WO2016106718A1 - 一种网络控制方法与虚拟交换机 - Google Patents

一种网络控制方法与虚拟交换机 Download PDF

Info

Publication number
WO2016106718A1
WO2016106718A1 PCT/CN2014/095988 CN2014095988W WO2016106718A1 WO 2016106718 A1 WO2016106718 A1 WO 2016106718A1 CN 2014095988 W CN2014095988 W CN 2014095988W WO 2016106718 A1 WO2016106718 A1 WO 2016106718A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
virtual switch
validity
identification information
source
Prior art date
Application number
PCT/CN2014/095988
Other languages
English (en)
French (fr)
Inventor
李太安
李明
吴天议
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2014/095988 priority Critical patent/WO2016106718A1/zh
Priority to CN201480084433.8A priority patent/CN107113280A/zh
Publication of WO2016106718A1 publication Critical patent/WO2016106718A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/50—Reducing energy consumption in communication networks in wire-line communication networks, e.g. low power modes or reduced link rate

Definitions

  • the present invention relates to the field of communications, and in particular, to a network control method and a virtual switch.
  • a distributed denial of service (DDoS) attack is a hacker that attacks a specified website with a distributed attack source.
  • the attack technology combines multiple computers as an attack platform to send an attack report to one or more targets.
  • the power of denial of service attacks is multiplied, causing the server to be overloaded and unable to serve normal requests.
  • an administrator sets a virtual switch (Vswitch) in a server, and configures a security group rule for the virtual switch.
  • a security group rule is a rule for judging whether a packet is secure. Each time a server receives a packet, it determines the security of the packet according to the security group rule. Only the packet determined by the security group rule is used. The virtual switch is forwarded to the virtual machine (VM) in the server. The packets that are not determined by the security group rule are discarded. This ensures that the VMs in the server do not need to process attack packets, which reduces the probability of server overload.
  • VM virtual machine
  • the security group rule needs to determine all the attack packets. It consumes a large amount of CPU (Central Processing Unit) resources. As a result, normal packets are likely to be due to CPU resources. Exhausted and cannot be processed.
  • CPU Central Processing Unit
  • the embodiment of the invention provides a network control method, a virtual switch and a server, which can save the resources of the server CPU, reduce the power consumption of the server CPU, shorten the system delay, and improve the efficiency of packet processing.
  • a first aspect of the embodiments of the present invention provides a network control method, including:
  • the first virtual switch of the destination virtual machine VM receives the first packet sent by the source VM;
  • the first virtual switch is configured with a security group rule, and the first virtual switch acquires flow identification information of the first packet, and according to the security group rule and the flow identification information of the first packet, Determining the validity of the first message;
  • the first virtual switch determines that the first packet is invalid according to the security group rule and the flow identification information of the first packet, the first virtual switch sends a second virtual switch to the source VM. Sending a second packet, where the second packet is used to indicate that the first packet is invalid.
  • the first virtual switch is further configured with a flow table, where the flow table records the security group rule pair.
  • the method further includes:
  • the first virtual switch searches for the validity of the first packet from the flow table according to the flow identification information of the first packet.
  • the first virtual switch does not find the validity of the first packet in the flow table, triggering the flow identification information according to the security group rule and the first packet, The step of determining the validity of the first message;
  • the first virtual switch finds the validity of the first packet in the flow table, and the validity of the first packet is valid, the first virtual switch will be the first The message is sent to the destination VM.
  • the method further includes:
  • the first virtual switch determines that the first packet is valid according to the security group rule, the first virtual switch records the validity of the first packet into the flow table, and Transmitting the first message to the destination VM;
  • the first virtual switch sends a third packet to the second virtual switch of the source VM, where the third packet is used to indicate that the first packet is valid.
  • the flow identification information It includes at least one of the following: source IP address, destination IP address, IP protocol type, source port number, and destination port number.
  • the flow identification information further includes at least one of the following: Cluster ID, data center ID, and username.
  • the first packet is a virtual extended local area network VXLAN packet, where the first The packet carries at least one of the following through the VXLAN header: a cluster identifier of the source VM, a data center identifier, and a username.
  • a second aspect of the embodiments of the present invention provides a virtual switch, where the virtual switch is used to manage a packet sent and received by a destination VM in the server, where the virtual switch is configured with a security group.
  • the virtual switch includes:
  • a receiving module configured to receive a first packet sent by the source virtual machine VM
  • a determining module configured to obtain flow identification information of the first packet, and determine validity of the first packet according to the security group rule and the flow identification information of the first packet;
  • a first sending module configured to send, to the virtual switch of the source VM, a second when the determining module determines that the first packet is invalid according to the security group rule and the flow identification information of the first packet a packet, where the second packet is used to indicate that the first packet is invalid.
  • the virtual switch is further configured with a flow table, where the flow table records different reports of the security group rule.
  • the virtual switch further includes:
  • a locating module configured to: before the judging module determines the validity of the first packet according to the security group rule and the flow identification information of the first packet, according to the flow table, according to the The flow identification information of the first packet is used to search for the validity of the first packet, and if the searching module does not find the validity of the first packet in the flow table, triggering the a determining, by the determining module, the validity of the first packet according to the security group rule and the flow identification information of the first packet;
  • the virtual switch further includes:
  • a second sending module configured to: when the searching module finds the validity of the first packet in the flow table, and the validity of the first packet is valid, the first report is The text is sent to the destination VM.
  • the virtual switch further includes:
  • a recording module configured to: when the determining module determines that the first packet is valid according to the security group rule, record the validity of the first packet into the flow table, and trigger the second Sending, by the sending module, the first packet to the destination VM;
  • the first sending module is further configured to: when the determining module determines that the first packet is valid according to the security group rule, send a third packet to the virtual switch of the source VM, where the third packet is sent The text is used to indicate that the first message is valid.
  • the flow identification information It includes at least one of the following: source IP address, destination IP address, IP protocol type, source port number, and destination port number.
  • the flow identification information further includes at least one of the following: a cluster of the source VM ID, data center ID, and username.
  • the first packet is a virtual extended local area network VXLAN packet, where the first The packet carries at least one of the following through the VXLAN header: a cluster identifier of the source VM, a data center identifier, and a username.
  • a third aspect of the embodiments of the present invention provides a server, including: an input device, an output device, a processor, and a memory, wherein the processor and the memory receive information external to the server through the input device, The processor and the memory send information to the outside of the server through the output device;
  • the first program code is stored in the memory, and the first program code is used to implement a virtual switch function
  • the processor is configured to perform the following steps by calling the first program code stored in the memory:
  • the second packet is sent to the second virtual switch of the source VM, where the second packet is used to indicate that the first packet is invalid.
  • the first program code includes a flow table, where the flow table records that the security group rule is different
  • the memory further stores a second program code for implementing the destination VM function, by calling the first program code stored in the memory, the processing It is also used to perform the following steps:
  • the first packet is sent to the destination VM.
  • the processor is further configured by calling the first program code stored in the memory. Used to perform the following steps:
  • the validity of the first packet is recorded in the flow table, and the first packet is sent to the destination VM;
  • the flow identification information It includes at least one of the following: source IP address, destination IP address, IP protocol type, source port number, and destination port number.
  • the flow identification information further includes at least one of the following: a cluster of the source VM ID, data center ID, and username.
  • the third party of the embodiment of the present invention in a fifth implementation manner, is a virtual extended local area network (VXLAN) packet, and the first packet carries at least one of the following: a cluster identifier of the source VM, and a data center identifier. , and username.
  • VXLAN virtual extended local area network
  • the embodiment of the present invention provides a network control method, where the first virtual switch of the destination VM receives the first packet sent by the source VM, and the first virtual switch is configured with the security group rule, where the first virtual switch obtains the first packet. And identifying the information, and determining, according to the security group rule and the flow identification information of the first packet, the validity of the first packet; if it is determined that the first packet is invalid, the second virtual to the source VM The switch sends a second packet, where the second packet is used to indicate that the first packet is invalid. In this way, the second virtual switch can learn and record the validity of the first packet. If the validity of the first packet is invalid, the second virtual machine will not send the same as the first packet.
  • the flow identification information packet so that the amount of packet data determined by the first virtual switch for the security group determination can be reduced, and the CPU resources of the server are saved. Therefore, the method provided by the embodiment of the present invention can save the resources of the server CPU, reduce the power consumption of the server CPU, shorten the system delay, and improve the efficiency of packet processing.
  • Figure 1 is a schematic diagram of the principle of network control in the current stage of technology
  • FIG. 2 is a schematic diagram of a network control principle according to an embodiment of the present invention.
  • FIG. 3 is a flowchart of an embodiment of a network control method according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of another embodiment of a network control method according to an embodiment of the present invention.
  • FIG. 5 is a structural diagram of an embodiment of a virtual switch according to an embodiment of the present invention.
  • FIG. 6 is a structural diagram of another embodiment of a virtual switch according to an embodiment of the present invention.
  • FIG. 7 is a structural diagram of an embodiment of a server according to an embodiment of the present invention.
  • the embodiment of the invention provides a network control method, which can save the resources of the server CPU, reduce the power consumption of the server CPU, shorten the system delay, and improve the efficiency of packet processing.
  • the invention also mentions The relevant virtual switches and servers are out, which will be explained separately below.
  • a VM is a computer-based computer system with full hardware system functionality that can be deployed on a server.
  • One or more VMs can be deployed on a single server.
  • a virtual switch is a functional software that is divided between the hardware and the operating system and is used to manage the sending and receiving of packets between VMs on the same server or between the VMs of different servers. It can be understood that multiple VMs in the same server can share one virtual switch.
  • the packets sent to the destination VM need to pass the validity determination of the virtual switch of the destination VM.
  • the virtual switch of the destination VM is configured with a security group rule, and the validity of the received packet is determined according to the security group rule.
  • the virtual switch of the destination VM determines that the packet is valid according to the security group rule, and forwards the packet to the destination VM.
  • the virtual switch of the destination VM determines that the packet is invalid according to the security group rule and does not forward the packet to the destination VM.
  • This method requires the virtual switch of the destination VM to make security decisions on all received packets.
  • the embodiment of the present invention improves the principle of the prior art, as shown in FIG. 2:
  • the first packet is used to indicate the first packet in the embodiment of the present invention, and the first packet is the first packet. If the validity of the first packet of the attack packet is invalid according to the security group rule, the virtual switch of the malicious VM that sends the attack packet is notified that the validity of the first packet of the attack packet is invalid. After the virtual switch of the malicious VM learns that the first packet of the attack packet is invalid, it does not send subsequent attack packets to the destination VM.
  • the packet in the network often carries the flow identification information.
  • the flow identification information may include one or more of a source IP (Internet Protocol) address, a destination IP address, an IP protocol type, a source port number, and a destination port number. .
  • the flow identification information is used as a basis for judging the validity of the message as a security group rule.
  • the packets belonging to the same flow have the same flow identification information. Therefore, the virtual switch determines the validity of the packets of the same flow according to the security group rule, and the determination result is the same. If the virtual switch records the validity judgment result of the packet according to the security group rule, the flow table can be obtained.
  • Table 1 is only an image description of the flow table structure. Is the real structure of the flow table stored in the virtual switch:
  • each entry has an entry, and different entries record the judgment result of the security group rule on the validity of the message with different flow identification information.
  • the entry in the first line indicates that the flow identification information includes the source IP address A, the destination IP address A, the IP protocol type A, the source port number A, and the destination port number A. The judgment result is valid.
  • Virtual switches of VMs in the network can be configured with flow tables. After the virtual switch of the malicious VM learns that the first packet of the attack packet is invalid, the virtual switch can record the flow identification information of the first packet of the attack packet in its own flow table, and record the validity of the flow identification information. invalid. In this way, when the malicious VM generates subsequent attack packets, the subsequent attack packets and the first packet of the attack packets belong to the same flow, and the flow identification information is the same. Therefore, the virtual switch of the malicious VM can learn that the subsequent attack packets are invalid. The subsequent attack packets are sent to the destination VM. In this way, a large number of attack packets are intercepted at the malicious VM, and the virtual switch of the destination VM is not required for security determination.
  • the virtual switch of the destination VM may also be configured with a flow table, which is used to record the validity of the security group rule for the validity of different packets.
  • a flow table which is used to record the validity of the security group rule for the validity of different packets.
  • the virtual switch of the destination VM receives the packet, it can first find the validity of the received packet from the configured flow table. If it is not found, it can determine it according to the security group rule. Since it is simpler to perform the operation of finding the flow table than the determination according to the security group rule, the CPU resources of the destination server can be further saved.
  • the network control method provided by the embodiment of the present invention can be expressed as the following basic process, as shown in FIG. 3:
  • the first virtual switch of the destination VM receives the first packet sent by the source VM.
  • the first virtual switch is a virtual switch of the destination VM, and the first virtual switch and the destination VM are both located in the destination server, and the first virtual switch receives the first packet sent by the source VM.
  • the first virtual switch obtains the flow identification information of the first packet, and determines the validity of the first packet according to the security group rule and the flow identification information of the first packet.
  • the first virtual switch determines that the first packet is invalid according to the security group rule, the first virtual switch sends a second packet to the second virtual switch of the source VM, where the second virtual switch is a virtual switch of the source VM, where The second packet is used to indicate that the first packet is invalid.
  • the network control method provided in this embodiment enables the second virtual switch to learn and record the validity of the first packet. If the validity of the first packet is invalid, the second virtual machine will not be sent subsequently.
  • the packet has the same packet identification information, which can reduce the amount of packet data that the first virtual switch determines for the security group, and saves the CPU resources of the destination server. Therefore, the method provided by the embodiment of the present invention can save the resources of the target server CPU, reduce the power consumption of the destination server CPU, shorten the system delay, and improve the efficiency of packet processing.
  • the network control method provided by the present invention may also be extended to the process shown in FIG. 4:
  • the first virtual switch of the destination VM receives the first packet sent by the source VM.
  • the first virtual switch obtains the flow identification information of the first packet, and searches for the validity of the first packet according to the flow identification information of the first packet from the flow table.
  • the first virtual switch is configured with a flow table.
  • the first virtual switch obtains the flow identification information of the first packet, and searches for the validity of the first packet according to the flow identification information of the first packet from its own flow table. If the first virtual switch finds that the validity of the first packet is valid in its own flow table, step 403 is performed; if the validity of the first packet is not found, step 404 is performed.
  • the first virtual switch sends the first packet to the destination VM.
  • the first virtual switch determines the validity of the first packet according to the security group rule and the flow identification information of the first packet.
  • step 405 is performed; if the first virtual switch is configured according to the security group rule and the flow of the first packet If the identification information determines that the first message is valid, step 406 is performed.
  • the first virtual switch sends a second packet to the second virtual switch of the source VM.
  • the first virtual switch determines that the first packet is invalid according to the security group rule and the flow identification information of the first packet, the first virtual switch sends a second packet to the second virtual switch of the source VM, where the second packet is used. Indicates that the first packet is invalid.
  • the second virtual switch can learn that the validity of the first packet is invalid according to the second packet, and does not send the packet with the same flow identification information as the first packet.
  • the second virtual switch is a virtual switch of the source VM.
  • the first virtual switch records the validity of the first packet into the flow table, and sends the first packet to the destination VM.
  • the first virtual switch determines that the first packet is valid according to the security group rule and the flow identification information of the first packet, the first virtual switch records the validity of the first packet into its own flow table, and the first The message is sent to the destination VM.
  • the first virtual machine records the validity of the first packet in the flow table, and implements autonomous update of the flow table configured in the first virtual switch.
  • the first virtual machine may record the validity of the first packet in the flow table as an optional operation. In this embodiment, the first virtual switch may not perform the recording operation.
  • the first virtual switch sends a third packet to the second virtual switch of the source VM.
  • the first virtual switch sends a third packet to the second virtual switch of the source VM, where the third packet is used to indicate that the first packet is valid.
  • the step 407 is an optional operation. In this embodiment, the first virtual switch may not perform the operation of step 407.
  • the sequence of the steps 407 and 406 is not limited. If the first virtual switch determines that the first packet is valid according to the security group rule and the flow identification information of the first packet, step 407 may be performed first, and then the step is performed. 406, there is no limit here.
  • the first virtual switch after receiving the first packet, the first virtual switch first searches for the validity of the first packet in its own flow table, and if not found, performs security determination according to the security group rule.
  • the method provided by this embodiment enables the first virtual switch to replace the partial security decision operation with the lookup flow table operation. Since the operation of finding the flow table is simpler than the determination according to the security group rule, the method provided in this embodiment can further save the CPU resources of the destination server.
  • the flow identification information includes a source ID, a destination IP address, an IP protocol type, a source port number, and a destination port number, and may also include a cluster identifier and a data center identifier of the source VM.
  • the user names are used as the basis for determining the extension of the security group rules.
  • the structure of the flow table should also be extended with the flow identification information. For example, if the extended flow identification information includes a source IP address, a destination IP address, an IP protocol type, a source port number, a destination port number, a cluster identifier, and a user name, the structure of the expanded flow table is shown in Table 2. :
  • the first packet may be a virtual eXtensible Local Area Network (VXLAN) packet, and the first packet carries one of a cluster identifier, a data center identifier, and a username of the source VM through the VXLAN header. Item or multiple items.
  • VXLAN virtual eXtensible Local Area Network
  • a user VM and a malicious VM exist in the network, and the user VM and the malicious VM simultaneously send a message to the virtual switch of the destination VM.
  • the virtual switch of the destination VM receives the packet 1 sent by the malicious VM and the packet 2 sent by the user VM.
  • the flow table A is stored in the virtual switch of the destination VM.
  • the virtual switch of the destination VM obtains the flow identification information of the packet 1, including: source IP address 1, destination IP address 1, IP protocol type 1, source port number 1, destination port number 1, cluster identifier 1, and data center identifier. , username 1.
  • the virtual switch of the destination VM finds that the validity of the flow identification information corresponding to the packet 1 in the flow table A is invalid. Therefore, the virtual switch sends a message to the virtual switch of the malicious VM, informing that the message 1 is invalid.
  • the flow table B is stored in the virtual switch of the malicious VM, and the virtual switch of the malicious VM records the flow identification information of the message 1 in the flow table B and its validity is invalid.
  • the virtual switch of the malicious VM searches the flow table B for the validity of these subsequent messages. If the flow identification information of the subsequent packets is the same as the flow identification information of the packet 1, the virtual switch of the malicious VM determines that the subsequent packet is invalid, and the subsequent packet is intercepted by the malicious VM and is not sent to the destination VM.
  • the virtual switch of the destination VM obtains the flow identification information of the packet 2, including: source IP address 2, destination IP address 2, IP protocol type 2, source port number 2, destination port number 2, cluster identifier 2, and data center identifier 2 , username 2.
  • the virtual switch of the destination VM does not find the report from the flow table A.
  • the validity of the flow identification information of the text 2 is determined based on the security group rule and the flow identification information of the message 2, and the validity of the message 2 is determined. The result of the judgment is that the message 2 is valid, so that the virtual switch of the destination VM sends the message 2 to the destination VM, and records the flow identification information of the message 2 in the flow table A and its validity is valid.
  • the virtual switch of the destination VM also sends a packet to the virtual switch of the user VM, informing that packet 2 is invalid.
  • the flow table C is stored in the virtual switch of the user VM, and the virtual switch of the user VM records the flow identification information of the message 2 in the flow table C and its validity is valid.
  • the virtual switch of the user VM searches the flow table C for the validity of these subsequent packets. If the flow identification information of the subsequent packets is the same as the flow identification information of the packet 2, the virtual switch of the user VM determines that the subsequent packets are valid and sends the packets to the destination VM.
  • the embodiment of the present invention further provides a related virtual switch, which is applicable to a server, and is configured with a security group rule for implementing the process of the embodiment shown in FIG. 3 or FIG. 4.
  • the server where the virtual switch is located is called a destination server, and the virtual switch can manage the packets sent and received by the destination VM in the server.
  • FIG. 5 For the basic structure 500, refer to FIG. 5, which includes:
  • the receiving module 501 is configured to receive the first packet sent by the source virtual machine VM.
  • the determining module 502 is configured to obtain the flow identification information of the first packet, and determine the validity of the first packet according to the security group rule and the flow identification information of the first packet.
  • the first sending module 503 is configured to: when the determining module 502 determines that the first packet is invalid according to the security group rule and the flow identification information of the first packet, send the second packet to the virtual switch of the source VM, where the second packet is sent Used to indicate that the first message is invalid.
  • the receiving module 501 receives the first packet sent by the source VM, and the determining module 502 obtains the stream identification information of the first packet, and according to the security group rule and the flow identification information of the first packet, Determining the validity of the first packet. If the determining module 502 determines that the first packet is invalid, the first sending module 503 sends a second packet to the virtual switch of the source VM, where the second packet is used to indicate the first packet. A message is invalid. In this way, the virtual switch of the source VM can learn and record the validity of the first packet. If the validity of the first packet is invalid, the virtual machine of the source VM will not send the same as the first packet.
  • the packet of the flow identification information can reduce the amount of packet data determined by the virtual switch of the destination VM for the security group, and save the CPU resources of the destination server. Therefore, the virtual switch provided by the embodiment of the present invention can save resources of the target server CPU and reduce the purpose.
  • the CPU power consumption of the server shortens the system delay and improves the efficiency of packet processing.
  • the virtual switch provided by the embodiment of the present invention may further be configured with a flow table, where the result of determining the validity of the security packet rule for different packets is recorded in the flow table.
  • the structure of the virtual switch 600 configured with the flow table is as shown in FIG. 6:
  • the receiving module 601 is configured to receive the first packet sent by the source virtual machine VM.
  • the determining module 602 is configured to obtain the flow identification information of the first packet, and determine the validity of the first packet according to the security group rule and the flow identification information of the first packet.
  • the searching module 603 is configured to: before the judging module judges the validity of the first packet according to the security group rule and the flow identification information of the first packet, from the flow table, according to the first packet The flow identifies the information and finds the validity of the first message. If the search module 603 does not find the validity of the first packet in the flow table, the trigger determination module 602 determines the validity of the first packet according to the security group rule and the flow identification information of the first packet. ;
  • the first sending module 604 is configured to: when the determining module 602 determines that the first packet is invalid according to the security group rule and the flow identification information of the first packet, send the second packet to the virtual switch of the source VM, where the second packet is sent Used to indicate that the first message is invalid.
  • the virtual switch of the source VM can learn that the validity of the first packet is invalid according to the second packet, and does not send the packet with the same flow identification information as the first packet.
  • the second sending module 605 is configured to: when the lookup module 603 finds the validity of the first packet in the flow table, and the validity of the first packet is valid, send the first packet to the destination VM.
  • the virtual switch may further include a recording module 606, configured to record, when the determining module 602 determines that the first packet is valid according to the security group rule, the validity of the first packet is recorded in the flow table. Autonomously updating the flow table configured in the virtual switch, and triggering the second sending module 605 to send the first packet to the destination VM;
  • the first sending module 604 is further configured to: when the determining module 602 determines that the first packet is valid according to the security group rule, send the third packet to the virtual switch of the source VM, where the third packet is sent.
  • the text is used to indicate that the first message is valid.
  • the virtual switch of the source VM can learn that the validity of the first packet is valid according to the third packet, and subsequently send the packet with the same flow identification information as the first packet.
  • the flow identification information may include a cluster identifier and a data center in addition to one or more of a source IP address, a destination IP address, an IP protocol type, a source port number, and a destination port number.
  • a cluster identifier and a data center in addition to one or more of a source IP address, a destination IP address, an IP protocol type, a source port number, and a destination port number.
  • One or more of the identifier, and the username as the basis for determining the extension of the security group rule. It can be understood that the structure of the flow table should also be extended with the flow identification information.
  • the first packet may be a virtual eXtensible Local Area Network (VXLAN) packet, and the first packet carries a cluster identifier, a data center identifier, and/or a username of the source VM through the VXLAN header.
  • VXLAN virtual eXtensible Local Area Network
  • a user VM and a malicious VM exist in the network, and the user VM and the malicious VM simultaneously send a message to the virtual switch of the destination VM.
  • the receiving module 601 of the virtual switch of the destination VM receives the message 1 sent by the malicious VM and the message 2 sent by the user VM.
  • the flow table A is stored in the virtual switch of the destination VM.
  • the determining module 602 obtains the flow identification information of the packet 1, which includes: source IP address 1, destination IP address 1, IP protocol type 1, source port number 1, destination port number 1, cluster identifier 1, data center identifier 1, and user Name 1.
  • the search module 603 finds that the validity of the flow identification information corresponding to the message 1 in the flow table A is invalid. Therefore, the first sending module 604 sends a message to the virtual switch of the malicious VM, informing that the message 1 is invalid.
  • the flow table B is stored in the virtual switch of the malicious VM, and the virtual switch of the malicious VM records the flow identification information of the message 1 in the flow table B and its validity is invalid.
  • the virtual switch of the malicious VM searches the flow table B for the validity of these subsequent messages. If the flow identification information of the subsequent packets is the same as the flow identification information of the packet 1, the virtual switch of the malicious VM determines that the subsequent packet is invalid, and the subsequent packet is intercepted by the malicious VM and is not sent to the destination VM.
  • the virtual switch determining module 602 of the destination VM obtains the flow identification information of the packet 2, including: source IP address 2, destination IP address 2, IP protocol type 2, source port number 2, destination port number 2, cluster identifier 2, and data. Center ID 2, User Name 2.
  • the search module 603 does not find the validity of the flow identification information of the message 2 from the flow table A, and then the determination module 602 determines the validity of the message 2 according to the security group rule and the flow identification information of the message 2. The result of the determination is that the message 2 is valid, so the second sending module 605 sends the message 2 to the destination VM, and the recording module 606 records the stream identification information of the message 2 in the flow table A and its validity is valid.
  • the first sending module 604 also sends a message to the virtual switch of the user VM, informing that the message 2 is valid.
  • the flow table C is stored in the virtual switch of the user VM, and the virtual switch of the user VM records the flow identification information of the message 2 in the flow table C and its validity is effective.
  • the virtual switch of the user VM searches the flow table C for the validity of these subsequent packets. If the flow identification information of the subsequent packets is the same as the flow identification information of the packet 2, the virtual switch of the user VM determines that the subsequent packets are valid and sends the packets to the destination VM.
  • the virtual switch in the embodiment of the present invention is described above from the perspective of a unitized functional entity.
  • the server in which the virtual switch is located in the embodiment of the present invention is described from the perspective of hardware processing.
  • FIG. 7 in the embodiment of the present invention, Another embodiment of server 700 includes:
  • the input device 701, the output device 702, the processor 703, and the memory 704 (wherein the number of processors 703 in the server 700 may be one or more, and one processor 703 is taken as an example in FIG. 7).
  • the processor 703 and the memory 704 receive information external to the server through the input device 701, and the processor 703 and the memory 704 transmit the information to the outside of the server through the output device 702.
  • the input device 701, the output device 702, the processor 703, and the memory 704 may be connected by a bus or other means, wherein the bus connection is taken as an example in FIG.
  • the first program code and the second program code are stored in the memory 704, the first program code is used to implement a virtual switch function, and the second program code is used to implement a destination virtual machine VM function by calling a memory.
  • 704 stores the first program code, and the processor 703 is configured to perform the following steps:
  • the first program code is further configured with a flow table, where the flow table records the judgment result of the validity of the security group rule on different messages, and the processor 703 further performs the following steps:
  • the first packet is sent to the server.
  • the processor 703 also performs the following steps:
  • the validity of the first packet is recorded in the flow table, and the first packet is sent to the server;
  • the flow identification information includes at least one of the following: a source IP address, a destination IP address, an IP protocol type, a source port number, and a destination port number.
  • the flow identification information further includes at least one of the following: a cluster identifier, a data center identifier, and a username.
  • the first packet is a virtual extended local area network (VXLAN) packet, and the first packet carries a cluster identifier, a data center identifier, and a username in the source VM through a VXLAN header.
  • VXLAN virtual extended local area network
  • the disclosed systems and methods can be implemented in other ways.
  • the system embodiment described above is merely illustrative.
  • the division of the unit is only a logical function division, and the actual implementation may have another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, module or unit, and may be electrical, mechanical or otherwise.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. You can choose some or all of them according to actual needs.
  • the unit is to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the integrated unit if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例提供了一种网络控制方法，可以节约服务器CPU的资源，降低服务器CPU的功耗，缩短系统时延，提升报文处理的效率。本发明实施例提供的网络控制方法包括目的VM的第一虚拟交换机接收源虚拟机VM发送的第一报文；第一虚拟交换机配置有安全组规则，第一虚拟交换机获取第一报文的流识别信息，并根据安全组规则和第一报文的流识别信息对所述第一报文的有效性进行判断；若确定所述第一报文无效，向所述源VM的第二虚拟交换机发送第二报文，第二报文用于表示第一报文无效。本发明还提出了相关的虚拟交换机与服务器。

Description

一种网络控制方法与虚拟交换机 技术领域
本发明涉及通信领域，尤其涉及一种网络控制方法与虚拟交换机。
背景技术
分布式拒绝服务(DDoS，Distributed Denial of Service)攻击是一种以分散攻击源来攻击指定网站的黑客方式，该攻击技术将多个计算机联合起来作为攻击平台，向一个或多个目标发送攻击报文，从而成倍地提高拒绝服务攻击的威力，造成服务器过载，无法为正常请求服务。
为了解决上述问题，现有技术中管理员在服务器中设置虚拟交换机(Vswitch)，并为虚拟交换机配置了安全组规则。安全组规则是一种判断报文是否安全的规则，服务器的虚拟交换机每接收到一个报文，都会根据安全组规则对报文的安全性进行判定，只有通过了安全组规则判定的报文，才会被虚拟交换机转发给服务器中的虚拟机(VM，Vritual Machine)，不通过安全组规则判定的报文直接被丢弃。这样就保证了服务器中的VM无需处理攻击报文，降低了服务器过载的概率。
但是在DDoS场景下存在着大量的攻击报文，安全组规则需要对所有的攻击报文进行判定，耗费了大量的处理器(CPU，Central Processing Unit)资源，导致正常报文很可能由于CPU资源耗尽而无法得到处理。
发明内容
本发明实施例提供了一种网络控制方法、虚拟交换机和服务器，可以节约服务器CPU的资源，降低服务器CPU的功耗，缩短系统时延，提升报文处理的效率。
本发明实施例第一方面提供了一种网络控制方法，包括：
目的虚拟机VM的第一虚拟交换机接收源VM发送的第一报文；
所述第一虚拟交换机配置有安全组规则，所述第一虚拟交换机获取所述第一报文的流识别信息，并根据所述安全组规则和所述第一报文的流识别信息， 对所述第一报文的有效性进行判断；
若所述第一虚拟交换机根据所述安全组规则和所述第一报文的流识别信息确定所述第一报文无效，则所述第一虚拟交换机向所述源VM的第二虚拟交换机发送第二报文，所述第二报文用于表示所述第一报文无效。
结合本发明实施例的第一方面，本发明实施例的第一方面的第一种实现方式中，所述第一虚拟交换机还配置有流表，所述流表记录了所述安全组规则对不同报文的有效性的判断结果，所述根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断之前还包括：
所述第一虚拟交换机从所述流表中，根据所述第一报文的流识别信息，查找所述第一报文的有效性；
若所述第一虚拟交换机在所述流表中没有查找到所述第一报文的有效性，则触发所述根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断的步骤；
若所述第一虚拟交换机在所述流表中查找到所述第一报文的有效性，并且所述第一报文的有效性为有效，则所述第一虚拟交换机将所述第一报文发送给所述目的VM。
结合本发明实施例的第一方面的第一种实现方式，本发明实施例的第一方面的第二种实现方式中，所述方法还包括：
若所述第一虚拟交换机根据所述安全组规则确定所述第一报文有效，则所述第一虚拟交换机将所述第一报文的有效性记录到所述流表中，并将所述第一报文发送给所述目的VM；
所述第一虚拟交换机向所述源VM的第二虚拟交换机发送第三报文，所述第三报文用于表示所述第一报文有效。
结合本发明实施例的第一方面、第一方面的第一种或第二种实现方式中的任一项，本发明实施例的第一方面的第三种实现方式中，所述流识别信息包括以下至少之一：源IP地址、目的IP地址、IP协议类型、源端口号、和目的端口号。
结合本发明实施例的第一方面的第三种实现方式，本发明实施例的第一方面的第四种实现方式中，所述流识别信息还包括以下至少之一：所述源VM的 集群标识、数据中心标识、和用户名。
结合本发明实施例的第一方面的第四种实现方式，本发明实施例的第一方面的第五种实现方式中，所述第一报文为虚拟扩展局域网VXLAN报文，所述第一报文通过VXLAN头部携带以下至少之一：所述源VM的集群标识、数据中心标识、和用户名。
本发明实施例的第二方面提供了一种虚拟交换机，所述虚拟交换机适用于服务器，所述虚拟交换机用于管理所述服务器中的目的VM收发的报文，所述虚拟交换机配置有安全组规则，所述虚拟交换机包括：
接收模块，用于接收源虚拟机VM发送的第一报文；
判断模块，用于获取所述第一报文的流识别信息，并根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断；
第一发送模块，用于当所述判断模块根据所述安全组规则和所述第一报文的流识别信息确定所述第一报文无效时，向所述源VM的虚拟交换机发送第二报文，所述第二报文用于表示所述第一报文无效。
结合本发明实施例的第二方面，本发明实施例的第二方面的第一种实现方式中，所述虚拟交换机还配置有流表，所述流表记录了所述安全组规则对不同报文的有效性的判断结果，所述虚拟交换机还包括：
查找模块，用于在所述判断模块根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断之前，从所述流表中，根据所述第一报文的流识别信息，查找所述第一报文的有效性，若所述查找模块在所述流表中没有查找到所述第一报文的有效性，则触发所述判断模块根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断的步骤；
所述虚拟交换机还包括：
第二发送模块，用于当所述查找模块在所述流表中查找到所述第一报文的有效性，并且所述第一报文的有效性为有效时，将所述第一报文发送给所述目的VM。
结合本发明实施例的第二方面的第一种实现方式，本发明实施例的第二方面的二种实现方式中，所述虚拟交换机还包括：
记录模块，用于当所述判断模块根据所述安全组规则确定所述第一报文有效时，将所述第一报文的有效性记录到所述流表中，并触发所述第二发送模块将所述第一报文发送给所述目的VM的操作；
所述第一发送模块还用于：当所述判断模块根据所述安全组规则确定所述第一报文有效时，向所述源VM的虚拟交换机发送第三报文，所述第三报文用于表示所述第一报文有效。
结合本发明实施例的第二方面、第二方面的第一种或第二种实现方式中的任一项，本发明实施例的第二方面的第三种实现方式中，所述流识别信息包括以下至少之一：源IP地址、目的IP地址、IP协议类型、源端口号、和目的端口号。
结合本发明实施例的第二方面的第三种实现方式，本发明实施例的第二方面的第四种实现方式中，所述流识别信息还包括以下至少之一：所述源VM的集群标识、数据中心标识、和用户名。
结合本发明实施例的第二方面的第四种实现方式，本发明实施例的第二方面的第五种实现方式中，所述第一报文为虚拟扩展局域网VXLAN报文，所述第一报文通过VXLAN头部携带以下至少之一：所述源VM的集群标识、数据中心标识、和用户名。
本发明实施例的第三方面提供了一种服务器，包括：输入装置、输出装置、处理器和存储器，所述处理器和所述存储器通过所述输入装置接收所述服务器外部的信息，所述处理器和所述存储器通过所述输出装置将信息发送到所述服务器的外部；
其中，所述存储器中存储有第一程序代码，所述第一程序代码用于实现虚拟交换机功能；
通过调用所述存储器存储的所述第一程序代码，所述处理器用于执行如下步骤：
接收源虚拟机VM发送的第一报文；
获取所述第一报文的流识别信息，并根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断；
若根据所述安全组规则和所述第一报文的流识别信息确定所述第一报文 无效，则向所述源VM的第二虚拟交换机发送第二报文，所述第二报文用于表示所述第一报文无效。
结合本发明实施例的第三方面，本发明实施例的第三方面的第一种实现方式中，所述第一程序代码中包括流表，所述流表记录了所述安全组规则对不同报文的有效性的判断结果，所述存储器中还存储有第二程序代码，，所述第二程序代码用于实现目的VM功能，通过调用所述存储器存储的第一程序代码，所述处理器还用于执行如下步骤：
从所述流表中，根据所述第一报文的流识别信息，查找所述第一报文的有效性；
若在所述流表中没有查找到所述第一报文的有效性，则触发所述根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断的步骤；
若在所述流表中查找到所述第一报文的有效性，并且所述第一报文的有效性为有效，则将所述第一报文发送给所述目的VM。
结合本发明实施例的第三方面的第一种实现方式，本发明实施例的第三方面的第二种实现方式中，所通过调用所述存储器存储的第一程序代码，所述处理器还用于执行如下步骤：
若根据所述安全组规则确定所述第一报文有效，则将所述第一报文的有效性记录到所述流表中，并将所述第一报文发送给所述目的VM；
向所述源VM的第二虚拟交换机发送第三报文，所述第三报文用于表示所述第一报文有效。
结合本发明实施例的第三方面、第三方面的第一种或第二种实现方式中的任一项，本发明实施例的第三方面的第三种实现方式中，所述流识别信息包括以下至少之一：源IP地址、目的IP地址、IP协议类型、源端口号、和目的端口号。
结合本发明实施例的第三方面的第三种实现方式，本发明实施例的第三方面的第四种实现方式中，所述流识别信息还包括以下至少之一：所述源VM的集群标识、数据中心标识、和用户名。
结合本发明实施例的第三方面的第四种实现方式，本发明实施例的第三方 面的第五种实现方式中，所述第一报文为虚拟扩展局域网VXLAN报文，所述第一报文通过VXLAN头部携带以下至少之一：所述源VM的集群标识、数据中心标识、和用户名。
本发明实施例提供了一种网络控制方法，包括目的VM的第一虚拟交换机接收源VM发送的第一报文；第一虚拟交换机配置有安全组规则，第一虚拟交换机获取第一报文的流识别信息，并根据安全组规则和第一报文的流识别信息对所述第一报文的有效性进行判断；若确定所述第一报文无效，向所述源VM的第二虚拟交换机发送第二报文，第二报文用于表示第一报文无效。通过这样的方法，使得第二虚拟交换机可以获知并记录第一报文的有效性，若第一报文的有效性为无效，则第二虚拟机后续将不会发送与第一报文具有相同的流识别信息的报文，这样就可以减少第一虚拟交换机进行安全组判定的报文数据量，节约了服务器的CPU资源。因此，本发明实施例所提供的方法能够节约服务器CPU的资源，降低服务器CPU的功耗，缩短系统时延，提升报文处理的效率。
附图说明
图1为现阶段技术中网络控制原理的示意图；
图2为本发明实施例中网络控制原理的示意图；
图3为本发明实施例中网络控制方法一个实施例流程图；
图4为本发明实施例中网络控制方法另一个实施例流程图；
图5为本发明实施例中虚拟交换机一个实施例结构图；
图6为本发明实施例中虚拟交换机另一个实施例结构图；
图7为本发明实施例中服务器一个实施例结构图。
具体实施方式
本发明实施例提供了一种网络控制方法，可以节约服务器CPU的资源，降低服务器CPU的功耗，缩短系统时延，提升报文处理的效率。本发明还提 出了相关的虚拟交换机与服务器，以下将分别进行说明。
VM是服务器中一种通过软件模拟的、具有完整硬件系统功能的计算机系统，一个服务器上可以部署一个或多个VM。虚拟交换机是服务器上划分出的一种介于硬件和操作系统之间的功能软件，用于管理同一服务器中的VM之间的报文收发，或不同服务器的VM之间的报文收发。可以理解的，同一个服务器中的多个VM可以共用一个虚拟交换机。
现阶段的技术进行网络控制的原理请参阅图1。无论是恶意VM还是用户VM，向目的VM发送的报文均需要经过目的VM的虚拟交换机的有效性判定。具体的，目的VM的虚拟交换机中配置有安全组规则，并根据安全组规则对接收到的报文进行有效性判定。对于用户VM发送的正常报文，目的VM的虚拟交换机根据安全组规则判定该报文有效，并将该报文转发给目的VM。对于恶意VM发送的攻击报文，目的VM的虚拟交换机根据安全组规则判定该报文无效，不会将该报文转发给目的VM。这种方法需要目的VM的虚拟交换机对所有接收到的报文进行安全性判定。为了减少目的VM的虚拟交换机进行安全性判定的次数，节约目的服务器的CPU资源，本发明实施例对现有技术的原理做出了改进，请参阅图2：
图2所示的原理图中，当目的VM的虚拟交换机接收到攻击报文首报(本发明实施例中用“首报”表示第一封报文，第一报文首报即第一封攻击报文)时，根据安全组规则确定该攻击报文首报的有效性为无效，则通知发送攻击报文的恶意VM的虚拟交换机：该攻击报文首报的有效性为无效。恶意VM的虚拟交换机获知了攻击报文首报为无效报文后，就不会把后续的攻击报文发送给目的VM。
下面解释恶意VM的虚拟交换机可以拦截后续的攻击报文的原理。网络中的报文往往携带有流识别信息，具体的，流识别信息可以包括源IP(Internet Protocol)地址、目的IP地址、IP协议类型、源端口号、目的端口号中的一项或多项。流识别信息用于作为安全组规则判断报文的有效性的判断依据。一般地，归属于同一个流的报文，其流识别信息相同，因此虚拟交换机根据安全组规则对同一个流的报文进行有效性判定，其判定结果也相同。若将虚拟交换机根据安全组规则对报文的有效性判定结果记录下来，则可以得到流表。以流识 别信息为源IP地址、目的IP地址、IP协议类型、源端口号、和目的端口号为例，流表的结构请参阅表1，其中表1仅为流表结构的一个形象说明，不一定是流表保存在虚拟交换机中的真实结构：
Figure PCTCN2014095988-appb-000001
表1
表1所示的流表的结构中，每一行为一个表项，不同的表项中记录了安全组规则对具有不同的流识别信息的报文的有效性的判断结果。例如，第一行的表项表示：流识别信息包括源IP地址A、目的IP地址A、IP协议类型A、源端口号A与目的端口号A的报文，安全组规则对其有效性的判断结果为有效。
网络中的VM的虚拟交换机均可以配置有流表。这样，当恶意VM的虚拟交换机获知了攻击报文首报为无效报文后，可以在自身的流表中记录攻击报文首报的流识别信息，并记录该流识别信息对应的有效性为无效。这样，恶意VM产生后续攻击报文时，由于后续攻击报文与攻击报文首报属于同一个流，其流识别信息相同，因此恶意VM的虚拟交换机就可以获知后续攻击报文为无效，不会把后续的攻击报文发送给目的VM。这样就使得大量的攻击报文在恶意VM处就被拦截，无需目的VM的虚拟交换机进行安全性判定。
可选的，目的VM的虚拟交换机中也可以配置有流表，用于记录安全组规则对不同报文的有效性的判定结果。当目的VM的虚拟交换机接收到报文时，可以先从配置的流表中查找接收到的报文的有效性，若查找不到再根据安全组规则进行判定。由于查找流表的操作要比根据安全组规则进行判定简单易行，因此能够进一步的节约目的服务器的CPU资源。
在图2所示的原理的基础上，本发明实施例提供的网络控制方法可以被表示为如下基本流程，如图3所示：
301、目的VM的第一虚拟交换机接收源VM发送的第一报文；
本实施例中，第一虚拟交换机为目的VM的虚拟交换机，第一虚拟交换机与目的VM均位于目的服务器中，第一虚拟交换机接收源VM发送的第一报文。
302、第一虚拟交换机获取第一报文的流识别信息，并根据安全组规则和第一报文的流识别信息，对第一报文的有效性进行判断；
303、若第一虚拟交换机根据安全组规则确定第一报文无效，则第一虚拟交换机向源VM的第二虚拟交换机发送第二报文，其中第二虚拟交换机为源VM的虚拟交换机，其中第二报文用于表示第一报文无效。
本实施例提供的网络控制方法，使得第二虚拟交换机可以获知并记录第一报文的有效性，若第一报文的有效性为无效，则第二虚拟机后续将不会发送与第一报文具有相同的流识别信息的报文，这样就可以减少第一虚拟交换机进行安全组判定的报文数据量，节约了目的服务器的CPU资源。因此，本发明实施例所提供的方法能够节约目的服务器CPU的资源，降低目的服务器CPU的功耗，缩短系统时延，提升报文处理的效率。
可选的，作为本发明的又一个实施例，若第一虚拟交换机也配置有流表，则本发明提供的网络控制方法也可以被扩展为图4所示的流程：
401、目的VM的第一虚拟交换机接收源VM发送的第一报文；
402、第一虚拟交换机获取第一报文的流识别信息，并从流表中，根据第一报文的流识别信息，查找所述第一报文的有效性；
本实施例中，第一虚拟交换机配置有流表。第一虚拟交换机获取第一报文的流识别信息，并从自身的流表中，根据第一报文的流识别信息，查找所述第一报文的有效性。其中，若第一虚拟交换机在自身的流表中查找到第一报文的有效性为有效，则执行步骤403；若没有查找到第一报文的有效性，则执行步骤404。
403、第一虚拟交换机将第一报文发送给目的VM；
404、第一虚拟交换机根据安全组规则和第一报文的流识别信息，对第一报文的有效性进行判断；
若第一虚拟交换机根据安全组规则和第一报文的流识别信息确定第一报文无效，则执行步骤405；若第一虚拟交换机根据安全组规则和第一报文的流 识别信息确定第一报文有效，则执行步骤406。
405、第一虚拟交换机向源VM的第二虚拟交换机发送第二报文；
若第一虚拟交换机根据安全组规则和第一报文的流识别信息确定第一报文无效，则第一虚拟交换机向源VM的第二虚拟交换机发送第二报文，第二报文用于表示第一报文无效。第二虚拟交换机可以根据第二报文，获知第一报文的有效性为无效，并不再发送与第一报文具有相同流识别信息的报文。其中，第二虚拟交换机为源VM的虚拟交换机。
406、第一虚拟交换机将第一报文的有效性记录到流表中，并将第一报文发送给目的VM；
若第一虚拟交换机根据安全组规则和第一报文的流识别信息确定第一报文有效，则第一虚拟交换机将第一报文的有效性记录到自身的流表中，并将第一报文发送给目的VM。
其中，第一虚拟机将第一报文的有效性记录到流表中，可以实现第一虚拟交换机中配置的流表的自主更新。但第一虚拟机将第一报文的有效性记录到流表中为可选操作，本实施例中第一虚拟交换机也可以不执行该记录操作。
407、第一虚拟交换机向源VM的第二虚拟交换机发送第三报文。
第一虚拟交换机向源VM的第二虚拟交换机发送第三报文，第三报文用于表示所述第一报文有效。其中，步骤407为可选操作，本实施例中第一虚拟交换机也可以不执行步骤407的操作。其中，步骤407与步骤406的先后执行顺序不做限定，若第一虚拟交换机根据安全组规则和第一报文的流识别信息确定第一报文有效，也可以先执行步骤407，再执行步骤406，此处不做限定。
本实施例提供的方法中，第一虚拟交换机接收到第一报文后，先在自身的流表中查找第一报文的有效性，若查找不到再根据安全组规则进行安全性判定。本实施例提供的方法使得第一虚拟交换机可以用查找流表操作来替代部分的安全性判定操作。由于查找流表的操作要比根据安全组规则进行判定简单易行，因此本实施例提供的方法能够进一步的节约目的服务器的CPU资源。
特别的，流识别信息中除了包括源IP地址、目的IP地址、IP协议类型、源端口号、和目的端口号中的一项或多项外，还可以包括源VM的集群标识、数据中心标识、和用户名中的一项或多项，作为安全组规则的扩展的判断依据。 可以理解的，流表的结构也应随着流识别信息进行扩展。例如，若扩展后的流识别信息中包括源IP地址、目的IP地址、IP协议类型、源端口号、目的端口号、集群标识、和用户名，则扩展后的流表的结构请参阅表2：
Figure PCTCN2014095988-appb-000002
表2
一般的，第一报文可以为虚拟扩展局域网(VXLAN，Virtual eXtensible Local Area Network)报文，该第一报文通过VXLAN头部携带源VM的集群标识、数据中心标识、和用户名中的一项或多项。
上面的实施例解释了本发明提供的网络控制方法的基本流程，下面将以一个具体的应用场景为例进行描述。
网络中存在用户VM和恶意VM，用户VM和恶意VM同时向目的VM的虚拟交换机发送报文。目的VM的虚拟交换机接收恶意VM发送的报文1，和用户VM发送的报文2。
目的VM的虚拟交换机中保存有流表A。目的VM的虚拟交换机获取报文1的流识别信息，具体包括：源IP地址1、目的IP地址1、IP协议类型1、源端口号1、目的端口号1、集群标识1、数据中心标识1、用户名1。目的VM的虚拟交换机从流表A中查找到报文1的流识别信息对应的有效性为无效，因此向恶意VM的虚拟交换机发送报文，告知报文1为无效。恶意VM的虚拟交换机中保存有流表B，恶意VM的虚拟交换机在流表B中记录报文1的流识别信息以及其有效性为无效。当恶意VM试图向目的VM发送后续的报文时，恶意VM的虚拟交换机会在流表B中查找这些后续的报文的有效性。若这些后续的报文的流识别信息与报文1的流识别信息相同，则恶意VM的虚拟交换机确定后续的报文无效，在恶意VM端将后续的报文拦截，不发送给目的VM。
目的VM的虚拟交换机获取报文2的流识别信息，具体包括：源IP地址2、目的IP地址2、IP协议类型2、源端口号2、目的端口号2、集群标识2、数据中心标识2、用户名2。目的VM的虚拟交换机从流表A中没有查找到报 文2的流识别信息对应的有效性，于是根据安全组规则和报文2的流识别信息，对报文2有效性进行判断。判断结果为报文2有效，于是目的VM的虚拟交换机将报文2发送给目的VM，并在流表A中记录报文2的流识别信息以及其有效性为有效。目的VM的虚拟交换机还向用户VM的虚拟交换机发送报文，告知报文2为无效。用户VM的虚拟交换机中保存有流表C，用户VM的虚拟交换机在流表C中记录报文2的流识别信息以及其有效性为有效。当用户VM需要向目的VM发送后续的报文时，用户VM的虚拟交换机会在流表C中查找这些后续的报文的有效性。若这些后续的报文的流识别信息与报文2的流识别信息相同，则用户VM的虚拟交换机确定后续的报文有效，并发送给目的VM。
本发明实施例还提供了相关的虚拟交换机，该虚拟交换机适用于服务器，且配置有安全组规则，用于实现图3或图4所示的实施例的流程。其中，该虚拟交换机所在的服务器称为目的服务器，该虚拟交换机可以管理服务器中的目的VM所收发的报文，其基本结构500请参阅图5，包括：
接收模块501，用于接收源虚拟机VM发送的第一报文；
判断模块502，用于获取第一报文的流识别信息，并根据安全组规则和第一报文的流识别信息，对第一报文的有效性进行判断；
第一发送模块503，用于当判断模块502根据安全组规则和第一报文的流识别信息确定第一报文无效时，向源VM的虚拟交换机发送第二报文，该第二报文用于表示第一报文无效。
本实施例提供的虚拟交换机中，接收模块501接收源VM发送的第一报文，判断模块502获取第一报文的流识别信息，并根据安全组规则和第一报文的流识别信息，对第一报文的有效性进行判断，若判断模块502确定第一报文无效，则第一发送模块503，向源VM的虚拟交换机发送第二报文，该第二报文用于表示第一报文无效。这样就使得源VM的虚拟交换机可以获知并记录第一报文的有效性，若第一报文的有效性为无效，则源VM的虚拟机后续将不会发送与第一报文具有相同的流识别信息的报文，这样就可以减少目的VM的虚拟交换机进行安全组判定的报文数据量，节约了目的服务器的CPU资源。因此，本发明实施例所提供的虚拟交换机能够节约目的服务器CPU的资源，降低目的 服务器CPU的功耗，缩短系统时延，提升报文处理的效率。
可选的，本发明实施例提供的虚拟交换机还可以配置有流表，该流表中记录了安全组规则对不同报文的有效性的判断结果。配置有流表的虚拟交换机600的结构如图6所示：
接收模块601，用于接收源虚拟机VM发送的第一报文；
判断模块602，用于获取第一报文的流识别信息，并根据安全组规则和第一报文的流识别信息，对第一报文的有效性进行判断；
查找模块603，用于在判断模块根据所述安全组规则和所述第一报文的流识别信息，对第一报文的有效性进行判断之前，从流表中，根据第一报文的流识别信息，查找第一报文的有效性。若查找模块603在流表中没有查找到第一报文的有效性，则触发判断模块602根据安全组规则和第一报文的流识别信息，对第一报文的有效性进行判断的步骤；
第一发送模块604，用于当判断模块602根据安全组规则和第一报文的流识别信息确定第一报文无效时，向源VM的虚拟交换机发送第二报文，该第二报文用于表示第一报文无效。源VM的虚拟交换机可以根据第二报文，获知第一报文的有效性为无效，并不再发送与第一报文具有相同流识别信息的报文。
第二发送模块605，用于当查找模块603在流表中查找到第一报文的有效性，并且第一报文的有效性为有效时，将第一报文发送给目的VM。
可选的，本实施例中，虚拟交换机还可以包括记录模块606，用于当判断模块602根据安全组规则确定第一报文有效时，将第一报文的有效性记录到流表中，实现虚拟交换机中配置的流表的自主更新，并触发第二发送模块605将第一报文发送给目的VM的操作；
可选的，本实施例中，第一发送模块604还用于：当判断模块602根据安全组规则确定第一报文有效时，向源VM的虚拟交换机发送第三报文，该第三报文用于表示所述第一报文有效。源VM的虚拟交换机可以根据第三报文，获知第一报文的有效性为有效，后续可以发送与第一报文具有相同流识别信息的报文。
特别的，流识别信息中除了包括源IP地址、目的IP地址、IP协议类型、源端口号、和目的端口号中的一项或多项外，还可以包括集群标识、数据中心 标识、和用户名中的一项或多项，作为安全组规则的扩展的判断依据。可以理解的，流表的结构也应随着流识别信息进行扩展。
一般的，第一报文可以为虚拟扩展局域网(VXLAN，Virtual eXtensible Local Area Network)报文，该第一报文通过VXLAN头部携带源VM的集群标识、数据中心标识、和/或用户名。
上面的实施例解释了本发明提供的虚拟交换机的基本结构，下面将以一个具体的应用场景为例进行描述。
网络中存在用户VM和恶意VM，用户VM和恶意VM同时向目的VM的虚拟交换机发送报文。目的VM的虚拟交换机的接收模块601接收恶意VM发送的报文1，和用户VM发送的报文2。
目的VM的虚拟交换机中保存有流表A。判断模块602获取报文1的流识别信息，具体包括：源IP地址1、目的IP地址1、IP协议类型1、源端口号1、目的端口号1、集群标识1、数据中心标识1、用户名1。查找模块603从流表A中查找到报文1的流识别信息对应的有效性为无效，因此第一发送模块604向恶意VM的虚拟交换机发送报文，告知报文1为无效。恶意VM的虚拟交换机中保存有流表B，恶意VM的虚拟交换机在流表B中记录报文1的流识别信息以及其有效性为无效。当恶意VM试图向目的VM发送后续的报文时，恶意VM的虚拟交换机会在流表B中查找这些后续的报文的有效性。若这些后续的报文的流识别信息与报文1的流识别信息相同，则恶意VM的虚拟交换机确定后续的报文无效，在恶意VM端将后续的报文拦截，不发送给目的VM。
目的VM的虚拟交换机判断模块602获取报文2的流识别信息，具体包括：源IP地址2、目的IP地址2、IP协议类型2、源端口号2、目的端口号2、集群标识2、数据中心标识2、用户名2。查找模块603从流表A中没有查找到报文2的流识别信息对应的有效性，于是判断模块602根据安全组规则和报文2的流识别信息，对报文2有效性进行判断。判断结果为报文2有效，于是第二发送模块605将报文2发送给目的VM，记录模块606在流表A中记录报文2的流识别信息以及其有效性为有效。第一发送模块604还向用户VM的虚拟交换机发送报文，告知报文2为有效。用户VM的虚拟交换机中保存有流表C，用户VM的虚拟交换机在流表C中记录报文2的流识别信息以及其有效性为 有效。当用户VM需要向目的VM发送后续的报文时，用户VM的虚拟交换机会在流表C中查找这些后续的报文的有效性。若这些后续的报文的流识别信息与报文2的流识别信息相同，则用户VM的虚拟交换机确定后续的报文有效，并发送给目的VM。
上面从单元化功能实体的角度对本发明实施例中的虚拟交换机进行了描述，下面从硬件处理的角度对本发明实施例中虚拟交换机所在的服务器进行描述，请参阅图7，本发明实施例中的服务器700另一实施例包括：
输入装置701、输出装置702、处理器703和存储器704(其中服务器700中的处理器703的数量可以一个或多个，图7中以一个处理器703为例)。处理器703和存储器704通过输入装置701接收服务器外部的信息，处理器703和存储器704通过输出装置702将信息发送到服务器外部。在本发明的一些实施例中，输入装置701、输出装置702、处理器703和存储器704可通过总线或其它方式连接，其中，图7中以通过总线连接为例。
其中，所述存储器704中存储有第一程序代码与第二程序代码，所述第一程序代码用于实现虚拟交换机功能，所述第二程序代码用于实现目的虚拟机VM功能，通过调用存储器704存储的第一程序代码，处理器703用于执行如下步骤：
接收源虚拟机VM发送的第一报文；
获取所述第一报文的流识别信息，并根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断；
若根据所述安全组规则和所述第一报文的流识别信息确定所述第一报文无效，则向所述源VM的第二虚拟交换机发送第二报文，所述第二报文用于表示所述第一报文无效。
本发明的一些实施例中，第一程序代码中还配置有流表，所述流表记录了所述安全组规则对不同报文的有效性的判断结果，处理器703还执行如下步骤：
从所述流表中，根据所述第一报文的流识别信息，查找所述第一报文的有效性；
若在所述流表中没有查找到所述第一报文的有效性，则触发所述根据所述 安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断的步骤；
若在所述流表中查找到所述第一报文的有效性，并且所述第一报文的有效性为有效，则将所述第一报文发送给所述服务器。
本发明的一些实施例中，处理器703还执行如下步骤：
若根据所述安全组规则确定所述第一报文有效，则将所述第一报文的有效性记录到所述流表中，并将所述第一报文发送给所述服务器；
向所述源VM的第二虚拟交换机发送第三报文，所述第三报文用于表示所述第一报文有效。
本发明的一些实施例中，所述流识别信息包括以下至少之一：源IP地址、目的IP地址、IP协议类型、源端口号、和目的端口号。
本发明的一些实施例中，所述流识别信息还包括以下至少之一：集群标识、数据中心标识、和用户名。
本发明的一些实施例中，所述第一报文为虚拟扩展局域网VXLAN报文，所述第一报文通过VXLAN头部携带所述源VM的集群标识、数据中心标识、和用户名中的一项或多项。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，模块和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统和方法，可以通过其它的方式实现。例如，以上所描述的系统实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，模块或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部 单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。

Claims (18)

  1. 一种网络控制方法，其特征在于，包括：
    目的虚拟机VM的第一虚拟交换机接收源VM发送的第一报文；
    所述第一虚拟交换机配置有安全组规则，所述第一虚拟交换机获取所述第一报文的流识别信息，并根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断；
    若所述第一虚拟交换机根据所述安全组规则和所述第一报文的流识别信息确定所述第一报文无效，则所述第一虚拟交换机向所述源VM的第二虚拟交换机发送第二报文，所述第二报文用于表示所述第一报文无效。
  2. 根据权利要求1所述的网络控制方法，其特征在于，所述第一虚拟交换机还配置有流表，所述流表记录了所述安全组规则对不同报文的有效性的判断结果，所述根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断之前还包括：
    所述第一虚拟交换机从所述流表中，根据所述第一报文的流识别信息，查找所述第一报文的有效性；
    若所述第一虚拟交换机在所述流表中没有查找到所述第一报文的有效性，则触发所述根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断的步骤；
    若所述第一虚拟交换机在所述流表中查找到所述第一报文的有效性，并且所述第一报文的有效性为有效，则所述第一虚拟交换机将所述第一报文发送给所述目的VM。
  3. 根据权利要求2所述的网络控制方法，其特征在于，所述方法还包括：
    若所述第一虚拟交换机根据所述安全组规则确定所述第一报文有效，则所述第一虚拟交换机将所述第一报文的有效性记录到所述流表中，并将所述第一报文发送给所述目的VM；
    所述第一虚拟交换机向所述源VM的第二虚拟交换机发送第三报文，所述第三报文用于表示所述第一报文有效。
  4. 根据权利要求1至3中任一项所述的网络控制方法，其特征在于，所述流识别信息包括以下至少之一：源IP地址、目的IP地址、IP协议类型、源 端口号、和目的端口号。
  5. 根据权利要求4所述的网络控制方法，其特征在于，所述流识别信息还包括以下至少之一：所述源VM的集群标识、数据中心标识、和用户名。
  6. 根据权利要求5所述的网络控制方法，其特征在于，所述第一报文为虚拟扩展局域网VXLAN报文，所述第一报文通过VXLAN头部携带以下至少之一：所述源VM的集群标识、数据中心标识、和用户名。
  7. 一种虚拟交换机，所述虚拟交换机适用于服务器，所述虚拟交换机用于管理所述服务器中的目的VM收发的报文，所述虚拟交换机配置有安全组规则，其特征在于，所述虚拟交换机包括：
    接收模块，用于接收源虚拟机VM发送的第一报文；
    判断模块，用于获取所述第一报文的流识别信息，并根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断；
    第一发送模块，用于当所述判断模块根据所述安全组规则和所述第一报文的流识别信息确定所述第一报文无效时，向所述源VM的虚拟交换机发送第二报文，所述第二报文用于表示所述第一报文无效。
  8. 根据权利要求7所述的虚拟交换机，其特征在于，所述虚拟交换机还配置有流表，所述流表记录了所述安全组规则对不同报文的有效性的判断结果，所述虚拟交换机还包括：
    查找模块，用于在所述判断模块根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断之前，从所述流表中，根据所述第一报文的流识别信息，查找所述第一报文的有效性，若所述查找模块在所述流表中没有查找到所述第一报文的有效性，则触发所述判断模块根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断的步骤；
    所述虚拟交换机还包括：
    第二发送模块，用于当所述查找模块在所述流表中查找到所述第一报文的有效性，并且所述第一报文的有效性为有效时，将所述第一报文发送给所述目的VM。
  9. 根据权利要求8所述的虚拟交换机，其特征在于，所述虚拟交换机还 包括：
    记录模块，用于当所述判断模块根据所述安全组规则确定所述第一报文有效时，将所述第一报文的有效性记录到所述流表中，并触发所述第二发送模块将所述第一报文发送给所述目的VM的操作；
    所述第一发送模块还用于：当所述判断模块根据所述安全组规则确定所述第一报文有效时，向所述源VM的虚拟交换机发送第三报文，所述第三报文用于表示所述第一报文有效。
  10. 根据权利要求7至9中任一项所述的虚拟交换机，其特征在于，所述流识别信息包括以下至少之一：源IP地址、目的IP地址、IP协议类型、源端口号、和目的端口号。
  11. 根据权利要求10所述的虚拟交换机，其特征在于，所述流识别信息还包括以下至少之一：所述源VM的集群标识、数据中心标识、和用户名。
  12. 根据权利要求11所述的虚拟交换机，其特征在于，所述第一报文为虚拟扩展局域网VXLAN报文，所述第一报文通过VXLAN头部携带以下至少之一：所述源VM的集群标识、数据中心标识、和用户名。
  13. 一种服务器，其特征在于，包括：输入装置、输出装置、处理器和存储器，所述处理器和所述存储器通过所述输入装置接收所述服务器外部的信息，所述处理器和所述存储器通过所述输出装置将信息发送到所述服务器的外部；
    其中，所述存储器中存储有第一程序代码，所述第一程序代码用于实现虚拟交换机功能；
    通过调用所述存储器存储的所述第一程序代码，所述处理器用于执行如下步骤：
    接收源虚拟机VM发送的第一报文；
    获取所述第一报文的流识别信息，并根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断；
    若根据所述安全组规则和所述第一报文的流识别信息确定所述第一报文无效，则向所述源VM的第二虚拟交换机发送第二报文，所述第二报文用于表示所述第一报文无效。
  14. 根据权利要求13所述的服务器，其特征在于，所述第一程序代码中包括流表，所述流表记录了所述安全组规则对不同报文的有效性的判断结果，所述存储器中还存储有第二程序代码，，所述第二程序代码用于实现目的VM功能，通过调用所述存储器存储的第一程序代码，所述处理器还用于执行如下步骤：
    从所述流表中，根据所述第一报文的流识别信息，查找所述第一报文的有效性；
    若在所述流表中没有查找到所述第一报文的有效性，则触发所述根据所述安全组规则和所述第一报文的流识别信息，对所述第一报文的有效性进行判断的步骤；
    若在所述流表中查找到所述第一报文的有效性，并且所述第一报文的有效性为有效，则将所述第一报文发送给所述目的VM。
  15. 根据权利要求14所述的服务器，其特征在于，所通过调用所述存储器存储的第一程序代码，所述处理器还用于执行如下步骤：
    若根据所述安全组规则确定所述第一报文有效，则将所述第一报文的有效性记录到所述流表中，并将所述第一报文发送给所述目的VM；
    向所述源VM的第二虚拟交换机发送第三报文，所述第三报文用于表示所述第一报文有效。
  16. 根据权利要求13至15中任一项所述的服务器，其特征在于，所述流识别信息包括以下至少之一：源IP地址、目的IP地址、IP协议类型、源端口号、和目的端口号。
  17. 根据权利要求16所述的服务器，其特征在于，所述流识别信息还包括以下至少之一：所述源VM的集群标识、数据中心标识、和用户名。
  18. 根据权利要求17所述的服务器，其特征在于，所述第一报文为虚拟扩展局域网VXLAN报文，所述第一报文通过VXLAN头部携带以下至少之一：所述源VM的集群标识、数据中心标识、和用户名。
PCT/CN2014/095988 2014-12-31 2014-12-31 一种网络控制方法与虚拟交换机 WO2016106718A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/CN2014/095988 WO2016106718A1 (zh) 2014-12-31 2014-12-31 一种网络控制方法与虚拟交换机
CN201480084433.8A CN107113280A (zh) 2014-12-31 2014-12-31 一种网络控制方法与虚拟交换机

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2014/095988 WO2016106718A1 (zh) 2014-12-31 2014-12-31 一种网络控制方法与虚拟交换机

Publications (1)

Publication Number Publication Date
WO2016106718A1 true WO2016106718A1 (zh) 2016-07-07

Family

ID=56283990

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/095988 WO2016106718A1 (zh) 2014-12-31 2014-12-31 一种网络控制方法与虚拟交换机

Country Status (2)

Country Link
CN (1) CN107113280A (zh)
WO (1) WO2016106718A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111698167A (zh) * 2020-04-01 2020-09-22 新华三大数据技术有限公司 一种报文处理方法及装置

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112822262B (zh) * 2021-01-04 2022-11-22 北京知道创宇信息技术股份有限公司 报文处理方法和装置、报文处理设备及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080052691A1 (en) * 2006-06-29 2008-02-28 Naveen Neelakantam Communicating with and recovering state information from a dynamic translator
CN102801729A (zh) * 2012-08-13 2012-11-28 福建星网锐捷网络有限公司 虚拟机报文转发方法、网络交换设备及通信系统
US20140007232A1 (en) * 2011-05-13 2014-01-02 International Business Machines Corporation (Ibm) Method and apparatus to detect and block unauthorized mac address by virtual machine aware network switches
CN104007997A (zh) * 2013-02-22 2014-08-27 中兴通讯股份有限公司 虚拟机安全组的配置方法及装置

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101202742B (zh) * 2006-12-13 2011-10-26 中兴通讯股份有限公司 一种防止拒绝服务攻击的方法和系统
CN101494639A (zh) * 2008-01-25 2009-07-29 华为技术有限公司 一种分组通信系统中防止攻击的方法及装置
CN103237039A (zh) * 2013-05-10 2013-08-07 汉柏科技有限公司 一种报文转发方法及设备
CN103581183B (zh) * 2013-10-30 2017-01-04 华为技术有限公司 一种虚拟化安全隔离方法与装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080052691A1 (en) * 2006-06-29 2008-02-28 Naveen Neelakantam Communicating with and recovering state information from a dynamic translator
US20140007232A1 (en) * 2011-05-13 2014-01-02 International Business Machines Corporation (Ibm) Method and apparatus to detect and block unauthorized mac address by virtual machine aware network switches
CN102801729A (zh) * 2012-08-13 2012-11-28 福建星网锐捷网络有限公司 虚拟机报文转发方法、网络交换设备及通信系统
CN104007997A (zh) * 2013-02-22 2014-08-27 中兴通讯股份有限公司 虚拟机安全组的配置方法及装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111698167A (zh) * 2020-04-01 2020-09-22 新华三大数据技术有限公司 一种报文处理方法及装置

Also Published As

Publication number Publication date
CN107113280A (zh) 2017-08-29

Similar Documents

Publication Publication Date Title
US11057404B2 (en) Method and apparatus for defending against DNS attack, and storage medium
US10250466B2 (en) Application signature generation and distribution
US11916874B2 (en) Systems and methods for routing data using software-defined networks
US10171475B2 (en) Cloud email message scanning with local policy application in a network environment
US11575606B2 (en) Method, apparatus, and system for generating, and processing packets according to, a flow filtering rule
US10171611B2 (en) Herd based scan avoidance system in a network environment
EP3281369B1 (en) Server load balancing
CN108667730B (zh) 基于负载均衡的报文转发方法、装置、存储介质和设备
US10862854B2 (en) Systems and methods for using DNS messages to selectively collect computer forensic data
CN113228583B (zh) 具有受信源的会话成熟度模型
US10516695B1 (en) Distributed denial of service attack mitigation in service provider systems
TW201703485A (zh) 編排實體與虛擬交換器以執行安全邊界之系統及方法
US10530758B2 (en) Methods of collaborative hardware and software DNS acceleration and DDOS protection
US10389611B2 (en) Inserting and removing stateful devices in a network
US20150379302A1 (en) Privacy enhanced email service
US11743236B2 (en) Generating an application-based proxy auto configuration
WO2016106718A1 (zh) 一种网络控制方法与虚拟交换机
JP6758542B2 (ja) 不審メール検知装置、不審メール検知方法および不審メール検知プログラム
US11457095B1 (en) Stateless communication using a stateful protocol
US20230164149A1 (en) Causing or preventing an update to a network address translation table
US11895129B2 (en) Detecting and blocking a malicious file early in transit on a network
WO2022267770A1 (zh) 隐私计算数据资源发布、发现的方法、装置和系统
CN114553452A (zh) 攻击防御方法及防护设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14909525

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14909525

Country of ref document: EP

Kind code of ref document: A1