCP policy update message according to the identification type of the VM and the identification of the VM, where the extended PCP policy update message carries the identification type of the VM, the The identification of the VM and the security policy corresponding to the VM;

A sending unit, configured to send the extended PCP policy update message to the corresponding network security device after the VM is migrated.

12. The network device according to claim 11, wherein the extended PCP policy update message carries the identification type of the VM, the identification of the VM and the security policy corresponding to the VM, including:

13. The network device according to claim 12, wherein the receiving unit is specifically configured to: receive a migration notification message of the VM, where the migration notification message carries the identification type of the VM and the The ID of the VM.

14. The network device according to claim 12, characterized in that the receiving unit is specifically used for: Receive an extended PCP policy request message sent by the corresponding network security device after the VM is migrated. The extended PCP policy request message includes a second Opcode field and a second Opcode-specific information field. The second Opcode field is In order to identify the message type of the extended PCP, the second Opcode-specific information field carries the identification type of the VM and the identification of the VM.