WO2016155574A1 - 一种网络设备间的通信方法、网络设备及分布式网络 - Google Patents

一种网络设备间的通信方法、网络设备及分布式网络 Download PDF

Info

Publication number
WO2016155574A1
WO2016155574A1 PCT/CN2016/077386 CN2016077386W WO2016155574A1 WO 2016155574 A1 WO2016155574 A1 WO 2016155574A1 CN 2016077386 W CN2016077386 W CN 2016077386W WO 2016155574 A1 WO2016155574 A1 WO 2016155574A1
Authority
WO
WIPO (PCT)
Prior art keywords
data packet
network device
security
data
network
Prior art date
Application number
PCT/CN2016/077386
Other languages
English (en)
French (fr)
Inventor
刘建锋
何伟
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2016155574A1 publication Critical patent/WO2016155574A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications

Definitions

  • the present invention relates to the field of communications technologies, and in particular, to a communication method, a network device, and a distributed network between network devices.
  • a distributed virtual network is a distributed, large Layer 2 network. Virtual machines on the same host can belong to different distributed virtual networks. Virtual machines on different hosts may belong to the same distributed virtual network.
  • a series of functions implemented through a gateway in a physical network need to be distributed to the virtual switch level. Reduce traffic roundabouts and increase network performance. Some simple features such as route lookups can be implemented internally by the network filtering virtual switch. There are also some advanced security features such as attack protection that require third-party capabilities. Third-party advanced security features typically run in a secure virtual machine.
  • the stateful inspection firewall uses the state detection packet filtering technology, which is a function extension on the traditional packet filtering.
  • the stateful inspection firewall has a check engine at the network layer that intercepts the packet and extracts information about the state of the application layer, and based on this, decides whether to accept or reject the connection.
  • This technology provides a highly secure solution with good adaptability and scalability.
  • Stateful inspection firewalls also typically include some agent-level services that provide additional support for specific application data content. Stateful inspection techniques are best suited to provide limited support for the User Datagram Protocol (UDP). It treats all UDP packets passing through the firewall as a virtual connection. When a reverse acknowledgment packet arrives, it considers that a virtual connection has been established.
  • UDP User Datagram Protocol
  • a node that implements the stateful inspection firewall function is set to achieve the purpose of security detection.
  • a virtualized security device on each server that is connected to each virtual machine through a transparent bridge. Packets sent and received by the virtual machine are forwarded by this security device, and network security detection is performed on the security device.
  • the advantage of this approach is that it can detect the security of the inter-virtual machine traffic on the server's internal network, and does not need to go back to the virtualized security device that may be on another server, like the gateway. To save traffic.
  • the embodiments of the present invention provide a communication method, a network device, and a distributed network between network devices, which are used to improve data transmission performance in a network.
  • An embodiment of the present invention provides a communication method between network devices, including:
  • Receiving a detection result of the data packet returned by the security device if the detection result is security, sending the data packet to a destination end of the data packet, and rejecting forwarding if the detection result is dangerous data pack.
  • the method further includes:
  • the data packet After receiving the subsequent data packet of the data stream, the data packet is sent to the destination end of the data packet.
  • the detection result is safe:
  • the data stream is a data stream contained within a white list, or the data stream is marked as a data stream through which the stream passes.
  • the host further includes: a routing module; the first network device and the security device and the routing module establish a connection by using an application program API ;
  • the interrupting the transmission of the data packet includes: interrupting, by the routing module, the transmission of the data packet by using the API.
  • the first network device and the second network device are virtual machines
  • the routing module is a virtual switch
  • the security device is A virtual machine with security detection capabilities.
  • the method also includes:
  • the security policy information is received from the cloud management server. If the security policy information specifies that the first network device needs to be securely protected, the API is used to establish a communication connection between the first network device and the routing module.
  • the data packet is stored in a security device with the host, in combination with the first, the second, or the third possible implementation.
  • the receiving, by the security device, the detection result of the data packet includes: reading the The detection result of the data packet;
  • the method further includes:
  • the data packet is deleted from the single queue.
  • the refusing to forward the data packet further includes:
  • the data packet is deleted.
  • a second embodiment of the present invention provides a network device, where the network device and the first network device are located in a host; the network device includes:
  • An interrupt control unit configured to interrupt transmission of the data packet when there is a data packet transmission between the first network device and the second network device;
  • a data transfer unit configured to store the data packet in a shared memory with a security device in the host
  • a result obtaining unit configured to receive a detection result of the data packet returned by the security device
  • a data processing unit configured to send the data packet to a destination end of the data packet if the detection result is security, and refuse to forward the data packet if the detection result is dangerous.
  • the first network device further includes:
  • a data forwarding unit configured to: if the detection result is safe, and the data packet is a number of data streams According to the packet, after receiving the subsequent data packet of the data stream, the data packet is sent to the destination end of the data packet.
  • the data processing unit is configured to: if the data stream is a data stream included in a whitelist, or the data The stream is marked as a stream of data that flows through, and the packet is sent to the destination of the packet.
  • the host further includes: a routing module; the first network device and the security device and the routing module establish a connection by using an application program API ;
  • the interrupt control unit is specifically configured to interrupt transmission of the data packet by using the API by using the routing module.
  • the first network device and the second network device are virtual machines
  • the routing module is a virtual switch
  • the security device is A virtual machine with security detection capabilities.
  • An information receiving unit configured to receive security policy information from a cloud management server
  • connection establishing unit configured to establish a communication connection between the interrupt control unit and the routing module by using an API if the security policy information specifies that the first network device needs to be securely protected.
  • the data transfer unit is configured to: after obtaining the data packet, store the data packet in a queue of a single queue located in the share, so that the security device sequentially detects the The security of packets within a single queue.
  • the result obtaining unit includes:
  • a result reading unit configured to read the detection result of the data packet from the single queue
  • a deletion control unit configured to delete the data packet from the single queue after the data delivery unit sends the data packet to a destination end of the data packet.
  • the data processing unit is specifically configured to: if the detection result of reading the data packet from the single queue is that the data packet is a dangerous data packet, delete the data packet.
  • a third aspect of the present invention provides a distributed network, including: a first network device, a second network device, and a third network device connected in a communicable connection manner, wherein the third network device is The network device according to any one of the preceding claims, wherein the third network device, the first network device, and the security device are located in the same host.
  • the embodiment of the present invention has the following advantages: the security device is set in the host, and the shared memory is used for security detection of the data packet, and the data packet is not required to be transmitted through the network, thereby saving network bandwidth and improving the network. Data transfer performance.
  • FIG. 2 is a schematic structural view of an apparatus according to an embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of a virtual machine communication network according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a configuration management process according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of a process for setting a security policy for a virtual machine according to an embodiment of the present invention
  • FIG. 7 is a schematic diagram of the structure of the security function in accordance with the present invention.
  • Figure 9 is a schematic diagram of the implementation of a single queue structure according to the present invention.
  • FIG. 10 is a structural view of a network device according to an embodiment of the present invention.
  • FIG. 11 is a structural view of a network device according to an embodiment of the present invention.
  • FIG. 12 is a structural view of a network device according to an embodiment of the present invention.
  • FIG. 13 is a schematic structural diagram of a network device according to the present invention.
  • Figure 14 is a structural view of a network device according to the present invention.
  • the embodiment of the invention provides a communication method between network devices, as shown in FIG. 1 , which includes:
  • Step 101 When there is a data packet transmission between the first network device and the second network device in the host, interrupt the transmission of the data packet, and store the data packet in a shared memory between the security device and the security device in the host;
  • first and second are used only to distinguish two different network devices, and do not represent other technical meanings, and should not be construed as having other limitations.
  • the first network device and the second network device may be located in the same host, or may be located in different hosts, which is not limited by the embodiment of the present invention.
  • the first network device and the second network device may be network devices of the physical entity, or may be virtual machines, and are set according to different application scenarios, which are not limited by the embodiment of the present invention.
  • the transmission process of the interrupted data packet may be interrupted or not. In this embodiment, it is indicated that the detection result of waiting for the forwarding of the data packet needs to be stopped, instead of immediately performing the forwarding process, and the forwarding of the subsequent data packet may be understood as the data packet transmission. Recovery.
  • Step 102 Receive a detection result of the data packet returned by the security device, and send the data packet to a destination end of the data packet if the detection result is security, and refuse to forward the data packet if the detection result is dangerous.
  • the security device is disposed in the host, and uses the shared memory to perform security detection on the data packet, and does not need to transmit the data packet through the network, thereby saving network bandwidth and improving data transmission performance in the network.
  • the manner of refusing to forward the data packet may be the same as the method of the present invention.
  • the foregoing embodiments mainly relate to a packet detection process and a processing procedure.
  • some data packets are associated with a subsequent data packet after the initial detection, so subsequent data packets may not need to be detected again, for example, data.
  • the data packet of the flow based on this, reduces the amount of data processing and improves the system efficiency in order to reduce the unnecessary security detection.
  • the embodiment of the present invention provides the following solution. Solution: If the foregoing detection result is safe, and the data packet is a data packet of the data stream, the method further includes: after receiving the subsequent data packet of the data stream, sending the data packet to the destination end of the data packet.
  • the security detection step is still performed; accordingly, After the security check is performed, there will be a step of recording the whitelist or the tag flow.
  • the flow through is the identification information that is safe to be safely detected.
  • the first network device, the second network device, the security device, and the like may have different distribution structures as needed.
  • This embodiment provides a more common example, as follows:
  • the host further includes: a routing module.
  • the first network device and the foregoing security device are connected to the routing module by using an application program interface (API);
  • API application program interface
  • the interrupting the transmission of the data packet includes: interrupting, by using the API, the transmission of the data packet by using the foregoing routing module.
  • connection manner between the security device and the first network device and the routing module, and the implementation of the interrupt control are also given. It can be used as a more preferred implementation of the embodiment of the present invention.
  • the first network device and the second network device in the embodiment of the present invention may be the physical device, and may also be applied to the virtual communication network. Therefore, the embodiment of the present invention provides the following solutions: the first network device and the second device.
  • the network device is a virtual machine
  • the foregoing routing module is a virtual switch
  • the foregoing security device is a virtual machine with security detection capability.
  • the embodiment also provides a flexible control scheme for whether the function of the security protection needs to be started, as follows:
  • the foregoing method further includes:
  • the API is used to establish a communication connection between the first network device and the routing module.
  • the cloud management server can collect the attributes of the network devices in each host, and use the network device as a virtual machine.
  • the host provides the hardware foundation of the virtual machine; the cloud management server can collect the attribute information of each virtual machine, for example, the user of the virtual machine, such as: ordinary users, important users, etc.; the use of the virtual machine, such as: client, Servers, etc.; depending on the attributes of the virtual machine, different virtual machines have different security performance requirements. Therefore, the virtual machine with high security performance requirements can be determined according to the predefined rules.
  • the collection of the above attribute information may be completed by the cloud management server.
  • the work of determining the virtual machine that needs security protection may be completed by the security management device or by the cloud management server; and the security management device may be integrated into the cloud management server.
  • the embodiment further provides a specific implementation scheme for transmitting a data packet by using the shared memory:
  • the shared memory between the foregoing data packet and the security device in the host includes:
  • the data packet After obtaining the data packet, the data packet is stored in the tail of the single queue located in the share, so that the security device sequentially detects the security of the data packet in the single queue from the head of the team to the end of the queue.
  • the above solution is implemented based on a single circular queue, which can conveniently ensure data consistency and reduce the occupation of memory space during data transmission.
  • the embodiment of the present invention further provides a reading and maintenance solution of the detection result, which is specifically as follows: the foregoing detection result of receiving the data packet returned by the security device includes: reading from the single queue Taking the detection result of the above data packet;
  • the method further includes:
  • the above data packet is deleted from the above single queue.
  • the embodiment of the present invention further provides a maintenance scheme of the data packet, which is specifically as follows: if the foregoing detection result is dangerous, the refusal to forward the data packet further includes:
  • the data packet is deleted.
  • the embodiment of the present invention further provides a distributed network security architecture with a virtual machine as a main application scenario.
  • the cloud platform completes filtering and classifying the data packet.
  • the cloud platform transmits the data packet to be detected and the result of classifying the data packet to a third-party security device, and the third-party security device completes deep security detection of the network data.
  • the processing result is returned to the cloud platform, and the cloud platform performs corresponding actions according to the processing result.
  • the details are as follows: Virtual Swtich
  • CM Cloud Manager
  • the virtual machine is connected to the virtual switch (VSwitch) through a virtual network interface, and the Security Virtual Machine (SVM) passes the Application Program Interface (API) and virtual machine.
  • the switch is connected.
  • the security management device acquires virtual machine list information from the cloud management server.
  • the security management device enables the protection of the virtual machine, and the notification and the virtual machine open the protection on the same host's Security Virtual Machine (SVM).
  • SVM Security Virtual Machine
  • step 403 Establish an API connection between the virtual machine and the secure virtual machine through the API server. This step can be completed before step 401 or step 402.
  • the virtual machine monitor delivers the security policy to the SVM of the same host as the virtual machine through the API server in the host.
  • the VMM can include a virtual switch (VS), and the VS is connected to each virtual machine (VM) and the SVM by using an API interface.
  • VS virtual switch
  • VM virtual machine
  • the SVM on the new host acquires the virtual machine event and obtains the security policy from the security management device.
  • the SVM determines whether to enable protection for the virtual machine according to the security policy of the virtual machine. If necessary, the SVM calls the API interface to enable protection.
  • Network traffic processing as shown in Figure 6, specifically includes:
  • the data stream is then encapsulated and passed to the SVM through the shared memory, waiting for the result to be processed.
  • the SVM performs security detection and returns the detection result.
  • the security API service module discards or continues to forward the data stream according to the result. In the case where the forwarding shown in FIG. 6 is a case where the detection result is secure, the flow of the discarding will not perform the forwarding step shown in FIG. 6.
  • SVM SVM
  • VMM VMM
  • SVM side DPI/IPS
  • Security API SVM
  • VMM side Security Agent and Virtual Switch/Basic Network Security
  • the API interface is used to interface between the VMM and the SVM.
  • the advantage is that after the SVM is processed, the processing result is returned. It occupies less network bandwidth than traditional network forwarding devices forward traffic. In addition, more results can be returned, so that subsequent traffic that does not require deep inspection is no longer passed to the SVM, which reduces the occupation of the network and reduces the processing pressure of the SVM.
  • the result returned by the SVM to the VMM can be:
  • Block Block
  • Blacklist BlackList.
  • the meaning of the flow pass/flow block is that the current access data stream does not need to be checked later, and is directly released.
  • the flow can be marked. For example, when it is confirmed that the access flow is trusted or needs to be rejected, subsequent traffic does not need to be forwarded.
  • the meaning of the whitelist/blacklist is that traffic can be directly blocked or blocked if it is a whitelist or blacklisted traffic.
  • the virtual machine 1 has the traffic destined for the virtual machine 2, and reaches the secure virtual machine via the API server.
  • the secure virtual machine determines that the virtual machine 1 is a virtual machine that needs to be protected, and the traffic has no relevant records, and the data packet of the detected traffic is determined to be safe, and the detection result is sent to the API server;
  • the API server determines, according to the detection result, whether the traffic can be forwarded to the virtual machine 2, if Then forward, otherwise delete the corresponding data packet; here also need to record the corresponding information of the traffic, such as: flow pass / flow block, white list / blacklist;
  • the subsequent data packet of the foregoing traffic arrives at the API server, and the API server first determines the result according to the recorded information, for example, whether it belongs to the recorded flow pass/flow block, whitelist/blacklist; the foregoing traffic can obtain a corresponding result. According to this, it is decided whether it can be forwarded, otherwise the corresponding data packet is deleted.
  • the SVM obtains the traffic to be detected through the API and returns the result through the API.
  • This type of communication is quite different from network forwarding devices.
  • the feature of the solution in this embodiment is that instead of forwarding data packets, the data packets are processed sequentially, and the processing results are sequentially returned. So you can use a single queue for communication.
  • the API server may put the traffic to be detected into the queue from the end of the queue in sequence; the SVM obtains the traffic to be detected from the queue header, performs detection, and sets the detection result in the corresponding position of the queue; API service The end starts processing from the position where the detection result is located, according to the detection result. To perform processing related to this packet.
  • the virtual switch puts the traffic to be detected into the shared memory, and the "tail pointer” rotates counterclockwise. Notify the SVM to process.
  • the SVM processes the content of the "head pointer” and notifies the virtual switch to process the result after processing.
  • the virtual switch reads the content of the "result pointer", and the traffic that passes through continues to be forwarded, and the traffic that cannot pass is discarded.
  • a network forwarding device generally has at least two queues (dual queues): a receiving queue and a sending queue. Compared to dual queues, single queues are easier to handle and more consistent.
  • the virtual switch continuously transmits data packets to the queue while moving the tail pointer backward.
  • the SVM continuously fetches packets from the queue for detection and moves the head pointer.
  • the virtual switch continuously fetches the result from the result pointer in the queue and forwards or discards the cached packet.
  • the distributed network security protection is realized, and the protection position is closer to the protection object, and the granularity is finer.
  • the demarcation of the security domain is no longer bound by the network, which is more convenient.
  • the virtual network basic network filtering function and the advanced network security module can be coordinated, and all traffic is not required to be transmitted to the advanced network security function module.
  • the embodiment of the present invention further provides a network device. As shown in FIG. 10, the network device and the first network device are located in the host.
  • the network device includes:
  • the interrupt control unit 1001 is configured to interrupt the transmission of the data packet when there is a data packet transmission between the first network device and the second network device;
  • a data transfer unit 1002 configured to store the foregoing data packet in a shared memory with a security device in the host;
  • the result obtaining unit 1003 is configured to receive a detection result of the foregoing data packet returned by the security device.
  • the data processing unit 1004 is configured to send the data packet to the destination end of the data packet if the detection result is safe, and refuse to forward the data packet if the detection result is dangerous.
  • the foregoing first network device further includes:
  • the data forwarding unit 1101 is configured to send the data packet to the destination end of the data packet after receiving the subsequent data packet of the data stream if the detection result is secure and the data packet is a data packet.
  • the data processing unit 1004 is configured to send the data packet to the data packet if the data stream is a data stream included in a white list, or the data stream is marked as a data stream that flows through the data stream. The purpose of the end.
  • the foregoing host further includes: a routing module; the foregoing first network device and the foregoing security device establish a connection with the routing module by using an application program interface API;
  • the interrupt control unit 1001 is specifically configured to interrupt the transmission of the data packet by using the foregoing API by using the routing module.
  • the first network device and the second network device are virtual machines
  • the routing module is a virtual switch
  • the security device is a virtual machine with security detection capability.
  • the foregoing first network device further includes:
  • the information receiving unit 1201 is configured to receive security policy information from the cloud management server.
  • the connection establishing unit 1202 is configured to establish a communication connection between the interrupt control unit 1001 and the routing module by using an API if the security policy information specifies that the first network device needs to be securely protected.
  • the data transfer unit 1002 is configured to: after obtaining the data packet, store the data packet in a queue of a single queue located in the share, so that the security device sequentially detects the foregoing from the team head to the team tail. The security of packets within a single queue.
  • the foregoing result obtaining unit 1003 includes:
  • the result reading unit 1301 is specifically configured to read the detection result of the data packet from the single queue.
  • the deletion control unit 1302 is configured to delete the data packet from the single queue after the data transfer unit 1002 sends the data packet to the destination end of the data packet.
  • the data processing unit 1004 is specifically configured to: if the detection result of reading the data packet from the single queue is that the data packet is a dangerous data packet, delete the data packet.
  • the embodiment of the present invention further provides a distributed network, as shown in FIG. 14, including: a first network device 1401, a second network device 1402, and a third network device 1403 connected in a communicable connection manner;
  • the third network device 1403 is a network device according to any one of the embodiments of the present invention.
  • the third network device 1403, the first network device 1401, and the security device are located in the same host.
  • the first network device 1401 has a data packet sent to the second network device 1402.
  • the data packet of the first network device 1401 is first sent to the third network device 1402, and the third network device 1402 determines whether to store the received data packet.
  • the security device then performs security detection on the data packet, and finally the third network device 1403 determines whether to forward the data packet to the second network device according to the security detection result, and the specific implementation process may refer to
  • the structure of the third network device 1402 may refer to the structure of the network device provided in the foregoing embodiment, and details are not described herein again.
  • the security device is disposed in the host, and uses the shared memory to perform security detection on the data packet, and does not need to transmit the data packet through the network, thereby saving network bandwidth and improving data transmission performance in the network.
  • An embodiment of the present invention further provides another network device.
  • the network device and the first network device are located in a host.
  • the network device includes: a receiver 1501, a transmitter 1502, a processor 1503, and a memory 1504.
  • the memory 1504 can provide a buffer required by the processor 1503 for data processing, and can also provide a shared memory space.
  • the processor 1503 is configured to interrupt the transmission of the data packet when the data packet is transmitted between the first network device and the second network device in the host, and transmit the data packet to the host through the shared memory.
  • the security device receives the detection result of the data packet returned by the security device, and if the detection result is safe, sends the data packet to the destination end of the data packet, and refuses to forward the data packet if the detection result is dangerous.
  • first and second are only used to distinguish between two different network devices. It does not represent other technical meanings and should not be construed as having other limitations.
  • the first network device and the second network device may be located in the same host, or may be located in different hosts, which is not limited by the embodiment of the present invention.
  • the security device is disposed in the host, and uses the shared memory to perform security detection on the data packet, and does not need to transmit the data packet through the network, thereby saving network bandwidth and improving data transmission performance in the network.
  • the foregoing embodiments mainly relate to a packet detection process and a processing procedure.
  • some data packets are associated with a subsequent data packet after the initial detection, so subsequent data packets may not need to be detected again, for example, data.
  • the data packet of the stream is based on the following, in order to reduce the amount of data processing and improve the system efficiency, the embodiment of the present invention provides the following solution: the processor 1503 is further configured to: if the foregoing detection result is safe And the data packet is a data packet of the data stream, and after receiving the subsequent data packet of the data stream, sending the data packet to the destination end of the data packet.
  • the processor 1503 is configured to determine that the detection result is safe.
  • the method includes: the data stream is a data stream included in the white list, or the data stream is marked as a data stream through which the stream passes.
  • the first network device, the second network device, the security device, and the like may have different distribution structures as needed.
  • This embodiment provides a more common example, as follows:
  • the host further includes: a routing module.
  • the first network device and the foregoing security device are connected to the routing module by using an application program interface (API);
  • API application program interface
  • the processor 1503, configured to interrupt the transmission of the data packet includes: interrupting, by using the API, the transmission of the data packet by using the foregoing routing module.
  • connection manner between the security device and the first network device and the routing module, and the implementation of the interrupt control are also given. It can be used as a more preferred implementation of the embodiment of the present invention.
  • the first network device and the second network device in the embodiment of the present invention may be physical devices. It can also be applied to a virtual communication network. Therefore, the embodiment of the present invention provides the following solutions: the first network device and the second network device are virtual machines, and the routing module is a virtual switch, and the security device has security detection capability. virtual machine.
  • the embodiment also provides a flexible control scheme for whether the security protection function needs to be activated.
  • the specific processor is as follows: the processor 1503 is further configured to receive security policy information from the cloud management server, if the foregoing security policy information specifies that the first The network device performs security protection, and the API is used to establish a communication connection between the first network device and the routing module.
  • the embodiment further provides a specific implementation scheme of using the shared memory to transfer the data packet: the processor 1503, configured to store the data packet in the shared memory with the security device in the host, including: after obtaining the data packet The data packet is stored in the tail of the single queue located in the share, so that the security device detects the security of the data packet in the single queue from the head of the team to the end of the queue.
  • the above solution is implemented based on a single circular queue, which can conveniently ensure data consistency and reduce the occupation of memory space during data transmission.
  • the embodiment of the present invention further provides a reading and maintenance solution of the detection result, which is specifically as follows: the processor 1503, configured to receive the detection result of the data packet returned by the security device, includes: Reading the detection result of the above data packet from the above single queue;
  • the processor 1503 is further configured to delete the data packet from the single queue after sending the data packet to the destination end of the data packet.
  • the embodiment of the present invention further provides a maintenance scheme of the data packet, which is specifically as follows: the processor 1503 is further configured to: if the data is read from the single queue If the packet detection result is that the above data packet is a dangerous data packet, the above data packet is deleted.
  • the disclosed system, apparatus, and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the above units is only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined or may be Integrate into another system, or some features can be ignored or not executed.
  • the coupling or communication connection may be an indirect coupling or communication connection through some interface, device or unit, and may be in electrical, mechanical or other form.
  • the units described above as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.
  • the above-described integrated unit if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium.
  • the technical solution of the present invention which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium.
  • a number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the above-described methods of various embodiments of the present invention.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例公开了一种网络设备间的通信方法、网络设备及分布式网络，其中方法的实现包括：在主机内的第一网络设备与第二网络设备之间有数据包传输时，中断所述数据包的传输，将所述数据包存入与所述主机内的安全设备之间的共享内存；接收所述安全设备返回的所述数据包的检测结果，若所述检测结果为安全则将所述数据包发往所述数据包的目的端，若所述检测结果为危险则拒绝转发所述数据包。安全设备设置于主机内，采用共享内存对数据包进行安全检测，并不需要通过网络传递数据包，因此可以节省网络带宽，提升网络中的数据传输性能。

Description

一种网络设备间的通信方法、网络设备及分布式网络 技术领域
本发明涉及通信技术领域，特别涉及一种网络设备间的通信方法、网络设备及分布式网络。
背景技术
在云计算环境中，分布式虚拟网络是分布式的大二层网络。同一台主机上的虚拟机可以属于不同的分布式虚拟网络，不同主机上的虚拟机可能又属于同一个分布式虚拟网络。
基于上述分布式特点，一系列在物理网络中通过网关实现的功能都需要分布式到虚拟交换机层面来做。减少流量的迂回、增加网络的性能。有些简单的功能如路由查找、可以由网络过滤虚拟交换内部实现。另外还有一些高级安全如攻击防护，需要借助第三方能力来实现。第三方的高级安全功能一般在安全虚拟机中运行。
为了实现虚拟机之间的安全通信，提出了状态检测防火墙。状态检测防火墙采用了状态检测包过滤的技术，是传统包过滤上的功能扩展。状态检测防火墙在网络层有一个检查引擎截获数据包并抽取出与应用层状态有关的信息，并以此为依据决定对该连接是接受还是拒绝。这种技术提供了高度安全的解决方案，同时具有较好的适应性和扩展性。状态检测防火墙一般也包括一些代理级的服务，它们提供附加的对特定应用程序数据内容的支持。状态检测技术最适合提供对用户数据报文协议(User Datagram Protocol，UDP)的有限支持。它将所有通过防火墙的UDP分组均视为一个虚连接，当反向应答分组送达时，就认为一个虚拟连接已经建立。
在分布式虚拟网络中，会设置实现状态检测防火墙功能的节点来达到安全检测的目的。目前，有一种处理方式是，透明地在每个服务器上部署一个虚拟化的安全设备，此安全设备通过透明桥接和每个虚拟机连接。虚拟机发出和接收的数据包都会经过此安全设备转发，在此安全设备上进行网络安全检测。此种做法的优点是，可以检测服务器内部网络的虚拟机间流量的安全性，另外不需要像网关那样，迂回到可能在另一台服务器上的虚拟化的安全设备，因此可 以节省流量。
但是，采用以上方案，所有流量均会经过安全设备，虚拟机的数据吞吐量会受到安全设备接口通信能力的限制，导致网络数据传输性能较低。
发明内容
本发明实施例提供了一种网络设备间的通信方法、网络设备及分布式网络，用于提升网络中的数据传输性能。
本发明实施例一方面提供了一种网络设备间的通信方法，包括：
在主机内的第一网络设备与第二网络设备之间有数据包传输时，中断所述数据包的传输，将所述数据包存入与所述主机内的安全设备之间的共享内存；
接收所述安全设备返回的所述数据包的检测结果，若所述检测结果为安全则将所述数据包发往所述数据包的目的端，若所述检测结果为危险则拒绝转发所述数据包。
结合一方面的实现方式，在第一种可能的实现方式中，若所述检测结果为安全，且所述数据包为数据流的数据包，所述方法还包括：
在接收到所述数据流的后续数据包后，将所述数据包发往所述数据包的目的端。
结合一方面的第一种可能的实现方式，在第二种可能的实现方式中，所述检测结果为安全包括：
所述数据流为在白名单内包含的数据流，或者，所述数据流被标记为流通过的数据流。
结合一方面的实现方式，在第三种可能的实现方式中，所述主机内还包括：路由模块；所述第一网络设备以及所述安全设备与所述路由模块采用应用程序接口API建立连接；
所述中断所述数据包的传输包括：通过所述路由模块采用所述API中断所述数据包的传输。
结合一方面的第三种可能的实现方式，在第四种可能的实现方式中，所述第一网络设备和第二网络设备均为虚拟机，所述路由模块为虚拟交换机，所述安全设备为具有安全检测能力的虚拟机。
结合一方面的第三种可能的实现方式，在第五种可能的实现方式中，所述 方法还包括：
接收来自云管理服务器的安全策略信息，若所述安全策略信息指定需要对所述第一网络设备进行安全防护，则采用API建立所述第一网络设备与所述路由模块之间的通信连接。
结合一方面、一方面的第一种、第二种或者第三种可能的实现方式，在第六种可能的实现方式中，所述将所述数据包存入与所述主机内的安全设备之间的共享内存包括：
在获得所述数据包后，将所述数据包存入位于共享内中的单队列的队尾，使所述安全设备从队头往队尾依次检测所述单队列内的数据包的安全性。
结合一方面的第六种可能的实现方式，在第七种可能的实现方式中，所述接收所述安全设备返回的所述数据包的检测结果包括：从所述单队列中读取所述数据包的检测结果；
在将所述数据包发往所述数据包的目的端之后还包括：
将所述数据包从所述单队列中删除。
结合一方面的第七种可能的实现方式，在第八种可能的实现方式中，所述若所述检测结果为危险则拒绝转发所述数据包还包括：
若从所述单队列中读取所述数据包的检测结果为所述数据包为危险数据包，则删除所述数据包。
本发明实施例二方面提供了一种网络设备，所述网络设备和第一网络设备位于主机内；所述网络设备包括：
中断控制单元，用于在所述第一网络设备与第二网络设备之间有数据包传输时，中断所述数据包的传输；
数据传递单元，用于将所述数据包存入与所述主机内的安全设备之间的共享内存；
结果获取单元，用于接收所述安全设备返回的所述数据包的检测结果；
数据处理单元，用于若所述检测结果为安全则将所述数据包发往所述数据包的目的端，若所述检测结果为危险则拒绝转发所述数据包。
结合二方面的实现方式，在第一种可能的实现方式中，所述第一网络设备还包括：
数据转发单元，用于若所述检测结果为安全，且所述数据包为数据流的数 据包，在接收到所述数据流的后续数据包后，将所述数据包发往所述数据包的目的端。
结合二方面的第一种可能的实现方式，在第二种可能的实现方式中，所述数据处理单元，用于若所述数据流为在白名单内包含的数据流，或者，所述数据流被标记为流通过的数据流，则将所述数据包发往所述数据包的目的端。
结合二方面的实现方式，在第三种可能的实现方式中，所述主机内还包括：路由模块；所述第一网络设备以及所述安全设备与所述路由模块采用应用程序接口API建立连接；
所述中断控制单元，具体用于通过所述路由模块采用所述API中断所述数据包的传输。
结合二方面的第三种可能的实现方式，在第四种可能的实现方式中，所述第一网络设备和第二网络设备均为虚拟机，所述路由模块为虚拟交换机，所述安全设备为具有安全检测能力的虚拟机。
结合二方面的第三种可能的实现方式，在第五种可能的实现方式中，所述第一网络设备还包括：
信息接收单元，用于接收来自云管理服务器的安全策略信息；
连接建立单元，用于若所述安全策略信息指定需要对所述第一网络设备进行安全防护，则采用API建立所述中断控制单元与所述路由模块之间的通信连接。
结合二方面、二方面的第一种、第二种或者第三种可能的实现方式，在第六种可能的实现方式中，
所述数据传递单元，具体用于在获得所述数据包后，将所述数据包存入位于共享内中的单队列的队尾，使所述安全设备从队头往队尾依次检测所述单队列内的数据包的安全性。
结合二方面的第六种可能的实现方式，在第七种可能的实现方式中，所述结果获取单元包括：
结果读取单元，具体用于从所述单队列中读取所述数据包的检测结果；
删除控制单元，用于在所述数据传递单元将所述数据包发往所述数据包的目的端之后，将所述数据包从所述单队列中删除。
结合二方面的第七种可能的实现方式，在第八种可能的实现方式中，
所述数据处理单元，具体用于若从所述单队列中读取所述数据包的检测结果为所述数据包为危险数据包，则删除所述数据包。
本发明实施例三方面提供了一种分布式网络，包括：以可通信连接方式连接的第一网络设备、第二网络设备以及第三网络设备，其特征在于，所述第三网络设备为本发明实施例提供的任意一项所述的网络设备，所述第三网络设备、所述第一网络设备以及安全设备位于同一主机内。
从以上技术方案可以看出，本发明实施例具有以下优点：安全设备设置于主机内，采用共享内存对数据包进行安全检测，并不需要通过网络传递数据包，因此可以节省网络带宽，提升网络中的数据传输性能。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明实施例方法流程示意图；
图2为本发明实施例装置结构示意图；
图3为本发明实施例虚拟机通信网络结构示意图；
图4为本发明实施例配置管理流程意图；
图5为本发明实施例虚拟机设置安全策略流程意图；
图6为本发明实施例网络流量处理流程意图；
图7为本发明实施安全功能配合结构意图；
图8为本发明实施例数据流传递流程意图；
图9为本发明实施单队列结构意图；
图10为本发明实施网络设备结构意图；
图11为本发明实施网络设备结构意图；
图12为本发明实施网络设备结构意图；
图13为本发明实施网络设备结构意图；
图14为本发明实施网络设备结构意图；
图15为本发明实施网络设备结构意图。
具体实施方式
为了使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明作进一步地详细描述，显然，所描述的实施例仅仅是本发明一部份实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其它实施例，都属于本发明保护的范围。
本发明实施例提供了一种网络设备间的通信方法，如图1所示，包括：
101：在主机内的第一网络设备与第二网络设备之间有数据包传输时，中断上述数据包的传输，将上述数据包存入与上述主机内的安全设备之间的共享内存；
在本实施例中“第一”和“第二”仅是为了区分两个不同的网络设备使用，并不代表其他的技术含义，不应理解为具有其他的限定。第一网络设备和第二网络设备可以位于同一主机内，也可以位于不同主机内，本发明实施例对此不作唯一性限定。第一网络设备和第二网络设备可以是物理实体的网络设备，也可以是虚拟机，依据不同的应用场景进行设定，本发明实施例不对此进行唯一性限定。中断数据包的传输过程，可以有中断指令也可以没有，在本实施例中，表示需要停止转发等待数据包的检测结果，而不是立即执行转发流程，后续数据包的转发可以理解为数据包传输的恢复。
102：接收上述安全设备返回的上述数据包的检测结果，若上述检测结果为安全则将上述数据包发往上述数据包的目的端，若上述检测结果为危险则拒绝转发上述数据包。
本发明实施例中，安全设备设置于主机内，采用共享内存对数据包进行安全检测，并不需要通过网络传递数据包，因此可以节省网络带宽，提升网络中的数据传输性能。
在本实施例中，拒绝转发数据包的方式可以是不转发，也可以直接删除，具体实现方式本发明实施例不作限制。
前述实施例主要涉及的是数据包检测过程以及处理过程，对于数据包而言，有些数据包在初次检测以后的后续数据包由于与之具有关联性，因此后续数据包可以不必再次检测，例如数据流的数据包，基于此为了减少不必要的安全检测降低数据处理量并提升系统效率，进一步地，本发明实施例提供了如下解决 方案：若上述检测结果为安全，且上述数据包为数据流的数据包，上述方法还包括：在接收到上述数据流的后续数据包后，将上述数据包发往上述数据包的目的端。
安全检测的方式有很多，可以遵照不同的安全检测算法，基于前一实施例中数据流的实现方案，检测结果为安全的情况则可以是：上述检测结果为安全包括：上述数据流为在白名单内包含的数据流，或者，上述数据流被标记为流通过的数据流。
对应于白名单内包含的数据流以及被标记为流通过的数据流，在数据流的最初的数据包被送达时，是没有记录的，因此仍然会执行安全检测的步骤；相应地，在执行完安全检测以后，会有记录白名单或者标记流通过的步骤。流通过是安全检测结果为安全的标识信息。
在本实施例中，第一网络设备第二网络设备安全设备等可能按照需要具有不同的分布结构，本实施例给出了其中较为常用的举例说明，具体如下：上述主机内还包括：路由模块；上述第一网络设备以及上述安全设备与上述路由模块采用应用程序接口(Application Program Interface，API)建立连接；
上述中断上述数据包的传输包括：通过上述路由模块采用上述API中断上述数据包的传输。
在以上实施例中，还给出了安全设备和第一网络设备之间与路由模块之间的连接方式，以及中断控制的实现方式。可以作为本发明实施例一个较为优选的实现方式使用。
本发明实施例中的第一网络设备和第二网络设备等设备均可以是实体设备，也可以应用于虚拟通信网络中，因此本发明实施例提供了如下方案：上述第一网络设备和第二网络设备均为虚拟机，上述路由模块为虚拟交换机，上述安全设备为具有安全检测能力的虚拟机。
本实施例还提供了安全防护的功能是否需要启动的灵活控制方案，具体如下：上述方法还包括：
接收来自云管理服务器的安全策略信息，若上述安全策略信息指定需要对上述第一网络设备进行安全防护，则采用API建立上述第一网络设备与上述路由模块之间的通信连接。
云管理服务器可以搜集各主机内的网络设备的属性，以网络设备为虚拟机 为例，主机提供虚拟机的硬件基础；云管理服务器可以搜集各虚拟机的属性信息，例如：虚拟机的使用者，如：普通用户，重要用户等；虚拟机的用途，如：客户机、服务器等；依据虚拟机的属性不同，不同的虚拟机会对应有不同的安全性能需求，因此可以按照预定义的规则确定安全性能要求较高的虚拟机属于需要进行安全防护的虚拟机。以上属性信息的搜集工作可以由云管理服务器完成，确定需要安全防护的虚拟机的工作可以由安全管理设备完成，也可以由云管理服务器完成；另外安全管理设备可以集成在云管理服务器内。
本实施例还提供了采用共享内存传递数据包的具体实现方案：上述将上述数据包存入与上述主机内的安全设备之间的共享内存包括：
在获得上述数据包后，将上述数据包存入位于共享内中的单队列的队尾，使上述安全设备从队头往队尾依次检测上述单队列内的数据包的安全性。
以上方案基于单环形队列实现，可以方便地保证数据一致性，并且减少数据包在传递过程中对内存空间的占用。
基于以上采用单环形队列的实现方案，本发明实施例还提供了检测结果的读取以及维护方案，具体如下：上述接收上述安全设备返回的上述数据包的检测结果包括：从上述单队列中读取上述数据包的检测结果；
在将上述数据包发往上述数据包的目的端之后还包括：
将上述数据包从上述单队列中删除。
进一步地，基于以上实施例中检测结果的读取实现方案，本发明实施例还提供了数据包的维护方案，具体如下：上述若上述检测结果为危险则拒绝转发上述数据包还包括：
若从上述单队列中读取上述数据包的检测结果为上述数据包为危险数据包，则删除上述数据包。
基于以上实施例，本发明实施例还提供了以虚拟机为主要应用场景的分布式的网络安全架构，在本发明实施例提供的网络安全架构中，由云平台完成对数据包的过滤、分类，云平台将需要检测的数据包以及对此数据包分类的结果传递给第三方安全设备，第三方安全设备来完成对网络数据的深度安全检测。然后返回处理结果给云平台，云平台根据处理结果进行相应的动作。在以下实施例中，分布就以下五个方面进行详细说明：一、部件结构；二、虚拟机通信网络结构；三、工作流程；四、高级安全功能和基础网络安全功能之间的配合； 五、数据流传递。具体如下：Virtual Swtich
一、部件结构：
如图2所示，在每个虚拟化的服务器上部署一个深度安全检测的虚拟机，在图2中为加粗线条所示的安全虚拟机(Security Virtual Machine，SVM)。云管理(Cloud Manager，CM)服务器可以维护需要防护的虚拟机配置策略，并通过安全管理(Security Manager，SM)设备将策略下发到此虚拟机所在服务器上的SVM中。
二、虚拟机通信网络结构：
如图3所示，可以一并参阅图2；虚拟机通过虚拟网络接口和虚拟交换机(VSwitch)连接，安全虚拟机(Security Virtual Machine，SVM)通过应用程序接口(Application Program Interface，API)和虚拟交换机连接。
三、工作流程：
1、配置管理流程，如图4所示，具体如下：
401：安全管理设备从云管理服务器获取虚拟机列表信息；
402：安全管理设备开启对虚拟机启用防护，同时通知和虚拟机在同一主机的安全虚拟机(Security Virtual Machine，SVM)开启防护。
403：通过API服务端建立虚拟机和安全虚拟机之间的API连接。本步骤可以在步骤401或者步骤402之前完成。
2、对虚拟机设置安全策略，如图5所示，具体如下：
501：虚拟机监视器(Virtual Machine Monitor，VMM)将安全策略通过主机内的API服务端下发到和虚拟机在同一主机的SVM上。
上述VMM可以包含一个虚拟交换机(Virtual Switch，VS)，VS与各虚拟机(Virtual Machine，VM)以及SVM采用API接口连接。
502：虚拟机迁移时，新主机上的SVM获取虚拟机事件，从安全管理设备获取安全策略。
503：SVM根据虚拟机的安全策略，决定是否对虚拟机开启防护。如果需要，SVM调用API接口，开启防护。
3、网络流量处理，如图6所示，具体包括：
601：当开启了防护的虚拟机1向虚拟机2外发出流量或接收流量时，安全API服务端中断数据流处理；
602：然后把数据流封装通过共享内存传递给SVM，等待处理结果。
603：SVM进行安全检测，返回检测结果。
604：安全API服务模块根据结果丢弃或继续转发数据流。在图6所示的转发为检测结果为安全的情况下的流程，丢弃的流程将不会执行图6所示转发步骤。
4、高级安全功能和基础网络安全功能之间的配合，如图7所示：
主要包含两个部分，SVM和VMM；其中，在SVM一侧包含：DPI/IPS，安全(Security)API；在VMM一侧包含：安全代理(Security Agent)以及虚拟交换机/基础网络安全；
使用API接口在VMM和SVM之间对接，优势是SVM处理后，返回的是处理结果。相对于传统网络转发设备转发流量来说，占用更少的网络带宽。另外可以返回更多的结果，让后续不需要深度检查的流量不再传递给SVM，这样既减少了对网络的占用，也减轻了SVM的处理压力。
SVM返回给VMM的结果可以是：
通过：Pass；
阻止：Block；
流通过：PassContinious；
流阻止：BlockContinious；
白名单：WhiteList；
黑名单：BlackList。
其中，流通过/流阻止的含义是，当前访问数据流后续不需要再进行检查，直接放过，在数据流经安全检测并获得结果为安全时可以标记流通过。例如：当确认访问流是可信或需要拒绝的流量，后续流量就不需要转发过来。
白名单/黑名单的含义是如果流量是某个白名单、黑名单的流量，可以直接放过或阻止。
5、数据流传递，如图8所示，包括：
801：虚拟机1有发往虚拟机2的流量，经API服务端到达安全虚拟机；
802：安全虚拟机确定虚拟机1是需要防护的虚拟机，并且该流量没有相关记录，则检测流量的数据包确定是否安全，并将检测结果发往API服务端；
803：API服务端根据检测结果确定流量是否可以转发给虚拟机2，如果可 以则转发，否则删掉相应数据包；这里还需要记录该流量的相应信息，例如：流通过/流阻止、白名单/黑名单；
804：上述流量的后续数据包到达API服务端，API服务端首先根据记录的信息确定结果，例如：是否属于记录的流通过/流阻止、白名单/黑名单；上述流量可以获得相应的结果，并据此决定是否可以则转发，否则删掉相应数据包。
在以上实施例中，SVM通过API获取要检测的流量，并通过API返回结果。这种通信方式与网络转发设备相比有很大的不同。采用本实施例方案特点是，不用转发数据包，而是顺序处理数据包，并顺序返回处理结果。所以可以采用单队列来进行通信。
在以上实施例中，API服务端可以把要检测的流量按照先后顺序从队列末尾放入队列；SVM从队列头部获取要检测的流量，进行检测，并在队列相应位置设置检测结果；API服务端从有检测结果所在的位置开始处理，根据检测结果。来进行与此数据包相关的处理。
如图9所示，可以有三个指针在队列上移动来处理队列上的数据包。虚拟交换机将要检测的流量放入共享内存，“尾指针”逆时针转动。通知SVM处理。SVM处理“头指针”的内容，处理后通知虚拟交换机处理结果。虚拟交换机读取“结果指针”的内容，通过的流量继续转发，不能通过的流量丢弃。
网络转发设备一般至少有两个队列(双队列)：接收队列、发送队列。相对于双队列，单队列处理起来更简单，一致性也更好保障。在本实施例中，虚拟交换机不断向队列中传送数据包，同时向后移动尾指针。SVM不断从队列中获取数据包进行检测，移动头指针。虚拟交换机不断从队列中的结果指针获取结果，对缓存的数据包转发或丢弃。
采用本发明实施例的方案，至少具有如下几个有益效果：
一、实现了分布式的网络安全防护，防护位置更贴近保护对象，粒度更细。安全域的划定不再受网络的绑定，更加方便。
二、通过虚拟交换机和高级网络安全功能模块之间，扩展定义检测结果，可以在虚拟交换机基本网络过滤功能和高级网络安全模块之间进行配合，不需要将所有流量传送给高级网络安全功能模块。
三、在虚拟交换机和基于共享内存的单环形队列相对于双环形队列更容易保证一致性，并且占用更少内存。
本发明实施例还提供了一种网络设备，如图10所示，上述网络设备和第一网络设备位于主机内；上述网络设备包括：
中断控制单元1001，用于在上述第一网络设备与第二网络设备之间有数据包传输时，中断上述数据包的传输；
数据传递单元1002，用于将上述数据包存入与上述主机内的安全设备之间的共享内存；
结果获取单元1003，用于接收上述安全设备返回的上述数据包的检测结果；
数据处理单元1004，用于若上述检测结果为安全则将上述数据包发往上述数据包的目的端，若上述检测结果为危险则拒绝转发上述数据包。
进一步地，如图11所示，上述第一网络设备还包括：
数据转发单元1101，用于若上述检测结果为安全，且上述数据包为数据流的数据包，在接收到上述数据流的后续数据包后，将上述数据包发往上述数据包的目的端。
可选地，上述数据处理单元1004，用于若上述数据流为在白名单内包含的数据流，或者，上述数据流被标记为流通过的数据流，则将上述数据包发往上述数据包的目的端。
可选地，上述主机内还包括：路由模块；上述第一网络设备以及上述安全设备与上述路由模块采用应用程序接口API建立连接；
上述中断控制单元1001，具体用于通过上述路由模块采用上述API中断上述数据包的传输。
可选地，上述第一网络设备和第二网络设备均为虚拟机，上述路由模块为虚拟交换机，上述安全设备为具有安全检测能力的虚拟机。
进一步地，如图12所示，上述第一网络设备还包括：
信息接收单元1201，用于接收来自云管理服务器的安全策略信息；
连接建立单元1202，用于若上述安全策略信息指定需要对上述第一网络设备进行安全防护，则采用API建立上述中断控制单元1001与上述路由模块之间的通信连接。
可选地，上述数据传递单元1002，具体用于在获得上述数据包后，将上述数据包存入位于共享内中的单队列的队尾，使上述安全设备从队头往队尾依次检测上述单队列内的数据包的安全性。
可选地，如图13所示，上述结果获取单元1003包括：
结果读取单元1301，具体用于从上述单队列中读取上述数据包的检测结果；
删除控制单元1302，用于在上述数据传递单元1002将上述数据包发往上述数据包的目的端之后，将上述数据包从上述单队列中删除。
可选地，上述数据处理单元1004，具体用于若从上述单队列中读取上述数据包的检测结果为上述数据包为危险数据包，则删除上述数据包。
本发明实施例还提供了一种分布式网络，如图14所示，包括：以可通信连接方式连接的第一网络设备1401、第二网络设备1402和第三网络设备1403；其中，上述第三网络设备1403为本发明实施例提供的任意一项的网络设备，上述第三网络设备1403、上述第一网络设备1401以及安全设备位于同一主机内。
其中，第一网络设备1401有数据包发往第二网络设备1402；第一网络设备1401的数据包首先发送给第三网络设备1402，由第三网络设备1402决定是否将接收到的数据包存储到与安全设备之间的共享内存，然后由安全设备对数据包进行安全检测，最后由第三网络设备1403依据安全检测结果决定是否将数据包转发给上述第二网络设备，具体实现过程可以参考前述实施例方法流程；第三网络设备1402的结构可以参考前述实施例中提供的网络设备的结构，在此不再一一赘述。
本发明实施例中，安全设备设置于主机内，采用共享内存对数据包进行安全检测，并不需要通过网络传递数据包，因此可以节省网络带宽，提升网络中的数据传输性能。
本发明实施例还提供了另外一种网络设备，如图15所示，上述网络设备和第一网络设备位于主机内；上述网络设备包括：接收器1501、发射器1502、处理器1503以及存储器1504，其中存储器1504可以提供处理器1503进行数据处理过程中所需要的缓存，也可以提供共享内存空间。
其中，上述处理器1503，用于在主机内的第一网络设备与第二网络设备之间有数据包传输时，中断上述数据包的传输，并通过共享内存将上述数据包传递给上述主机内的安全设备；接收上述安全设备返回的上述数据包的检测结果，若上述检测结果为安全则将上述数据包发往上述数据包的目的端，若上述检测结果为危险则拒绝转发上述数据包。
在本实施例中“第一”和“第二”仅是为了区分两个不同的网络设备使用， 并不代表其他的技术含义，不应理解为具有其他的限定。第一网络设备和第二网络设备可以位于同一主机内，也可以位于不同主机内，本发明实施例对此不作唯一性限定。
本发明实施例中，安全设备设置于主机内，采用共享内存对数据包进行安全检测，并不需要通过网络传递数据包，因此可以节省网络带宽，提升网络中的数据传输性能。
前述实施例主要涉及的是数据包检测过程以及处理过程，对于数据包而言，有些数据包在初次检测以后的后续数据包由于与之具有关联性，因此后续数据包可以不必再次检测，例如数据流的数据包，基于此为了减少不必要的安全检测降低数据处理量并提升系统效率，进一步地，本发明实施例提供了如下解决方案：上述处理器1503，还用于若上述检测结果为安全，且上述数据包为数据流的数据包，在接收到上述数据流的后续数据包后，将上述数据包发往上述数据包的目的端。
安全检测的方式有很多，可以遵照不同的安全检测算法，基于前一实施例中数据流的实现方案，检测结果为安全的情况则可以是：上述处理器1503，用于确定上述检测结果为安全的方式包括：上述数据流为在白名单内包含的数据流，或者，上述数据流被标记为流通过的数据流。
对应于白名单内包含的数据流以及被标记为流通过的数据流，在数据流的最初的数据包被送达时，是没有记录的，因此仍然会执行安全检测的步骤；相应地，在执行完安全检测以后，会有记录白名单或者标记流通过的步骤。
在本实施例中，第一网络设备第二网络设备安全设备等可能按照需要具有不同的分布结构，本实施例给出了其中较为常用的举例说明，具体如下：上述主机内还包括：路由模块；上述第一网络设备以及上述安全设备与上述路由模块采用应用程序接口(Application Program Interface，API)建立连接；
上述处理器1503，用于上述中断上述数据包的传输包括：通过上述路由模块采用上述API中断上述数据包的传输。
在以上实施例中，还给出了安全设备和第一网络设备之间与路由模块之间的连接方式，以及中断控制的实现方式。可以作为本发明实施例一个较为优选的实现方式使用。
本发明实施例中的第一网络设备和第二网络设备等设备均可以是实体设备， 也可以应用于虚拟通信网络中，因此本发明实施例提供了如下方案：上述第一网络设备和第二网络设备均为虚拟机，上述路由模块为虚拟交换机，上述安全设备为具有安全检测能力的虚拟机。
本实施例还提供了安全防护的功能是否需要启动的灵活控制方案，具体如下：上述处理器1503，还用于接收来自云管理服务器的安全策略信息，若上述安全策略信息指定需要对上述第一网络设备进行安全防护，则采用API建立上述第一网络设备与上述路由模块之间的通信连接。
本实施例还提供了采用共享内存传递数据包的具体实现方案：上述处理器1503，用于将上述数据包存入与上述主机内的安全设备之间的共享内存包括：在获得上述数据包后，将上述数据包存入位于共享内中的单队列的队尾，使上述安全设备从队头往队尾依次检测上述单队列内的数据包的安全性。
以上方案基于单环形队列实现，可以方便地保证数据一致性，并且减少数据包在传递过程中对内存空间的占用。
基于以上采用单环形队列的实现方案，本发明实施例还提供了检测结果的读取以及维护方案，具体如下：上述处理器1503，用于接收上述安全设备返回的上述数据包的检测结果包括：从上述单队列中读取上述数据包的检测结果；
上述处理器1503，还用于在将上述数据包发往上述数据包的目的端之后，将上述数据包从上述单队列中删除。
进一步地，基于以上实施例中检测结果的读取实现方案，本发明实施例还提供了数据包的维护方案，具体如下：上述处理器1503，还用于若从上述单队列中读取上述数据包的检测结果为上述数据包为危险数据包，则删除上述数据包。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，上述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直 接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
上述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
上述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例上述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上上述，以上实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的精神和范围。

Claims (19)

  1. 一种网络设备间的通信方法，其特征在于，包括：
    在主机内的第一网络设备与第二网络设备之间有数据包传输时，中断所述数据包的传输，将所述数据包存入与所述主机内的安全设备之间的共享内存；
    接收所述安全设备返回的所述数据包的检测结果，若所述检测结果为安全则将所述数据包发往所述数据包的目的端，若所述检测结果为危险则拒绝转发所述数据包。
  2. 根据权利要求1所述方法，其特征在于，若所述检测结果为安全，且所述数据包为数据流的数据包，所述方法还包括：
    在接收到所述数据流的后续数据包后，将所述数据包发往所述数据包的目的端。
  3. 根据权利要求2所述方法，其特征在于，所述检测结果为安全包括：
    所述数据流为在白名单内包含的数据流，或者，所述数据流被标记为流通过的数据流。
  4. 根据权利要求1所述方法，其特征在于，所述主机内还包括：路由模块；所述第一网络设备以及所述安全设备与所述路由模块采用应用程序接口API建立连接；
    所述中断所述数据包的传输包括：通过所述路由模块采用所述API中断所述数据包的传输。
  5. 根据权利要求4所述方法，其特征在于，所述第一网络设备和第二网络设备均为虚拟机，所述路由模块为虚拟交换机，所述安全设备为具有安全检测能力的虚拟机。
  6. 根据权利要求4所述方法，其特征在于，所述方法还包括：
    接收来自云管理服务器的安全策略信息，若所述安全策略信息指定需要对所述第一网络设备进行安全防护，则采用API建立所述第一网络设备与所述路由模块之间的通信连接。
  7. 根据权利要求1至4任意一项所述方法，其特征在于，所述将所述数据包存入与所述主机内的安全设备之间的共享内存包括：
    在获得所述数据包后，将所述数据包存入位于共享内中的单队列的队尾，使所述安全设备从队头往队尾依次检测所述单队列内的数据包的安全性。
  8. 根据权利要求7所述方法，其特征在于，所述接收所述安全设备返回的所述数据包的检测结果包括：从所述单队列中读取所述数据包的检测结果；
    在将所述数据包发往所述数据包的目的端之后还包括：
    将所述数据包从所述单队列中删除。
  9. 根据权利要求8所述方法，其特征在于，所述若所述检测结果为危险则拒绝转发所述数据包还包括：
    若从所述单队列中读取所述数据包的检测结果为所述数据包为危险数据包，则删除所述数据包。
  10. 一种网络设备，其特征在于，所述网络设备和第一网络设备位于主机内；所述网络设备包括：
    中断控制单元，用于在所述第一网络设备与第二网络设备之间有数据包传输时，中断所述数据包的传输；
    数据传递单元，用于将所述数据包存入与所述主机内的安全设备之间的共享内存；
    结果获取单元，用于接收所述安全设备返回的所述数据包的检测结果；
    数据处理单元，用于若所述检测结果为安全则将所述数据包发往所述数据包的目的端，若所述检测结果为危险则拒绝转发所述数据包。
  11. 根据权利要求10所述网络设备，其特征在于，所述第一网络设备还包括：
    数据转发单元，用于若所述检测结果为安全，且所述数据包为数据流的数据包，在接收到所述数据流的后续数据包后，将所述数据包发往所述数据包的目的端。
  12. 根据权利要求11所述网络设备，其特征在于，
    所述数据处理单元，用于若所述数据流为在白名单内包含的数据流，或者，所述数据流被标记为流通过的数据流，则将所述数据包发往所述数据包的目的端。
  13. 根据权利要求10所述网络设备，其特征在于，所述主机内还包括：路由模块；所述第一网络设备以及所述安全设备与所述路由模块采用应用程序接口API建立连接；
    所述中断控制单元，具体用于通过所述路由模块采用所述API中断所述数 据包的传输。
  14. 根据权利要求13所述网络设备，其特征在于，所述第一网络设备和第二网络设备均为虚拟机，所述路由模块为虚拟交换机，所述安全设备为具有安全检测能力的虚拟机。
  15. 根据权利要求13所述网络设备，其特征在于，所述第一网络设备还包括：
    信息接收单元，用于接收来自云管理服务器的安全策略信息；
    连接建立单元，用于若所述安全策略信息指定需要对所述第一网络设备进行安全防护，则采用API建立所述中断控制单元与所述路由模块之间的通信连接。
  16. 根据权利要求10至13任意一项所述网络设备，其特征在于，
    所述数据传递单元，具体用于在获得所述数据包后，将所述数据包存入位于共享内中的单队列的队尾，使所述安全设备从队头往队尾依次检测所述单队列内的数据包的安全性。
  17. 根据权利要求16所述网络设备，其特征在于，所述结果获取单元包括：
    结果读取单元，具体用于从所述单队列中读取所述数据包的检测结果；
    删除控制单元，用于在所述数据传递单元将所述数据包发往所述数据包的目的端之后，将所述数据包从所述单队列中删除。
  18. 根据权利要求14所述网络设备，其特征在于，
    所述数据处理单元，具体用于若从所述单队列中读取所述数据包的检测结果为所述数据包为危险数据包，则删除所述数据包。
  19. 一种分布式网络，包括：以可通信连接方式连接的第一网络设备、第二网络设备以及第三网络设备，其特征在于，所述第三网络设备为权利要求10～18任意一项所述的网络设备，所述第三网络设备、所述第一网络设备以及安全设备位于同一主机内。
PCT/CN2016/077386 2015-04-02 2016-03-25 一种网络设备间的通信方法、网络设备及分布式网络 WO2016155574A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510154559.4 2015-04-02
CN201510154559.4A CN106161522A (zh) 2015-04-02 2015-04-02 一种网络设备间的通信方法、网络设备及分布式网络

Publications (1)

Publication Number Publication Date
WO2016155574A1 true WO2016155574A1 (zh) 2016-10-06

Family

ID=57003903

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/077386 WO2016155574A1 (zh) 2015-04-02 2016-03-25 一种网络设备间的通信方法、网络设备及分布式网络

Country Status (2)

Country Link
CN (1) CN106161522A (zh)
WO (1) WO2016155574A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109413001B (zh) * 2017-08-15 2021-06-22 东软集团股份有限公司 对云计算系统内的交互数据进行安全保护的方法及装置
CN109672681A (zh) * 2018-12-25 2019-04-23 上海点融信息科技有限责任公司 入侵检测方法及入侵检测装置
CN110012033B (zh) * 2019-05-05 2022-03-22 深信服科技股份有限公司 一种数据传输方法、系统及相关组件
CN111953661A (zh) * 2020-07-23 2020-11-17 深圳供电局有限公司 一种基于sdn的东西向流量安全防护方法及其系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101800730A (zh) * 2009-02-09 2010-08-11 国际商业机器公司 安全增强的虚拟机通信方法和虚拟机系统
CN101946466A (zh) * 2007-12-21 2011-01-12 英特尔公司 多个应用的对等流传输和api服务
CN102523215A (zh) * 2011-12-15 2012-06-27 北京海云捷迅科技有限公司 基于kvm虚拟化平台的虚拟机在线杀毒系统
US20130036470A1 (en) * 2011-08-03 2013-02-07 Zhu Minghang Cross-vm network filtering
US20130275964A1 (en) * 2008-06-03 2013-10-17 Jonathan L. Edwards System, method, and computer program product for scanning data utilizing one of a plurality of virtual machines of a device

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103458003B (zh) * 2013-08-15 2016-11-16 中电长城网际系统应用有限公司 一种自适应云计算环境虚拟安全域访问控制方法和系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101946466A (zh) * 2007-12-21 2011-01-12 英特尔公司 多个应用的对等流传输和api服务
US20130275964A1 (en) * 2008-06-03 2013-10-17 Jonathan L. Edwards System, method, and computer program product for scanning data utilizing one of a plurality of virtual machines of a device
CN101800730A (zh) * 2009-02-09 2010-08-11 国际商业机器公司 安全增强的虚拟机通信方法和虚拟机系统
US20130036470A1 (en) * 2011-08-03 2013-02-07 Zhu Minghang Cross-vm network filtering
CN102523215A (zh) * 2011-12-15 2012-06-27 北京海云捷迅科技有限公司 基于kvm虚拟化平台的虚拟机在线杀毒系统

Also Published As

Publication number Publication date
CN106161522A (zh) 2016-11-23

Similar Documents

Publication Publication Date Title
JP6430462B2 (ja) バーチャルマシン通信トラフィックを成形すること
US10038668B2 (en) Computerized system and method for handling network traffic
US8369334B2 (en) Internet real-time deep packet inspection and control device and method
US8955093B2 (en) Cooperative network security inspection
US20130275592A1 (en) Adaptive session forwarding following virtual machine migration detection
US9246825B2 (en) Accelerated processing of aggregate data flows in a network environment
US12015556B2 (en) Method, apparatus, and system for generating, and processing packets according to, a flow filtering rule
US9166921B2 (en) Selective packet sequence acceleration in a network environment
US9356844B2 (en) Efficient application recognition in network traffic
WO2016101783A1 (zh) 一种攻击数据包的处理方法、装置及系统
WO2017114286A1 (zh) 基于混合云平台的网络管理系统
US9722933B2 (en) Selective packet sequence acceleration in a network environment
CN108429761B (zh) 智慧协同网络中资源适配解析服务器DDoS攻击检测防御方法
WO2016155574A1 (zh) 一种网络设备间的通信方法、网络设备及分布式网络
CN110768884B (zh) Vxlan报文封装及策略执行方法、设备、系统
CN111245740B (zh) 配置业务的服务质量策略方法、装置和计算设备
KR20130126833A (ko) 네트워크 가상화를 위한 고속 스위칭 방법 및 고속 가상 스위치
WO2023040303A1 (zh) 网络流量控制方法以及相关系统
WO2019033891A1 (zh) 一种基于rdma的网络流量确定方法及装置
JP5957318B2 (ja) ネットワークシステム、情報中継装置、及びパケット配信方法
WO2022100001A1 (zh) 网络安全防护方法以及防护设备
CN102546587B (zh) 防止网关系统会话资源被恶意耗尽的方法及装置
EP4199427A1 (en) Ai-supported network telemetry using data processing unit
WO2017070965A1 (zh) 一种基于软件定义网络的数据处理方法及相关设备
US7848331B2 (en) Multi-level packet classification

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16771329

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16771329

Country of ref document: EP

Kind code of ref document: A1