WO2017152396A1 - 流表处理方法及装置 - Google Patents

流表处理方法及装置 Download PDF

Info

Publication number
WO2017152396A1
WO2017152396A1 PCT/CN2016/075982 CN2016075982W WO2017152396A1 WO 2017152396 A1 WO2017152396 A1 WO 2017152396A1 CN 2016075982 W CN2016075982 W CN 2016075982W WO 2017152396 A1 WO2017152396 A1 WO 2017152396A1
Authority
WO
WIPO (PCT)
Prior art keywords
flow table
matching
security group
packet
port
Prior art date
Application number
PCT/CN2016/075982
Other languages
English (en)
French (fr)
Inventor
苑威
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2016/075982 priority Critical patent/WO2017152396A1/zh
Priority to EP18203905.7A priority patent/EP3522460B1/en
Priority to CN201680068616.XA priority patent/CN108293019B/zh
Priority to EP16856471.4A priority patent/EP3249862B1/en
Publication of WO2017152396A1 publication Critical patent/WO2017152396A1/zh
Priority to US16/125,330 priority patent/US10715492B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/38—Flow based routing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/54—Organization of routing tables
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/64—Routing or path finding of packets in data switching networks using an overlay routing layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/104—Grouping of entities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45587—Isolation or security of virtual machine instances
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances

Definitions

  • the present invention relates to the field of computer technology, and in particular, to a method, a device, a computing device, and a method and device for processing a packet in a software-defined network (English full name: software defined network, abbreviation: SDN) Computing device.
  • a software-defined network English full name: software defined network, abbreviation: SDN
  • a virtual multi-tenant scenario exists and different virtual machines in the tenant (English name: virtual machine, abbreviated: VM) receive different messages and send messages. Isolation and setting rules for receiving and sending packets for each virtual machine according to the requirements of the tenant.
  • the security group (English: security group) is used to specify the rules for the virtual machine to receive and send packets.
  • a security group usually has multiple rules for receiving packets and multiple rules for sending packets.
  • the security group in some cloud computing environments can also have only rules for receiving packets or rules for sending packets.
  • multiple virtual machines can be added to each security group.
  • the packets received or sent by the multiple virtual machines need to meet the rules in the security group. For example, a total of M virtual machines join a security group, and the number of rules in the security group is N.
  • the SDN controller needs to send the security group matching flow table, and each security group matching flow table sent by the SDN controller Both contain at least two matching fields, which makes the matching of the security group matching flow table more complicated.
  • the present application provides a flow table processing method to improve the matching efficiency of a security group.
  • the first aspect of the present application provides a flow table processing method, including: an SDN controller receives a message that a M virtual machine port sent by a cloud computing management platform joins a security group, where the message carries the M virtual machine ports. The identity and the identity of the security group.
  • the SDN controller generates a first matching flow table set according to the identifier of the security group and the identifier of the M virtual machine ports, where at least M ports corresponding to the M virtual machine ports match the flow table, and each virtual machine port corresponds to at least A port matching flow table, each port matching flow table includes port matching information and an identifier of the security group.
  • the port matching information in each port matching flow table corresponds to one virtual machine port.
  • Each virtual machine port can match the two port matching flow table, that is, the port matching information in the two port matching flow table can correspond to the same virtual Machine port.
  • the port matching information in each port matching flow table may be obtained according to the identifier of the virtual machine port.
  • the SDN controller obtains the N rules included in the security group according to the identifier of the security group, and generates a second matching flow table set, where the second matching flow table set includes at least N rule matching flow tables corresponding to the N rules.
  • Each rule corresponds to at least one rule matching flow table, and each rule matching flow table includes rule matching information and an identifier of the security group.
  • the rule matching information in each rule matching flow table corresponds to one rule.
  • the number of rule matching flow tables corresponding to each rule is also different.
  • Each rule can match multiple rule matching flow tables, that is, multiple rules match the rule matching information in the flow table. Corresponds to the same rule.
  • the SDN controller generates an action flow table of the security group, where the action flow table of the security group includes an identifier of the security group and a message action, where the action flow table is used to indicate: when the message is in the first matching flow table set When any port matching flow table matches and matches any one of the rule matching flow tables in the second matching flow table set, the message performs the message action.
  • the SDN controller sends the first matching flow table set, the second matching flow table set, and the action flow table of the security group to the switching device, so that the switching device processes the message according to the flow table.
  • the first matching flow table set and the second matching flow table set are used to implement the security group matching of the packet, and the action flow table is matched to successfully match the packet action of the security group, thereby reducing the message in the process of performing security group matching.
  • the number of matching domains of the matched flow table reduces the complexity of the security group matching process and improves the efficiency of the security group matching.
  • the combination of at least two matching domains also makes the number of flow tables large.
  • the SDN controller needs to generate at least M*N.
  • the security group matches the flow table.
  • the number of flow tables also increases greatly, which reduces the operating efficiency of the system.
  • the solution provided by the application reduces the number of flow tables that need to be generated, reduces the burden on the SDN controller to generate a flow table, and reduces the number of packets received by the switching device.
  • the burden of matching also reduces the communication pressure of the SDN controller to send the flow table to the switching device to the communication network.
  • the reduced number of flow tables also reduces the storage pressure of the switching device, enabling the switching device to handle more complex security group scenarios.
  • each port matching flow table further includes a first connection identifier, where the first connection identifier is used to indicate that the packet is any of the first matching flow table set When a port matching flow table is matched, the security group matching of the packet completes the first part, and the first connection identifier may further indicate that the matching of the security group includes two parts; each rule matching flow table further includes a second connection identifier, When the second connection identifier is used to indicate that the packet matches any one of the rule matching flow tables in the second matching flow table set, the security group matching of the packet completes the second part, and the second connection identifier may further indicate the The matching of the security group has two parts.
  • the switching device determines that the packet is successfully matched according to the first connection identifier and the second connection identifier before processing the packet according to the packet action included in the action flow table of the security group. Security group.
  • the first matching flow table set and the second matching flow table set are connected by using the first connection identifier and the second connection identifier, so that the first matching flow table set and the second matching flow table set cooperate to complete the security group matching.
  • the SDN controller further receives a message that the new virtual machine port joins the security group, where the virtual machine port is the foregoing A virtual machine port other than the M virtual machine ports, where the virtual machine port is the M+1th virtual machine port that joins the security group.
  • the message carries the identity of the security group and the identity of the new virtual machine port.
  • the SDN controller acquires port matching information of the new virtual machine port according to the identifier of the new virtual machine port.
  • the SDN controller generates a port matching flow table corresponding to the new virtual machine port, and the port matching flow table corresponding to the new virtual machine port includes port matching information of the new virtual machine port and an identifier of the security group.
  • the SDN controller sends the port matching flow table corresponding to the new virtual machine port to the switching device.
  • the SDN controller before the SDN controller generates the port matching flow table corresponding to the new virtual machine port, it is also required to confirm that the second matching flow table set is already recorded on the switching device, that is, the SDN controller needs to confirm that the foregoing is recorded on the SDN controller.
  • M virtual machine ports are associated with this security group.
  • the above scheme is adopted, and in the scenario where a new virtual machine port is added to the security group, the flow table generation and subsequent matching processes are simpler, and the working efficiency of the SDN controller and the switching device are improved. Matching efficiency.
  • the SDN controller only needs to generate a small number of flow table and send it to the switching device.
  • the SDN controller needs to generate at least N flow tables in this scenario, so the technical solution provided by the application reduces the SDN control.
  • the work load of the device improves the working efficiency of the SDN controller.
  • the SDN controller receives a message that the new rule joins the security group, where the new rule is the foregoing N in the security group.
  • the new rule is the N+1 rule of the security group.
  • the SDN controller generates a rule matching flow table corresponding to the new rule, and the rule matching flow table corresponding to the new rule includes new rule matching information, an identifier of the security group, and the new rule matching information corresponds to the new rule.
  • the new rule matching information is generated by the new rule, and the new rule can be carried in the message that the new rule joins the security group.
  • the SDN controller sends the rule matching flow table corresponding to the new rule to the switching device.
  • the flow table generation and the subsequent matching process are simpler in the scenario where a new rule is added to the security group, which improves the working efficiency of the SDN controller and the matching efficiency of the switching device.
  • the SDN controller only needs to generate a small number of flow tables and send them to the switching device.
  • the SDN controller needs to generate at least M flow tables in this scenario, so the technical solution provided by the application reduces the SDN controller.
  • the work load increases the efficiency of adding rules to the security group.
  • the second and third implementation manners of the foregoing first aspect may also be used in combination, that is, adding a new virtual machine port to the security group, and adding a new rule to the security group.
  • the SDN controller generates the new virtual The port matching flow table corresponding to the machine port matches the rule matching flow table corresponding to the new rule, and is sent to the switching device.
  • the security is also included in each of the port matching flow table and each of the rule matching flow tables. Group priority information.
  • the M virtual machine ports are added to the security group, they may belong to another security group.
  • the packets sent by the M virtual machine ports may match multiple security groups. If the port matches the flow table.
  • the rule matching flow table also includes the priority information of the security group, and the action flow corresponding to the security group with the highest priority is executed when the packets sent by the virtual machine ports belonging to the multiple security groups match the multiple security groups.
  • the message action in the table is not limited to the packets sent by the virtual machine ports belonging to the multiple security groups.
  • the each port matching flow table further includes connection tracking information (English: connection tracking) information, where the connection is The tracking information indicates that the packet matching any one of the port matching flow tables belongs to the new session.
  • the security group provides stateful access control. Therefore, if the packet does not belong to the new session, the security group matching is not required.
  • the packet is processed according to the history processing method of the session to which the packet belongs.
  • the port matching flow table includes the link tracking information, so that only the packets of the newly created session need to match the first matching flow table set and the second matching flow table set.
  • the each port matching flow table, the each rule matching flow table, and the security group further includes direction information, where the direction information indicates that the packet matching the first matching flow table set and the second matching flow table set is outgoing (English: egress) direction or enters (English: Ingress) direction.
  • the packet received by the switching device has two directions, namely, a packet sent from the virtual machine port connected to the switching device to the switching device, that is, an outgoing direction, and sent to the switching device through the switching device.
  • the packet of the virtual machine port is the entry direction.
  • the processing flow of the switching device is different for the packets in different directions, and the direction information is recorded in each of the port matching flow table, the each rule matching flow table, and the action flow table of the security group, so as to Messages in different directions are matched with flow tables that record information in different directions.
  • the port included in the first matching flow table set generated by the SDN controller may be 2M, and the number of action flow tables of the security group generated by the SDN controller is 2. If the direction of the packet needs to match the direction information in the flow table, you need to generate 2M port matching flow table and 2 action flow table for the scenario where the M virtual machine port is added to the security group.
  • Each virtual machine port corresponds to two port matching flow tables. One port matches the direction information in the flow table to indicate the outgoing direction of the packet, and the other port matches the direction information in the flow table to indicate the incoming direction of the packet.
  • Each virtual machine port corresponds to two action flow tables.
  • the direction information in one action flow table indicates the outgoing direction of the message
  • the direction information in the other action flow table indicates the direction in which the message enters.
  • some security management groups of the cloud computing management platform may only report a rule of the entry direction or the outgoing direction of the message.
  • the direction information of each port matching flow table, each rule matching flow table, and the security group also includes the direction information.
  • the number of the port matching flow table included in the first matching flow table set generated by the SDN controller may be M, and the number of the action flow table of the security group generated by the SDN controller is 1, that is, only the packet entering direction or A flow table in the direction of outgoing messages.
  • a second aspect of the present application provides a packet processing method, including: receiving, by a switching device, a to-be-processed message sent by a virtual machine.
  • the switching device matches the to-be-processed message with the security group matching information.
  • the security group matching information includes the first matching flow table set, the second matching flow table set, and the action flow of the security group generated by the SDN controller in the first aspect or the first aspect. table.
  • the switching device determines that the to-be-processed packet matches any of the port matching flow table matching flow tables in the first matching flow table set, and matches any of the rule matching flow tables in the second matching flow table set. And processing the to-be-processed message according to the packet action included in the action flow table of the security group.
  • the to-be-processed message cannot match any one of the flow table in the first matching flow table set, or any one of the to-be-processed message and the second matching flow table set If the packets cannot be matched, the pending packet does not match the security group.
  • the switching device After receiving the first matching flow table set and the second matching flow table set, the switching device only needs to match the flow table in the first matching flow table set and the flow table in the second matching flow table set after receiving the to-be-processed message. If the matching packet is matched, the number of matching domains of the matching flow table is less than that of the prior art, and the prior art needs to match with the M*N flow table. The number of flow tables that need to be matched is reduced, the workload of the switching device is reduced, and the efficiency of the matched packets matching the security group is improved.
  • the switching device further receives the security group matching information before receiving the to-be-processed packet.
  • the switching device receives the first generated by the SDN controller in the first implementation manner of the foregoing first aspect A matching flow table set and a second matching flow table set.
  • the switching device After the switching device determines that the to-be-processed packet matches any one of the port matching flow tables in the first matching flow table set, the first connection identifier is recorded; the switching device determines the to-be-processed packet and the second matching flow table. After the matching of the flow table is successful, the second connection identifier is recorded.
  • the first connection identifier and the second connection identifier may further indicate that the matching of the security group has two parts. Therefore, the switching device determines the to-be-processed packet according to the recorded first connection identifier and the second connection identifier. The security group is successfully matched, so the switching device processes the to-be-processed message according to the packet action.
  • the switching device connects the first matching flow table set and the second matching flow table set by using the first connection identifier and the second connection identifier, and the matching between the to-be-processed packet and the security group is efficiently implemented.
  • the third aspect of the present application provides a flow table processing apparatus, configured to generate a flow table according to a message that a virtual machine port joins a security group, so that the switching device implements the virtual according to the indication of the flow table.
  • the machine port joins the security group.
  • the flow table processing apparatus includes at least one module for performing the flow table processing method provided by the first aspect or any one of the first aspects.
  • a fourth aspect of the present invention provides a message processing apparatus, configured to receive a flow table sent by an SDN controller, and process the received pending message according to an indication of a flow table.
  • the message processing apparatus includes at least one module for performing the message processing method provided by any one of the second aspect or the second aspect.
  • a fifth aspect of the present application provides a computing device, which may be a network node in an SDN architecture, on which software for implementing an SDN controller may be run, such that the computing device implements an SDN controller.
  • the flow table processing method provided by the first aspect or any one of the first aspects is executed when the computing device is running.
  • a sixth aspect of the present application provides a computing device, which may be a computing node in an SDN architecture, on which computing software for implementing a switching device may be implemented to enable the computing device to implement the function of the switching device.
  • the packet processing method provided by any one of the second aspect or the second aspect is executed when the computing device is running.
  • the seventh aspect of the present application provides an SDN, where the SDN includes at least one computing device as provided in the fifth aspect as a network node in the SDN, and further includes at least one computing device as provided in the sixth aspect as an SDN calculate node.
  • the computing device provided by the fifth aspect and the meter provided by the sixth aspect Establish a communication network between devices.
  • a storage medium where the program code is stored, and when the program code is executed by the computing device, the flow table provided by any one of the first aspect or the first aspect is executed.
  • the storage medium includes, but is not limited to, a flash memory (English: flash memory), a hard disk (English: hard disk drive, abbreviated as HDD) or a solid state drive (English: solid state drive, abbreviation: SSD).
  • the ninth aspect of the present application provides a storage medium, where the program code is stored, and the program code is executed by the computing device, and the message provided by any one of the second aspect or the second aspect is executed.
  • the storage medium includes, but is not limited to, a flash memory, an HDD, or an SSD.
  • a tenth aspect of the present application provides a program code, which may be a software installation package, which is provided by any one of the first aspect or the first aspect when the computing device is run by the computing device.
  • Flow table processing method may be a software installation package, which is provided by any one of the first aspect or the first aspect when the computing device is run by the computing device.
  • a program code is provided, and the program code may be a software installation package, where the software installation package is executed by the computing device, and the implementation of the second aspect or the second aspect is provided.
  • Flow table processing method is provided, and the program code may be a software installation package, where the software installation package is executed by the computing device, and the implementation of the second aspect or the second aspect is provided.
  • a flow table processing method including:
  • the SDN controller generates a third matching flow table set of the security group, and the M virtual machines join the security group, where the third matching flow table set includes at least M virtual machine matching flow tables corresponding to the M virtual machines.
  • Each virtual machine corresponds to at least one virtual machine matching flow table, and each virtual machine matching flow table includes virtual machine matching information and an identifier of the security group, where M is an integer greater than 0;
  • the SDN controller generates a fourth matching flow table set, where the security group includes N rules, and the fourth matching flow table set includes at least N rule matching flow tables corresponding to the N rules, and each rule corresponds to At least one rule matching flow table, each rule matching flow table includes rule matching information and an identifier of the security group, where N is an integer greater than 0;
  • the SDN controller generates an action flow table of the security group, and the action flow table of the security group includes an identifier of the security group and a packet action, where the packet action indication message matches the security group successfully.
  • the matching of the packet with the security group includes: the packet and the third Any virtual machine matching flow table in the flow matching table set matches and matches any rule matching flow table in the fourth matching flow table set;
  • the SDN controller sends the third matching flow table set, the fourth matching flow table set, and the action flow table of the security group to the switching device.
  • the virtual machine matching information may be an identifier of the virtual machine or other information of the virtual machine, and the virtual machine matching information may distinguish different virtual machines.
  • the SDN controller may also receive a message that the virtual machine joins the security group, so the SDN controller adds the virtual machine matching information to the virtual machine matching flow table. .
  • the switching device that receives the to-be-processed packet obtains the virtual machine to which the to-be-processed packet belongs, and obtains the virtual machine of the virtual machine to which the to-be-processed packet belongs.
  • the matching information is matched, and the flow table of the third matching flow table set is matched according to the virtual machine matching information of the virtual machine to which the to-be-processed message belongs.
  • a thirteenth aspect of the present application provides a flow table processing method, including:
  • the SDN controller generates a fifth matching flow table set of the security group, and the M subnets are added to the security group, and the fifth matching flow table set includes at least M subnet matching flow tables corresponding to the M subnets, and each subnet Corresponding to at least one subnet matching flow table, each subnet matching flow table includes subnet matching information and an identifier of the security group, where M is an integer greater than 0;
  • the SDN controller generates a sixth matching flow table set, where the security group includes N rules, and the sixth matching flow table set includes at least N rule matching flow tables corresponding to the N rules, and each rule corresponds to At least one rule matching flow table, each rule matching flow table includes rule matching information and an identifier of the security group, where N is an integer greater than 0;
  • the SDN controller generates an action flow table of the security group, and the action flow table of the security group includes an identifier of the security group and a packet action, where the packet action indication message matches the security group successfully. After the packet is successfully matched with the security group, the packet is matched with any virtual machine matching flow table in the fifth matching flow table set and is matched with the sixth matching flow table. Any of the rules matching the flow table match;
  • the SDN controller sends the fifth matching flow table set, the sixth matching flow table set, and the action flow table of the security group to the switching device.
  • the subnet matching information may be an identifier of a subnet or other information of a subnet, such as a network address and a mask, and the subnet matching information may distinguish different subnets.
  • the SDN controller may also receive a message that the subnet joins the security group, so the SDN controller adds the subnet matching information of the subnet to the subnet. Match the flow table.
  • the switching device that receives the to-be-processed packet obtains the subnet to which the to-be-processed packet belongs, and obtains the subnet matching of the subnet to which the to-be-processed packet belongs.
  • the information matches the flow table in the fifth matching flow table set according to the subnet matching information of the subnet to which the to-be-processed message belongs.
  • FIG. 1a to 1c are schematic diagrams of an SDN architecture provided by an embodiment of the present application.
  • FIG. 2 is a schematic structural diagram of a computing device provided by an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of a flow table processing method according to an embodiment of the present disclosure
  • FIG. 4 is a schematic flowchart of a packet processing method according to an embodiment of the present application.
  • FIG. 5 is a schematic diagram of a flow table according to an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a flow table processing apparatus according to an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of a packet processing apparatus according to an embodiment of the present disclosure.
  • first, second, etc. are used in the present application to distinguish each object, such as a first matching flow table set, a second matching flow table set, etc., but there is no logic or timing between each of the "first” and "second”. Dependencies on.
  • a cloud computing management platform refers to a software platform for deploying, managing, and configuring a large number of virtual machines in a network to provide cloud computing services to users.
  • the cloud computing management platform generally needs to support and manage all kinds of mainstream virtual machine monitors (English full name: virtual machine monitor, abbreviation: VMM), and provide users with an application programming interface (English full name: application programming interface, abbreviation: API) Helps users implement VM migration, load balancing, and elastic scaling.
  • Currently available cloud computing management platforms include Eucalyptus, CloudStack, OpenNebula, Openstack, and others.
  • a flow table is used to control a data flow in an SDN, which may also be referred to as an SDN flow table.
  • SDN flow table a flow table conforming to the openflow protocol is used as an example, and a flow conforming to other protocols may also be used in actual use. table.
  • switching devices refer to virtual switches (English name: virtual switch).
  • Common switching devices include Open vSwitch, abbreviated as OVS, which is a virtual switch provided by an open source project.
  • FIG. 1 is a schematic diagram of an SDN architecture applied to an embodiment of the present application.
  • the cloud computing management platform receives an operation message sent by a user by using an API provided to the user.
  • the operation message includes the port of the VM joining the security group to the security group.
  • the cloud computing management platform instructs the SDN controller in the network node to generate a corresponding flow table according to the operation message, and the SDN controller sends the flow table to the switching device on each computing node for exchange.
  • the device can implement the user's operation message according to the flow table.
  • Network nodes can be used not only to deploy SDN controllers, but also to implement modules for network address translation (English name: network address translation, abbreviated: NAT), load balancing, and firewall.
  • the compute nodes and network nodes in the SDN architecture of the present application may be physical servers.
  • the communication network between the cloud computing management platform and the network nodes and the communication network between the network nodes and the computing nodes may be networks within the data center.
  • the cloud management platform can also control network nodes in other data centers across data centers.
  • FIG. 1b is a schematic diagram of another SDN architecture applied in the embodiment of the present application, and the difference from FIG. 1a is The cloud computing management platform is deployed on the network node.
  • the neutron module used to manage the network configuration in the openstack cloud computing management platform can be deployed on the network node.
  • FIG. 1c is a schematic diagram of still another SDN architecture applied in the embodiment of the present application.
  • the difference from the foregoing SDN architecture is that a distributed SDN controller is used.
  • the nodes in which the SDN controller is deployed in FIGS. 1a through 1c can be implemented by computing device 200.
  • the schematic diagram of the organizational structure of the computing device 200 includes a processor 202 and a memory 204, and may further include a bus 208 and a communication interface 206.
  • the processor 202, the memory 204, and the communication interface 206 can implement communication connection with each other through the bus 208, and can also implement communication by other means such as wireless transmission.
  • the processor 202 can be a central processing unit (English: central processing unit, abbreviated: CPU).
  • the memory 204 may include a volatile memory (English: volatile memory), such as random-access memory (English: random-access memory, abbreviation: RAM); the memory may also include non-volatile memory (English: non-volatile memory) For example, a read-only memory (English: read-only memory, abbreviated as ROM), a flash memory, an HDD or an SSD; the memory 204 may also include a combination of the above types of memories.
  • ROM read-only memory
  • flash memory an HDD or an SSD
  • the memory 204 may also include a combination of the above types of memories.
  • the nodes in which the switching devices are deployed in FIGS. 1a through 1c can also be implemented by computing device 200.
  • the program code for implementing the message processing method provided in FIG. 4 of the present application is stored in the memory 204 and executed by the processor 202.
  • each security group matching flow table delivered by the SDN controller includes at least two The matching domain, where the at least two matching domains are used to determine which security group the virtual machine port that sends the packet belongs to, and determine whether the packet matches the rules in the security group.
  • the combination of the at least two matching fields also makes the number of the flow table large. For example, for a security group with N rules including M virtual machine ports, the SDN controller needs to deliver at least M*N security group matching flows. Table, as M or N increases, the number of flow tables also increases significantly.
  • the embodiment of the present invention changes the form of the security group matching flow table, and splits the flow table used to implement the security group matching into two parts, and the part is a port matching flow table, which is used for matching the virtual machine port.
  • the other part is a rule matching flow table, which is used to match the rules of the security group.
  • the packet After the matching of the two parts is completed, the packet is considered to be successfully matched with the security group. At this time, the packet can perform the third part of the action.
  • whether the port matching flow table, the rule matching flow table, or the action flow table has only a single matching domain, the generation and matching of the flow table are relatively simple.
  • the port matching flow table and the rule matching flow table used for matching are separately generated, and are not combined, so that when M and N are relatively large, the total number of flow tables generated for matching is less than the current one.
  • the number of flow tables in the technology is, for example, the number of flow tables used for matching generated by the embodiment of the present invention is M+N 1 (generally, N rules may correspond to N rule matching information, but in some cases, N rules Corresponding to N 1 rule matching information, each rule matching information needs to generate a matching flow table for matching, N 1 is greater than N), or 2M+N 1 , and is generated according to the prior art.
  • the number of matching flow tables is M*N 1 .
  • a flow table processing method is provided.
  • Step 402 The SDN controller generates a first matching flow table set of the security group, and the M virtual machine ports join the security group, where the first matching flow table set includes at least M ports corresponding to the M virtual machine ports. Matching the flow table, each virtual machine port corresponds to at least one port matching flow table, and each port matching flow table includes port matching information and an identifier of the security group, where M is an integer greater than 0.
  • the SDN controller generates the first matching flow table set, where the flow table in the first matching flow table set is used for matching the virtual machine port, that is, which security group the virtual machine port that sends or receives the message belongs to.
  • the SDN controller generates the flow table of the first matching flow table set according to the obtained message that the obtained M virtual machine ports join the security group, where the first matching flow table is centralized.
  • the flow table is used to match the port information of the virtual machine.
  • the user sends a security group join message to the cloud computing management platform, where the security group join message includes an identifier of the M virtual machine ports and an identifier of the security group.
  • the M virtual machine ports indicate M different ports, and the M virtual machine ports may belong to m virtual machines, m ⁇ M. Cloud management platform will use this M
  • the identifier of the virtual machine port and the identity of the security group are sent to the SDN controller.
  • the format of the identifier of the security group specified in the API provided by the cloud computing management platform may not be the same as the format of the identifier of the security group carried in the flow table generated by the SDN controller. Therefore, the cloud computing management platform or the SDN controller After receiving the identifier of the security group sent by the user, it can be converted into the identifier of the security group specified in the flow table design specification according to actual needs for use in generating the flow table.
  • the security group join message sent by the user to the cloud computing management platform, and the identifier of the M virtual machine ports may be replaced by one or more virtual machine identifiers or one or more subnet identifiers, and the cloud computing management platform or the SDN controller
  • the identifier of the corresponding virtual machine port is obtained according to the one or more virtual machine identifiers, or the identifier of the corresponding virtual machine port is obtained according to one or more subnet identifiers.
  • the cloud computing management platform or the SDN controller Since the user can add all virtual machine ports corresponding to one or more virtual machines or all virtual machine ports corresponding to one or more subnets to the security group, in this case, the cloud computing management platform or the SDN controller The one or more virtual machine identifiers or the one or more subnet identifiers are also required to be converted, obtain the identifier of the corresponding virtual machine port, or directly obtain the port matching information of the corresponding virtual machine port.
  • the number of port matching flow tables included in the first matching flow table set has the following three optional scenarios:
  • each port matching flow table further includes direction information, where the direction information indicates the outgoing direction of the packet.
  • the port matching flow table in each outgoing direction includes the direction information, the identifier of the security group, and port matching information of the outgoing direction of the packet.
  • the packets in the inbound direction are all released or discarded.
  • the SDN controller also needs to generate a flow table for releasing or discarding all incoming packets.
  • each port matching flow table further includes direction information, where the direction information indicates the direction in which the packet enters.
  • the port matching flow table of each inbound direction includes the direction information, the identifier of the security group, and port matching information of the packet entering direction.
  • the packets in the outbound direction are all released or discarded.
  • the SDN controller also needs to generate a flow table for releasing or discarding all outgoing packets.
  • the security group includes the rules for the inbound direction of the packet and the rules for the outbound direction of the packet. Therefore, the first matching flow table set also needs to generate the M matching direction port matching flow table and the M outbound direction port matching.
  • the flow table has a total of 2M port matching flow tables. Each virtual machine port corresponds to a port matching flow table in the inbound direction and a port matching flow table in the outbound direction.
  • the port matching flow table includes direction information, where the direction information indicates the direction in which the packet enters or the outgoing direction of the packet.
  • the inbound direction port matching flow table includes the direction information of the packet entry direction, the identifier of the security group, and the port matching information of the packet entry direction.
  • the outbound direction port matching flow table includes the direction information of the outbound direction of the packet, the identifier of the security group, and the port matching information of the outbound direction of the packet.
  • the common port matching information in the outgoing direction includes the identifier of the virtual machine port.
  • the port matching information of the common inbound direction includes the VXLAN network identifier corresponding to the virtual machine port (VXLAN network identifier, VNI) and the media access control corresponding to the virtual machine port (English name: media access control, Abbreviation: MAC) address, or VLAN ID (English full name: VLAN identifier, abbreviation: VID) and the MAC address corresponding to the virtual machine port. That is, the VNI and the MAC address together serve as the port matching information of the inbound direction, or the VID and the MAC address together serve as the port matching information of the inbound direction. In fact, the port matching information of the inbound direction and the port matching information of the outbound direction are selected according to the design of the flow table, and the port matching information can distinguish different virtual machine ports.
  • each port matching flow table further includes priority information of the security group.
  • the packets sent or received by the M virtual machine ports may also successfully match multiple security groups. Therefore, the priority information of the security group included in the port matching flow table may be When a packet is successfully matched with multiple security groups, the packet is processed by the packet action in the action flow table of the security group with the highest priority.
  • each port matching flow table further includes connection tracking information of the security group, where the connection tracking information indicates that the packet matching the successful port matching flow table belongs to the new session.
  • the binding tracking information is added to the port matching flow table so that only the packets of the newly created session need to match the first matching flow table set.
  • Step 404 The SDN controller generates a second matching flow table set, where the security group includes N rules, and the second matching flow table set includes at least N rule matching flow tables corresponding to the N rules, and each rule Correct At least one rule should match the flow table, and each rule matching flow table includes rule matching information and an identifier of the security group, and the N is an integer greater than zero.
  • the SDN controller generates the second matching flow table set, where the flow table in the second matching flow table set is used to match the rules of the security group, that is, whether the packet matches at least one rule in the security group. .
  • rule matching flow table may further include priority information of the security group.
  • the packets sent or received by the M virtual machine ports may also successfully match multiple security groups. Therefore, the priority information of the security group included in the rule matching flow table may be When a packet is successfully matched with multiple security groups, the packet is processed by the packet action in the action flow table of the security group with the highest priority.
  • the rule matching flow table may further include direction information of the security group. If the rule includes the direction information of the rule, that is, the rule is used to limit the packets in the outbound direction or the packets in the inbound direction, the rule matching flow table also needs to include the direction information.
  • the SDN controller accesses the preset database according to the identifier of the security group according to the identifier of the security group to obtain the N rules included in the security group.
  • Each rule includes one or more of the following matching conditions, such as IPv4 or IPv6, and a protocol type (for example, a transmission control protocol (English name: transmission control protocol, abbreviation: TCP), an IP prefix, etc.
  • One or more matching conditions are generated to generate rule matching information.
  • One rule can generate multiple rule matching information, so one rule can also match multiple rule matching flow tables. Therefore, the number of port matching flow tables in the second matching flow table set is greater than Or equal to N.
  • a rule in a security group includes a matching condition: remote_group security group A
  • the matching condition indicates that all virtual machine ports in security group A can match the rule. If the rule is the rule of the outbound direction of the packet, the remote_group security group A indicates that the packet whose destination VM port belongs to security group A matches the rule. If the rule is the rule for the packet to enter the direction, the remote_group security group A indicates that the packet whose source VM port belongs to security group A matches the rule.
  • rules indicating matching conditions of consecutive port ranges such as the specified TCP port in the matching condition is 8000-8100, if the rule matching information uses the address prefix and the mask.
  • each port matching flow table further includes a first connection identifier, where the first connection identifier is used to indicate that the security group matching of the packet includes two parts, where the packet and the first When any port matching flow table in the matching flow table set matches, the security group matching of the packet completes the first part;
  • Each of the rule matching flow table further includes a second connection identifier, where the second connection identifier is used to indicate that the security group matching of the packet includes two parts, where the packet and the second matching flow table set are When any one of the rules matches the flow table match, the security group matching of the message completes the second part.
  • the security group matching is split into two parts, which are respectively implemented by the first matching flow table set and the second matching flow table set. Therefore, the two parts need to be connected by the connection identifier.
  • Each connection identifier consists of two pieces of information, which currently belong to the first part and a total of several parts. For example, the first connection identifier is “1/2”, indicating that the first part belongs to the first part and there are 2 parts in total, and the second connection identifier is “2/2”, indicating that the current part belongs to the second part and there are 2 parts in total. .
  • the first connection identifier and the second connection identifier enable the switching device to determine whether the packet matches the split flow table of each part in the process of performing security group matching on the packet.
  • Step 406 The SDN controller generates an action flow table of the security group, where the action flow table of the security group includes an identifier of the security group and a packet action, where the packet action indication message matches the security group
  • the matching of the packet with the security group includes: matching the packet with any port matching flow table in the first matching flow table set and the second matching flow table set Any of the rules match the flow table match.
  • the packet matches the port matching flow table of the first matching flow table set, that is, the port matching information of the virtual machine port that sends the packet or the port matching information of the destination virtual machine port of the packet, and the The port matching information in the at least one port matching flow table in the first matching flow table set matches.
  • Matching the packet with any rule matching flow table in the second matching flow table set that is, the protocol type, IP information, and the like used by the packet, and matching the flow table with at least one rule in the second matching flow table set. Rule matching information match.
  • the packet matches any one of the port matching flow tables in the first matching flow table set, and the packet matches any one of the rule matching flow tables in the second matching flow table set, the packet and the security are matched. The group match was successful.
  • the action flow table of the security group further includes direction information.
  • the number of the action flow table of the security group generated by the SDN controller in step 406 is 2, and includes the direction information of the outgoing direction of the packet, the identifier of the security group, and the report of the outgoing direction of the packet.
  • steps 402, 404, and 406 there is no sequence of steps between steps 402, 404, and 406, and steps 402, 404, and 406 may be performed in any order or in parallel.
  • Step 408 The SDN controller sends the first matching flow table set, the second matching flow table set, and the action flow table of the security group to the switching device.
  • the SDN controller sends the generated first matching flow table set, the second matching flow table set, and the action flow table of the security group to the switching device, so that the switching device can follow the above after receiving the message.
  • the switching device can include one or more virtual switches.
  • FIG. 5 The following describes the structure of the flow table by using FIG. 5 as an example.
  • the flow table structure in actual use can be different from the flow table structure shown in FIG. 5, and the naming of each field can also be designed according to requirements, wherein sgA indicates the safety group A.
  • $sgA_conj_id in actions conjunction($sgA_conj_id, 1/2) is the identifier of security group A, and 1/2 is the first connection identifier.
  • the action indicates that if the packet matches the port matching flow table successfully, the $sgA_conj_id and 1/2 are recorded.
  • Rule1 egress, ipv4, 22/tcp, remote_group: sgA is one of the rules in security group A.
  • the egress indicates that the rule is used for outgoing packets.
  • ipv4, 22/tcp, remote_group: sgA is rule1.
  • the remote_group:sgA in the matching condition indicates that the addresses of all the virtual machine ports associated with security group A are aggregated as rules.
  • the action indicates that if the message matches the rule matching flow table successfully, then $sgA_conj_id and 2/2 are recorded.
  • the action in the flow table 1 indicates that the next flow table is executed, and the action indication message in the action flow table 2 in the outgoing direction of the message is sent from one port.
  • the action of the message indicated by the action flow table may be various according to the flow table design.
  • one security group is provided with an action flow table, and the packets matching the success of the security group are all executed in the action flow table. Text action.
  • the flow table processing method further includes: the SDN controller receives a message that the new virtual machine port joins the security group, where the new virtual machine port is the M+1th virtual machine port that joins the security group.
  • the SDN controller generates a port matching flow table corresponding to the new virtual machine port.
  • the SDN controller sends the port matching flow table corresponding to the new virtual machine port to the switching device.
  • the port matching flow table corresponding to the new virtual machine port includes port matching information of the new virtual machine port and an identifier of the security group.
  • the SDN controller records the history virtual machine port joining each security group, if SDN control After receiving the message that the new virtual machine port joins the security group A, the SDN controller finds that it has recorded that the historical virtual machine port has joined the security group A, and the port matching flow generated when the historical virtual machine port joins the security group A
  • the table, the rule matching flow table, and the action flow table of the security group A have been sent to the switching device, so the SDN controller does not need to generate the rule matching flow table and the action flow table of the security group A, and only needs to generate the new virtual machine.
  • the port corresponding to the port matches the flow table and is sent to the switching device.
  • the security group includes a rule for the inbound direction of the packet and a rule for the outbound direction of the packet
  • the port matching flow table corresponding to the new virtual machine port further includes direction information.
  • the number of the port matching flow table corresponding to the new virtual machine port generated by the SDN controller is 2, and includes the direction information of the outgoing direction of the packet, the identifier of the security group, and the new virtual machine. Port matching information of the outbound direction of the packet in the outbound direction, the direction information of the incoming direction of the packet, the identifier of the security group, and the port matching information of the incoming direction of the packet of the new virtual machine port.
  • the flow table generation and the subsequent matching process are simpler, and a new flow can be implemented by using a smaller number of flow tables.
  • the virtual machine port is added to the security group. Compared with the existing technology, it is required to generate at least N flow tables to improve the working efficiency of the SDN controller.
  • the SDN controller receives a message that the new rule joins the security group, where the new rule is an N+1 rule of the security group; and the SDN controller generates a rule matching flow table corresponding to the new rule; The SDN controller sends the rule matching flow table corresponding to the new rule to the switching device.
  • the rule matching flow table corresponding to the new rule includes new rule matching information, an identifier of the security group, and the new rule matching information corresponds to the new rule.
  • the SDN controller receives the message that the new rule is added to the security group A. Since the rule matching flow table corresponding to the history rule of the security group A has been sent to the switching device, the SDN controller only needs to generate the rule corresponding to the new rule. The flow table is matched and sent to the switching device. The number of rule matching flow tables corresponding to the new rule generated by the SDN controller is greater than or equal to 1 because the new rule can correspond to multiple rule matching information.
  • the flow table generation and subsequent matching processes are simpler, and a new rule can be implemented by using a smaller number of flow tables.
  • Adding a security group improves the existing technology by generating at least M flow tables. The efficiency of the SDN controller.
  • the flow table processing method provided above reduces the complexity of the flow table used to implement the security group matching of the packet, improves the generation and use efficiency of the flow table used to implement the security group matching of the packet, and reduces the virtual machine.
  • the number of flow tables that the SDN controller needs to generate reduces the workload of the SDN controller and the transmission load of the communication network between the SDN controller and the switching device.
  • the present application further provides a packet processing method.
  • the method is performed when a node deploying a switching device is deployed in FIG. 1a to FIG. 1c, and a schematic flowchart thereof is shown in FIG. 4 .
  • Step 602 The switching device receives the to-be-processed message.
  • Step 604 The switching device matches the to-be-processed message with the security group matching information.
  • the security group matching information includes: a first matching flow table set, a second matching flow table set, and an action flow table of the security group, where M virtual machine ports join the security group, and the security group includes N rules,
  • M and N are respectively integers greater than 0
  • the first matching flow table set includes at least M port matching flow tables corresponding to the M virtual machine ports, and each virtual machine port corresponds to at least one port matching flow table.
  • Each port matching flow table includes port matching information and an identifier of the security group
  • the second matching flow table set includes at least N rule matching flow tables corresponding to the N rules, and each rule corresponds to at least one rule matching.
  • each rule matching flow table includes rule matching information and an identifier of the security group
  • the action flow table of the security group includes an identifier of the security group and a packet action, where the packet action indication message is After the security group is successfully matched, the matching of the packet with the security group includes: matching the packet with any port matching flow table in the first matching flow table set and Two matching flow table Either a matching rule matching flow table.
  • the security group matching information includes the first matching flow table set, the second matching flow table set, and the action flow table of the security group generated in steps 402 to 406 and its various alternatives.
  • the message processing method is used in combination with the flow table processing method shown in FIG. 3.
  • the node that executes the message processing method belongs to the same SDN as the node that executes the flow table processing method shown in FIG.
  • the switching device in step 602 receives the first matching flow table set and the second matching flow table set and the action flow table of the security group generated by the SDN controller in the flow table processing method shown in FIG. 3, and the implementation details and various
  • the optional flow table content refers to the flow table processing method corresponding to FIG. 3 .
  • each port matching flow table further includes a first connection identifier
  • each rule matching flow table further includes a second connection identifier
  • the switching device After the switching device obtains the to-be-processed packet, it determines that the to-be-processed packet matches the matching matching flow table of any one of the first matching flow table sets, and records the identifier of the security group and the first connection identifier, as shown in FIG. The port matches $sgA_conj_id and 1/2 in the flow table. After the switching device determines that the to-be-processed message matches any one of the rule matching flow table in the second matching flow table set, the switch records the identifier of the security group and the second connection identifier, as shown in the rule matching flow table in FIG. sgA_conj_id and 2/2.
  • the switching device determines that the pending message matches the security group A successfully according to the recorded $sgA_conj_id and 1/2, $sgA_conj_id and 2/2.
  • the matching of the security group is divided into two parts, and the split matching flow table and the rule matching flow table have only a single matching domain, so the switching device uses the to-be-processed packet and the security group.
  • the matching process of matching information is also relatively simple.
  • the number of flow tables that need to be matched in the embodiment of the present invention is M+N or 2M+N, which reduces the number of flow tables that need to be matched, and reduces the exchange.
  • the working load of the device improves the speed at which the pending packets match the security group.
  • each port matching flow table in the first matching flow table set further includes direction information.
  • the port matching information in the outbound direction of the packet may be the identifier of the virtual machine port.
  • the switching device After receiving the packet to be processed in the outbound direction, the switching device obtains the identifier of the virtual machine port of the to-be-processed packet in the outbound direction. Matches the outbound direction port matching flow table.
  • the port matching information of the packet in the direction of the packet is the VNI and the MAC address. After receiving the pending packet in the inbound direction, the switching device obtains the VNI of the destination virtual machine port of the packet according to the information carried in the packet. MAC address, used to match the inbound direction port matching flow table.
  • the pending packet carries the information such as the protocol type and the destination IP address, and the switching device matches the rule matching information in the rule matching flow table according to the information.
  • Step 606 After the switching device successfully matches the to-be-processed packet with the security group, the switching device processes the to-be-processed packet according to the packet action.
  • the switching device further receives the security group matching information before performing step 602.
  • the security group matching information is sent by the SDN controller to the switching device, and the switching device can receive After one security group matching information, step 602 to step 606 are performed a plurality of times.
  • the message action in the process processes the to-be-processed message.
  • the action flow table of the security group further includes direction information.
  • the number of the action flow table of the security group received in step 602 is 2, and includes the direction information of the outgoing direction of the packet, the identifier of the security group, and the packet action in the outgoing direction of the packet. And the direction information of the direction in which the packet enters the direction, the identifier of the security group, and the packet action in the direction in which the packet enters.
  • the switching device implements the security group matching of the packet by using the first matching flow table set and the second matching flow table set, and implements the packet action of the security group matched by the action flow table, thereby reducing
  • the complexity of the security group matching process is reduced, and the number of flow tables that need to be matched when the switching device processes the pending packets is reduced, which improves the working efficiency of the switching device.
  • the application also provides a flow table processing device 800 that can act as a network node in an SDN architecture.
  • the device may be implemented by the computing device 200 shown in FIG. 2, or may be implemented by an application-specific integrated circuit (ASIC), or a programmable logic device (English: programmable logic device, abbreviation: PLD) )achieve.
  • the PLD may be a complex programmable logic device (CPLD), an FPGA, a general array logic (GAL), or any combination thereof.
  • the flow table processing device 800 is for implementing the flow table processing method shown in FIG.
  • the flow table processing device 800 and its respective modules may also be software modules, such as software modules implementing an SDN controller.
  • the schematic diagram of the organization of the flow table processing apparatus 800 includes a generation module 802 and a transmission module 804.
  • the generating module 802 When the generating module 802 is in operation, the step 402, the step 404, and the step 406 in the flow table processing method shown in FIG. 3 and various alternatives thereof are executed.
  • the sending module 804 When the sending module 804 is in operation, the flow table processing shown in FIG. 3 is executed. Step 408 in the method.
  • the flow table processing device reduces the complexity of the flow table used to implement the security group matching of the packet, improves the generation and use efficiency of the flow table used to implement the security group matching of the packet, and reduces the virtual machine.
  • the number of flow tables that the SDN controller needs to generate reduces the workload of the flow table processing device and the transmission load of the communication network between the flow table processing device and the switching device.
  • the embodiment of the present invention further provides a message processing apparatus 1000, which can be used as a computing node in an SDN architecture.
  • the apparatus may be implemented by the computing device 200 shown in FIG. 4, or may be implemented by an ASIC, or a PLD.
  • the above PLD may be a complex programmable CPLD, an FPGA, a GAL, or any combination thereof.
  • the message processing apparatus 1000 is configured to implement the image deployment method shown in FIG. 8.
  • the message processing apparatus 1000 and each module thereof may also be a software module, such as a software module implementing a virtual switch.
  • the schematic diagram of the organization of the message processing apparatus 1000 includes a receiving module 1002 and a processing module 1004.
  • the receiving module 1002 When the receiving module 1002 is in operation, the step 602 in the message processing method shown in FIG. 4 and the action of acquiring the security group matching information before the step 602 are performed.
  • the processing module 1004 When the processing module 1004 is in operation, the message processing method shown in FIG. 4 is executed. Step 604 and step 606.
  • the packet processing apparatus implements the security group matching of the packet by using the first matching flow table set and the second matching flow table set, and implements matching the packet action of the security group by using the action flow table, thereby reducing the security group matching.
  • the complexity of the process and the number of flow tables that need to be matched when the switching device processes the pending packets improves the working efficiency of the switching device.
  • the implementation details of the flow table processing method shown in FIG. 3 can be applied to the flow table processing device 800.
  • the implementation details of the message processing method shown in FIG. 4 can be applied to the message processing apparatus 1000.
  • the methods described in connection with the present disclosure can be implemented by a processor executing software instructions.
  • the software instructions can be composed of corresponding software modules, which can be stored in RAM, flash memory, ROM, erasable programmable read only memory (English: erasable programmable read only Memory, abbreviation: EPROM), electrically erasable programmable read only memory (EEPROM), hard disk, optical disk, or any other form of storage medium known in the art.
  • the functions described herein may be implemented in hardware or software.
  • the functions may be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium.
  • a storage medium may be any available media that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种流表处理方法，该方法运用于软件定义网络SDN，SDN控制器确定M个虚拟机端口加入安全组后，生成第一匹配流表集与第二匹配流表集和该安全组的动作流表，第一匹配流表集和第二匹配流表集配合实现该安全组的匹配，该安全组的动作流表包括与该安全组匹配成功的报文的报文动作。本申请提供的方法降低了实现安全组匹配的流表的复杂程度，提升了安全组的匹配效率。

Description

流表处理方法及装置 技术领域
本申请涉及计算机技术领域，尤其涉及在软件定义网络(英文全称：software defined network，缩写：SDN)中的用于流表处理的方法、装置以及计算设备和用于报文处理的方法、装置以及计算设备。
背景技术
云计算环境中，由于存在复杂的多租户场景且租户内不同虚拟机(英文全称：virtual machine，缩写：VM)接收报文与发送报文的策略不同等场景，为了实现各个虚拟机之间的隔离，并按照租户的需求为各个虚拟机设置接收报文和发送报文的规则，采用了安全组(英文：security group)来规定虚拟机接收和发送报文的规则。
安全组内一般含有多条接收报文的规则和多条发送报文的规则，部分云计算环境中的安全组也可以仅有接收报文的规则或仅有发送报文的规则。与之同时，每个安全组内可以加入多个虚拟机，这多个虚拟机接收或发送的报文需要符合该安全组内的规则。例如，共有M个虚拟机加入一个安全组，该安全组内的规则数量为N。现有的SDN中，为了使得虚拟机发出的报文能够匹配这个安全组中的N条规则，需要SDN控制器下发安全组匹配流表，SDN控制器下发的每个安全组匹配流表都包含至少两个匹配域，这使得安全组匹配流表的匹配比较复杂。
发明内容
本申请提供了一种流表处理方法，以提升安全组的匹配效率。
本申请的第一方面，提供了一种流表处理方法，包括：SDN控制器接收云计算管理平台发送的M个虚拟机端口加入安全组的消息，该消息中携带该M个虚拟机端口的标识和该安全组的标识。
SDN控制器根据安全组的标识和这M个虚拟机端口的标识，生成第一匹配流表集，所述M个虚拟机端口对应的至少M个端口匹配流表，每个虚拟机端口对应至少一个端口匹配流表，每个端口匹配流表包括端口匹配信息和所述安全组的标识。每个端口匹配流表中的端口匹配信息对应一个虚拟机端口，由于每个虚拟机端口可以对应两个端口匹配流表，也即两个端口匹配流表中的端口匹配信息可以对应同一个虚拟机端口。每个端口匹配流表中的端口匹配信息可以是根据虚拟机端口的标识获取的。
SDN控制器根据该安全组的标识获取该安全组包括的N条规则，并生成第二匹配流表集，该第二匹配流表集包括所述N条规则对应的至少N个规则匹配流表，每条规则对应至少一个规则匹配流表，每个规则匹配流表包括规则匹配信息和所述安全组的标识。每个规则匹配流表中的规则匹配信息对应一条规则。根据该安全组内的规则的不同，每个规则对应的规则匹配流表的数量也不同，每个规则可以对应多条规则匹配流表，也即多条规则匹配流表中的规则匹配信息可以对应同一条规则。
SDN控制器生成该安全组的动作流表，该安全组的动作流表包括该安全组的标识以及报文动作，该动作流表用于指示：当报文与该第一匹配流表集中的任意一个端口匹配流表匹配且与该第二匹配流表集中的任意一个规则匹配流表匹配时，该报文执行该报文动作。
SDN控制器将该第一匹配流表集、该第二匹配流表集、该安全组的动作流表发送至交换设备，以供交换设备根据这些流表处理报文。通过第一匹配流表集、第二匹配流表集实现报文的安全组匹配，以及通过动作流表实现匹配成功该安全组的报文动作，降低了报文在进行安全组匹配的过程中所匹配的流表的匹配域的数量，降低了安全组匹配过程的复杂程度，提升了安全组匹配的效率。
同时，现有技术中，至少两个匹配域的组合也使得流表数量较多，例如，对于包含M个虚拟机端口的具有N条规则的安全组，SDN控制器需要生成至少M*N个安全组匹配流表，随着M或N的增大，流表数量也大量的增加，降低了系统的运行效率。而与现有技术相比，本申请提供的方案降低了需要生成的流表的数量，减轻了SDN控制器生成流表的负担，降低了交换设备收到报文后进行 匹配时的负担，还减轻了SDN控制器发送流表至交换设备对通信网络的通信压力。同时，流表的数量降低也降低了交换设备的存储压力，使得交换设备能够处理更复杂的安全组场景。
结合第一方面，在第一方面的第一种实现方式中，每个端口匹配流表还包括第一连接标识，该第一连接标识用于指示报文与该第一匹配流表集中的任意一个端口匹配流表匹配时，该报文的安全组匹配完成第一部分，该第一连接标识还可以指示该安全组的匹配包括两个部分；每个规则匹配流表还包括第二连接标识，该第二连接标识用于指示该报文与该第二匹配流表集中的任意一个规则匹配流表匹配时，该报文的安全组匹配完成第二部分，该第二连接标识还可以指示该安全组的匹配共有两个部分；交换设备根据该安全组的动作流表中包括的报文动作处理该报文前，根据该第一连接标识和该第二连接标识确定该报文成功匹配该安全组。
通过第一连接标识和第二连接标识，将第一匹配流表集和第二匹配流表集连接起来，使得第一匹配流表集和第二匹配流表集配合完成安全组匹配。
结合第一方面或第一方面的第一种实现方式，在第一方面的第二种实现方式中，SDN控制器还接收到了新虚拟机端口加入该安全组的消息，该虚拟机端口为前述M个虚拟机端口之外的虚拟机端口，该虚拟机端口为第M+1个加入该安全组的虚拟机端口。该消息中携带该安全组的标识和该新虚拟机端口的标识。
SDN控制器根据该新虚拟机端口的标识获取该新虚拟机端口的端口匹配信息。
SDN控制器生成该新虚拟机端口对应的端口匹配流表，该新虚拟机端口对应的端口匹配流表包括该新虚拟机端口的端口匹配信息和该安全组的标识。SDN控制器将该新虚拟机端口对应的端口匹配流表发送至交换设备。
可选的，SDN控制器生成该新虚拟机端口对应的端口匹配流表前，还需要确认该交换设备上已经记录有前述第二匹配流表集，也即需要确认SDN控制器上记录有前述M个虚拟机端口与该安全组关联。
采用上述方案，使得在有新虚拟机端口加入到安全组的场景下，流表生成以及的后续匹配过程都更加简单，提升了SDN控制器的工作效率以及交换设备 的匹配效率。并且SDN控制器仅需生成少量条流表并发送至交换设备，而现有技术中，SDN控制器在此场景下，至少需要生成N条流表，因此本申请提供的技术方案减少了SDN控制器的工作负担，提升了SDN控制器的工作效率。
结合第一方面或第一方面的第一种实现方式，在第一方面的第三种实现方式中，SDN控制器接收新规则加入该安全组的消息，该新规则为该安全组中前述N条规则之外的规则，该新规则为该安全组的第N+1条规则。
SDN控制器生成该新规则对应的规则匹配流表，该新规则对应的规则匹配流表包括新规则匹配信息、该安全组的标识，该新规则匹配信息对应于所述新规则。该新规则匹配信息通过该新规则生成，该新规则可以携带在该新规则加入该安全组的消息之中。
SDN控制器将该新规则对应的规则匹配流表发送至该交换设备。
采用上述方案，使得在有新规则加入到安全组的场景下，流表的生成以及后续匹配过程都更加简单，提升了SDN控制器的工作效率以及交换设备的匹配效率。并且SDN控制器仅需生成少量流表并发送至交换设备，而现有技术中，SDN控制器在此场景下，至少需要生成M条流表，因此本申请提供的技术方案减少了SDN控制器的工作负担，提升了为安全组增加规则的效率。
上述第一方面的第二和第三种实现方式还可以组合使用，即增加新虚拟机端口至该安全组，并且为该安全组增加新规则，此种场景下，SDN控制器生成该新虚拟机端口对应的端口匹配流表和该新规则对应的规则匹配流表，并发送至交换设备。
结合第一方面或第一方面的前述任意一种实现方式，在第一方面的第四种实现方式中，所述每个端口匹配流表和所述每个规则匹配流表中还包括该安全组的优先级信息。
该M个虚拟机端口除了加入到该安全组之外，还可能属于别的安全组，则该M个虚拟机端口发出的报文可能会匹配成功多个安全组，此时如果端口匹配流表和规则匹配流表中还包括安全组的优先级信息，则可以确定属于多个安全组的虚拟机端口发出的报文匹配成功多个安全组时，执行优先级最高的安全组对应的动作流表中的报文动作。
结合第一方面或第一方面的前述任意一种实现方式，在第一方面的第五种实现方式中，所述每个端口匹配流表还包括联结追踪(英文：connection tracking)信息，该联结追踪信息指示匹配任意一个端口匹配流表的报文属于新建会话。
安全组提供有状态的访问控制，因此如果报文不属于新建会话，则无须进行安全组匹配，直接按照该报文所属的会话的历史处理方法处理该报文。端口匹配流表中包括了联结追踪信息，使得仅有新建会话的报文需要匹配第一匹配流表集和第二匹配流表集。
结合第一方面或第一方面的前述任意一种实现方式，在第一方面的第六种实现方式中，所述每个端口匹配流表、所述每个规则匹配流表和所述安全组的动作流表中还包括方向信息，所述方向信息指示与所述第一匹配流表集和所述第二匹配流表集匹配的报文为外出(英文：egress)方向或进入(英文：ingress)方向。
交换设备接收到的报文有两种方向，分别为从与该交换设备相连的虚拟机端口发往该交换设备的报文，即外出方向，以及通过该交换设备发往与该交换设备相连的虚拟机端口的报文，即进入方向。针对不同方向的报文，交换设备的处理流程也不同，在所述每个端口匹配流表、所述每个规则匹配流表和所述安全组的动作流表中记录有方向信息，以将不同方向的报文与记录了不同方向信息的流表进行匹配。
如果该安全组包括的规则有报文进入方向和报文外出方向的规则，在第一方面或第一方面的任意一种实现方式中，SDN控制器生成的第一匹配流表集中包括的端口匹配流表的数量可以为2M，SDN控制器生成的该安全组的动作流表的数量为2。由于考虑到报文的方向需要与流表中的方向信息匹配，因此针对M个虚拟机端口加入所述安全组的场景，需要生成2M个端口匹配流表和2个动作流表。每个虚拟机端口对应两个端口匹配流表，其中一个端口匹配流表中的方向信息指示报文外出方向，另一个端口匹配流表中的方向信息指示报文进入方向。每个虚拟机端口对应两个动作流表，其中一个动作流表中的方向信息指示报文外出方向，另一个动作流表中的方向信息指示报文进入方向。
根据云计算管理平台的设计，有的云计算管理平台的安全组中可以只有报 文进入方向或报文外出方向的规则，此种情况下，所述每个端口匹配流表、所述每个规则匹配流表和所述安全组的动作流表中还包括所述方向信息，而SDN控制器生成的第一匹配流表集中包括的端口匹配流表的数量可以为M，SDN控制器生成的该安全组的动作流表的数量为1，即仅需要生成报文进入方向或报文外出方向的流表。
本申请的第二方面，提供了一种报文处理方法，包括：交换设备接收虚拟机发出的待处理的报文。
交换设备将该待处理的报文与安全组匹配信息进行匹配。该安全组匹配信息包括第一方面或第一方面的任意一种实现方式中SDN控制器生成的所述第一匹配流表集、所述第二匹配流表集和所述安全组的动作流表。
交换设备确定将该待处理的报文与所述第一匹配流表集中的任一端口匹配流表匹配流表匹配，并且与所述第二匹配流表集中的任一规则匹配流表匹配后，按照所述安全组的动作流表包括的报文动作处理该待处理报文。
相应的，如果确定所述待处理报文与所述第一匹配流表集中的任意一个流表都无法匹配，或所述待处理报文与所述第二匹配流表集中的任意一个流表都无法匹配，则该待处理报文未匹配成功该安全组。
交换设备接收第一匹配流表集和第二匹配流表集后，在接收到待处理的报文后，仅需与第一匹配流表集中的流表和第二匹配流表集中的流表匹配，就可以确定该待处理报文是否匹配成功该安全组，所匹配的流表的匹配域的数量比现有技术少，并且与现有技术需要与M*N个流表匹配相比，降低了需要匹配的流表的数量，降低了交换设备的工作负担，提升了待处理报文匹配安全组的效率。
结合第二方面，在第二方面的第一种实现方式中，交换设备在接收该待处理的报文之前，还接收了该安全组匹配信息。
结合第二方面或第二方面的第一种实现方式，在第二方面的第二种实现方式中，交换设备接收到的为前述第一方面的第一种实现方式中SDN控制器生成的第一匹配流表集和第二匹配流表集。
交换设备确定该待处理报文与该第一匹配流表集中的任意一个端口匹配流表匹配后，记录所述第一连接标识；交换设备确定该待处理报文与所述第二匹配流表集中的任意一个规则匹配流表匹配成功后，记录所述第二连接标识。该第一连接标识和该第二连接标识还可以指示该安全组的匹配共有两个部分，因此交换设备根据记录的所述第一连接标识与所述第二连接标识，确定该待处理报文匹配成功该安全组，因此交换设备按照所述报文动作处理所述待处理报文。
通过该第一连接标识和该第二连接标识，交换设备将该第一匹配流表集和该第二匹配流表集连接，高效的实现了待处理报文与安全组的匹配。
本申请的第三方面，提供了一种流表处理装置，该流表处理装置用于根据虚拟机端口加入安全组的消息，生成流表以供交换设备按照该流表的指示实现将该虚拟机端口加入该安全组。该流表处理装置包括了用于执行第一方面或第一方面的任意一种实现方式提供的流表处理方法的至少一个模块。
本申请的第四方面，提供了一种报文处理装置，该报文处理装置用于接收SDN控制器发送的流表，按照流表的指示处理接收到的待处理报文。该报文处理装置包括了用于执行第二方面或第二方面的任意一种实现方式提供的报文处理方法的至少一个模块。
本申请的第五方面，提供了一种计算设备，该计算设备可以为SDN架构中的网络节点，该计算设备上可以运行用于实现SDN控制器的软件，以使得该计算设备实现SDN控制器的功能。该计算设备运行时执行第一方面或第一方面的任意一种实现方式提供的流表处理方法。
本申请的第六方面，提供了一种计算设备，该计算设备可以为SDN架构中的计算节点，该计算设备上可以运行用于实现交换设备的软件，以使得该计算设备实现交换设备的功能。该计算设备运行时执行第二方面或第二方面的任意一种实现方式提供的报文处理方法。
本申请的第七方面，提供了一种SDN，该SDN中包括至少一个如第五方面提供的计算设备作为SDN中的网络节点，还包括至少一个如第六方面提供的计算设备作为SDN中的计算节点。第五方面提供的计算设备与第六方面提供的计 算设备之间建立通信网络。
本申请的第八方面，提供了一种存储介质，该存储介质中存储了程序代码，该程序代码被计算设备运行时，执行第一方面或第一方面的任意一种实现方式提供的流表处理方法。该存储介质包括但不限于快闪存储器(英文：flash memory)，硬盘(英文：hard disk drive，缩写：HDD)或固态硬盘(英文：solid state drive，缩写：SSD)。
本申请的第九方面，提供了一种存储介质，该存储介质中存储了程序代码，该程序代码被计算设备运行时，执行第二方面或第二方面的任意一种实现方式提供的报文处理方法。该存储介质包括但不限于快闪存储器、HDD或SSD。
本申请的第十方面，提供了一种程序代码，该程序代码可以为一个软件安装包，该软件安装包被计算设备运行时，执行第一方面或第一方面的任意一种实现方式提供的流表处理方法。
本申请的第十一方面，提供了一种程序代码，该程序代码可以为一个软件安装包，该软件安装包被计算设备运行时，执行第二方面或第二方面的任意一种实现方式提供的流表处理方法。
本申请的第十二方面，提供了一种流表处理方法，包括：
SDN控制器生成安全组的第三匹配流表集，M个虚拟机加入所述安全组，所述第三匹配流表集包括所述M个虚拟机对应的至少M个虚拟机匹配流表，每个虚拟机对应至少一个虚拟机匹配流表，每个虚拟机匹配流表包括虚拟机匹配信息和所述安全组的标识，所述M为大于0的整数；
所述SDN控制器生成第四匹配流表集，所述安全组包括N条规则，所述第四匹配流表集包括所述N条规则对应的至少N个规则匹配流表，每条规则对应至少一个规则匹配流表，每个规则匹配流表包括规则匹配信息和所述安全组的标识，所述N为大于0的整数；
所述SDN控制器生成所述安全组的动作流表，所述安全组的动作流表包括所述安全组的标识和报文动作，所述报文动作指示报文与所述安全组匹配成功后执行的操作，所述报文与所述安全组匹配成功包括：所述报文与所述第三匹 配流表集中的任一虚拟机匹配流表匹配且与所述第四匹配流表集中的任一规则匹配流表匹配；
所述SDN控制器将所述第三匹配流表集，所述第四匹配流表集以及所述安全组的动作流表发送至交换设备。
以上虚拟机匹配信息可以为虚拟机的标识，也可以为虚拟机的其他信息，该虚拟机匹配信息可以区分不同虚拟机。
与本申请的第一方面提供的流表处理方法不同的是，SDN控制器接收到的也可能是虚拟机加入安全组的消息，因此SDN控制器将虚拟机匹配信息加入虚拟机匹配流表中。接收到该第三匹配流表集的交换设备在获取了待处理的报文后，判断发出该待处理的报文所属的虚拟机后，获取该待处理的报文所属的虚拟机的虚拟机匹配信息，并根据该待处理的报文所属的虚拟机的虚拟机匹配信息匹配该第三匹配流表集中的流表。
第十二方面提供的流表处理方法的其他实现方式参照第一方面提供的流表处理方法的各个实现方式。
本申请的第十三方面，提供了一种流表处理方法，包括：
SDN控制器生成安全组的第五匹配流表集，M个子网加入所述安全组，所述第五匹配流表集包括所述M个子网对应的至少M个子网匹配流表，每个子网对应至少一个子网匹配流表，每个子网匹配流表包括子网匹配信息和所述安全组的标识，所述M为大于0的整数；
所述SDN控制器生成第六匹配流表集，所述安全组包括N条规则，所述第六匹配流表集包括所述N条规则对应的至少N个规则匹配流表，每条规则对应至少一个规则匹配流表，每个规则匹配流表包括规则匹配信息和所述安全组的标识，所述N为大于0的整数；
所述SDN控制器生成所述安全组的动作流表，所述安全组的动作流表包括所述安全组的标识和报文动作，所述报文动作指示报文与所述安全组匹配成功后执行的操作，所述报文与所述安全组匹配成功包括：所述报文与所述第五匹配流表集中的任一虚拟机匹配流表匹配且与所述第六匹配流表集中的任一规则匹配流表匹配；
所述SDN控制器将所述第五匹配流表集，所述第六匹配流表集以及所述安全组的动作流表发送至交换设备。
以上子网匹配信息可以为子网的标识，也可以为子网的其他信息，例如网络地址及掩码，该子网匹配信息可以区分不同子网。
与本申请的第一方面提供的流表处理方法不同的是，SDN控制器接收到的也可能是子网加入安全组的消息，因此SDN控制器将该子网的子网匹配信息加入子网匹配流表中。接收到该第五匹配流表集的交换设备在获取了待处理的报文后，判断该待处理的报文所属的子网后，获取该待处理的报文所属的子网的子网匹配信息，并根据该待处理的报文所属的子网的子网匹配信息匹配该第五匹配流表集中的流表。
第十三方面提供的流表处理方法的其他实现方式参照第一方面提供的流表处理方法的各个实现方式。
附图说明
为了更清楚地说明本申请实施例的技术方案，下面将对实施例中所需要使用的附图作以简单地介绍，显而易见的，下面描述中的附图是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1a至图1c为本申请实施例提供的SDN架构的示意图；
图2为本申请实施例提供的计算设备的组织结构示意图；
图3为本申请实施例提供的流表处理方法的流程示意图；
图4为本申请实施例提供的报文处理方法的流程示意图；
图5为本申请实施例提供的流表的示意图；
图6为本申请实施例提供的流表处理装置的组织结构示意图；
图7为本申请实施例提供的报文处理装置的组织结构示意图。
具体实施方式
下面结合本申请实施例中的附图，对本申请实施例中的技术方案进行描述。
本申请中采用术语第一、第二等来区分各个对象，例如第一匹配流表集、第二匹配流表集等，但各个“第一”、“第二”之间不具有逻辑或时序上的依赖关系。
贯穿本说明书，云计算管理平台指代用于在网络中部署、管理、配置大量虚拟机以向用户提供云计算服务的软件平台。云计算管理平台一般需要支持管理各类主流的虚拟机监视器(英文全称：virtual machine monitor，缩写：VMM)，并向用户提供应用程序编程接口(英文全称：application programming interface,缩写：API)以帮助用户实现VM迁移、负载均衡、弹性伸缩等功能。目前已有的云计算管理平台包括Eucalyptus、CloudStack、OpenNebula、Openstack等。
贯穿本说明书，流表用于在SDN中控制数据流，也可以称为SDN流表，在本申请实施例中采用符合openflow协议的流表作为示例，实际使用中也可以采用符合其他协议的流表。
贯穿本说明书，交换设备指虚拟交换机(英文全称：virtual switch)，常见的交换设备包括Open vSwitch，缩写为OVS，OVS为一个开源项目提供的虚拟交换机。
本申请实施例所应用的SDN架构
图1a为本申请实施例所应用的SDN架构的示意图，云计算管理平台通过向用户提供的API接收用户发出的操作消息，本申请中该操作消息包括了VM的端口加入安全组、向安全组添加规则等，云计算管理平台获取了操作消息后，根据操作消息指示网络节点中的SDN控制器生成对应的流表，SDN控制器将流表发送至各个计算节点上的交换设备，以供交换设备能够根据流表实现用户的操作消息。网络节点不仅可以用于部署SDN控制器，还可以部署用于实现网络地址翻译(英文全称：network address translation，缩写：NAT)、负载均衡、防火墙等功能的模块。
本申请的SDN架构中的计算节点和网络节点可以为物理服务器。云计算管理平台和网络节点之间的通信网络以及网络节点和计算节点之间的通信网络可以为数据中心内的网络。云计算管理平台也可以跨数据中心对其他数据中心的网络节点进行控制。
图1b为本申请实施例所应用的另一SDN架构的示意图，与图1a的区别在 于，云计算管理平台部署于网络节点，例如采用openstack云计算管理平台的场景下，openstack云计算管理平台中用于管理网络配置的neutron模块可以部署于网络节点。
图1c为本申请实施例所应用的又一SDN架构的示意图，与前述SDN架构的区别在于采用了分布式的SDN控制器。
图1a至图1c中部署了SDN控制器的节点可以通过计算设备200实现。计算设备200的组织结构示意图如图2所示，包括处理器202、存储器204，还可以包括总线208、通信接口206。
其中，处理器202、存储器204和通信接口206可以通过总线208实现彼此之间的通信连接，也可以通过无线传输等其他手段实现通信。
处理器202可以为中央处理器(英文：central processing unit，缩写：CPU)。
存储器204可以包括易失性存储器(英文：volatile memory)，例如随机存取存储器(英文：random-access memory，缩写：RAM)；存储器也可以包括非易失性存储器(英文：non-volatile memory)，例如只读存储器(英文：read-only memory，缩写：ROM)，快闪存储器，HDD或SSD；存储器204还可以包括上述种类的存储器的组合。在通过软件来实现本申请提供的技术方案时，用于实现本申请图3提供的流表处理方法的程序代码保存在存储器204中，并由处理器202来执行。计算设备200通过通信接口206与SDN中其他节点通信。
图1a至图1c中部署了交换设备的节点也可以通过计算设备200实现。在通过软件来实现本申请提供的技术方案时，用于实现本申请图4提供的报文处理方法的程序代码保存在存储器204中，并由处理器202来执行。
现有的SDN中，为了使得虚拟机端口发出的报文能够匹配安全组，需要SDN控制器下发安全组匹配流表，SDN控制器下发的每个安全组匹配流表都包含至少两个匹配域，这至少两个匹配域分别用于确定发出报文的虚拟机端口属于哪个安全组和确定该报文能否匹配安全组内的规则，这使得安全组匹配流表的匹配比较复杂，另外，至少两个匹配域的组合也使得流表数量较多，例如，对于包含M个虚拟机端口的具有N条规则的安全组，SDN控制器需要下发至少M*N个 安全组匹配流表，随着M或N的增大，流表数量也大量的增加。针对上述问题，本发明实施例将安全组匹配流表的形式进行改变，将用于实现安全组匹配的流表拆分为两部分，一部分为端口匹配流表，用于进行虚拟机端口的匹配，另外一部分为规则匹配流表，用于进行安全组的规则的匹配，在上述两部分的匹配都完成后，认为报文与安全组匹配成功，此时，报文可以执行第三部分的动作流表指示的报文动作。根据本发明实施例，无论是端口匹配流表、规则匹配流表，还是动作流表，都只有单个的匹配域，使得流表的生成和匹配都比较简单。另一方面，用于进行匹配的端口匹配流表和规则匹配流表单独生成，不用进行组合，使得在M和N比较大的情况下，生成的总共的用于匹配的流表数量少于现有技术中的流表数量，例如，本发明实施例生成的用于匹配的流表数量为M+N1(一般来说N条规则可能对应N个规则匹配信息，但部分情况下N条规则可能对应于N1个规则匹配信息，每个规则匹配信息都需要生成用于进行匹配的匹配流表，N1大于N)，或者为2M+N1，而根据现有技术中生成的用于匹配的流表数量为M*N1。
根据本发明实施例提供的一种流表处理方法，图1a至图1c中部署了SDN控制器的节点运行时执行该方法，其流程示意图如图3所示。
步骤402，SDN控制器生成安全组的第一匹配流表集，M个虚拟机端口加入所述安全组，所述第一匹配流表集包括所述M个虚拟机端口对应的至少M个端口匹配流表，每个虚拟机端口对应至少一个端口匹配流表，每个端口匹配流表包括端口匹配信息和所述安全组的标识，所述M为大于0的整数。
SDN控制器生成所述第一匹配流表集，所述第一匹配流表集中的流表用于虚拟机端口的匹配，也即确定发出或接收报文的虚拟机端口属于哪个安全组。
可选的，SDN控制器根据获取到的所述M个虚拟机端口加入所述安全组的消息，分别生成所述第一匹配流表集中的各个流表，所述第一匹配流表集中的流表用于进行虚拟机的端口信息的匹配。
用户向云计算管理平台发送安全组加入消息，所述安全组加入消息包括该M个虚拟机端口的标识以及该安全组的标识。这M个虚拟机端口指示M个不同的端口，这M个虚拟机端口可以属于m个虚拟机，m≤M。云计算管理平台将这M 个虚拟机端口的标识与该安全组的标识发送给SDN控制器。
云计算管理平台提供给用户的API中规定的安全组的标识的格式，与SDN控制器后续生成的流表中携带的安全组的标识的格式可能不统一，因此云计算管理平台或SDN控制器可以在接收到用户发来的安全组的标识后，可以根据实际需求，将其转化为流表设计规范中规定的安全组的标识以供生成流表时使用。
用户向云计算管理平台发送的安全组加入消息中，替换M个虚拟机端口的标识的可以是一个或多个虚拟机标识或一个或多个子网标识，这时云计算管理平台或SDN控制器需要根据该一个或多个虚拟机标识获取对应的虚拟机端口的标识，或根据一个或多个子网标识获取对应的虚拟机端口的标识。由于用户可以将一个或多个虚拟机对应的全部虚拟机端口或一个或多个子网对应的全部虚拟机端口加入到该安全组中，因此在这种情况下，云计算管理平台或SDN控制器还需要对该一个或多个虚拟机标识或该一个或多个子网标识进行转换，获取对应的虚拟机端口的标识，或直接获取对应的虚拟机端口的端口匹配信息。
所述第一匹配流表集中包括的端口匹配流表的数量有以下三种可选的场景：
场景1：该安全组仅包括报文外出方向的规则，因此所述第一匹配流表集中也仅需要生成M个外出方向的端口匹配流表。此种场景下，可选的，每个端口匹配流表还包括方向信息，该方向信息指示报文外出方向。每个外出方向的端口匹配流表包括了该方向信息、所述安全组的标识和报文外出方向的端口匹配信息。由于该安全组内没有报文进入方向的规则，因此进入方向的报文会全部被放行或丢弃，SDN控制器还需要生成一条流表用于放行或丢弃全部进入方向的报文。
场景2：该安全组仅包括报文进入方向的规则，因此所述第一匹配流表集中也仅需要生成M个进入方向的端口匹配流表。此种场景下，可选的，每个端口匹配流表还包括方向信息，该方向信息指示报文进入方向。每个进入方向的端口匹配流表包括了该方向信息、所述安全组的标识和报文进入方向的端口匹配信息。由于该安全组内没有报文外出方向的规则，因此外出方向的报文会全部被放行或丢弃，SDN控制器还需要生成一条流表用于放行或丢弃全部外出方向的报文。
场景3：该安全组包括报文进入方向的规则和报文外出方向的规则，因此所述第一匹配流表集中也需要生成M个进入方向的端口匹配流表以及M个外出方向的端口匹配流表，共2M个端口匹配流表，每个虚拟机端口对应一个进入方向的端口匹配流表和一个外出方向的端口匹配流表。此种场景下，可选的，每个端口匹配流表还包括方向信息，该方向信息指示报文进入方向或报文外出方向。进入方向端口匹配流表中包括了报文进入方向的方向信息、所述安全组的标识和报文进入方向的端口匹配信息。外出方向端口匹配流表中包括了报文外出方向的方向信息、所述安全组的标识和报文外出方向的端口匹配信息。
上述场景中，常见的外出方向的端口匹配信息包括虚拟机端口的标识。
上述场景中，常见的进入方向的端口匹配信息包括虚拟机端口对应的VXLAN网络标识(英文全称：VXLAN network identifier，缩写：VNI)与虚拟机端口对应的媒体访问控制(英文全称：media access control，缩写：MAC)地址，或VLAN标识(英文全称：VLAN identifier，缩写：VID)与虚拟机端口对应的MAC地址。也即VNI和MAC地址一起作为进入方向的端口匹配信息，或VID与MAC地址一起作为进入方向的端口匹配信息。实际上采用何种进入方向的端口匹配信息和外出方向的端口匹配信息根据流表的设计进行选择，端口匹配信息能够区分不同虚拟机端口。
可选的，每个端口匹配流表还包括所述安全组的优先级信息。
由于这M个虚拟机端口可以加入多个安全组，因此这M个虚拟机端口发出或接收的报文也可能成功匹配多个安全组，因此端口匹配流表包括的安全组的优先级信息可以在报文成功匹配多个安全组的情况下，采用优先级最高的安全组的动作流表中的报文动作处理该报文。
可选的，每个端口匹配流表还包括所述安全组的联结追踪信息，该联结追踪信息指示匹配成功端口匹配流表的报文属于新建会话。由于仅需要对新建会话的报文进行匹配，因此在端口匹配流表中加入联结追踪信息使得仅有新建会话的报文需要匹配第一匹配流表集。
步骤404，SDN控制器生成第二匹配流表集，所述安全组包括N条规则，所述第二匹配流表集包括所述N条规则对应的至少N个规则匹配流表，每条规则对 应至少一个规则匹配流表，每个规则匹配流表包括规则匹配信息和所述安全组的标识，所述N为大于0的整数。
SDN控制器生成所述第二匹配流表集，所述第二匹配流表集中的流表用于进行安全组的规则的匹配，也即确定报文能否匹配该安全组内的至少一条规则。
可选的，规则匹配流表中还可以包括所述安全组的优先级信息。
由于这M个虚拟机端口可以加入多个安全组，因此这M个虚拟机端口发出或接收的报文也可能成功匹配多个安全组，因此规则匹配流表包括的安全组的优先级信息可以在报文成功匹配多个安全组的情况下，采用优先级最高的安全组的动作流表中的报文动作处理该报文。
可选的，规则匹配流表中还可以包括所述安全组的方向信息。如果每条规则中包括了该条规则的方向信息，即该条规则用于限定外出方向的报文或进入方向的报文，则规则匹配流表中还需要包括方向信息。
SDN控制器根据该安全组的标识，根据该安全组的标识，访问预设的数据库获取该安全组所包括的N条规则。每条规则中包括以下一种或多种匹配条件，例如IPv4或IPv6、采用协议类型(例如传输控制协议(英文全称：transmission control protocol，缩写：TCP)、IP前缀等。SDN控制器根据这一种或多种匹配条件，生成规则匹配信息。一条规则可以生成多个规则匹配信息，因此一条规则也可以对应多个规则匹配流表。因此，第二匹配流表集中端口匹配流表的数量大于或等于N。
常见的，如果安全组内的一条规则包括匹配条件：remote_group安全组A，该匹配条件指示安全组A内的全部虚拟机端口能够匹配该规则。如果该规则为报文外出方向的规则，remote_group安全组A指示：目的虚拟机端口属于安全组A的报文匹配该规则。如果该规则为报文进入方向的规则，remote_group安全组A指示：源虚拟机端口属于安全组A的报文匹配该规则。
若虚拟机端口1(地址为192.168.10.1)虚拟机端口2(地址为192.168.10.2)均属于安全组A且该规则为报文外出方向的规则。那么该规则对应两条规则匹配流表，其规则匹配信息分别为nw_dst＝192.168.10.1与nw_dst＝192.168.10.2。如果有更多虚拟机端口属于安全组A，则安全组A对应的规则匹配流表的数量可能更多。
还有其他种类的规则可以对应多个规则匹配流表，例如指示连续的端口范围的匹配条件的规则，比如匹配条件中指定TCP端口为8000-8100，如果规则匹配信息中采用地址前缀与掩码的方式来描述该匹配条件，如tcp_dst＝0x1f40/0xff00，有可能一组地址前缀与掩码无法描述该匹配条件，因此会需要多个规则匹配信息来描述该匹配条件，也即该规则对应多个规则匹配流表。
可选的，所述每个端口匹配流表还包括第一连接标识，所述第一连接标识用于指示所述报文的安全组匹配包括两部分，在所述报文与所述第一匹配流表集中的任意一个端口匹配流表匹配时，所述报文的安全组匹配完成第一部分；
所述每个规则匹配流表还包括第二连接标识，所述第二连接标识用于指示所述报文的安全组匹配包括两部分，在所述报文与所述第二匹配流表集中的任意一个规则匹配流表匹配时，所述报文的安全组匹配完成第二部分。
由于本发明实施例中将安全组匹配拆分为两部分，分别通过第一匹配流表集和第二匹配流表集实现，因此需要通过连接标识来连接这两个部分。每个连接标识包括两个信息，当前属于第几个部分以及总共有几个部分。例如第一连接标识为“1/2”，指示当前属于第1个部分且总共有2个部分，第二连接标识为“2/2”，指示当前属于第2个部分且总共有2个部分。通过第一连接标识和第二连接标识，使得交换设备在对报文进行安全组匹配的过程中，能够确定该报文能否匹配拆分出来的每个部分的流表。
步骤406，SDN控制器生成所述安全组的动作流表，所述安全组的动作流表包括所述安全组的标识和报文动作，所述报文动作指示报文与所述安全组匹配成功后执行的操作，所述报文与所述安全组匹配成功包括：所述报文与所述第一匹配流表集中的任一端口匹配流表匹配且与所述第二匹配流表集中的任一规则匹配流表匹配。
报文与所述第一匹配流表集中的任一端口匹配流表匹配，即发出该报文的虚拟机端口的端口匹配信息或该报文的目的虚拟机端口的端口匹配信息，与所述第一匹配流表集中的至少一个端口匹配流表中的端口匹配信息匹配。报文与所述第二匹配流表集中的任一规则匹配流表匹配，即该报文采用的协议类型、IP信息等，与所述第二匹配流表集中的至少一个规则匹配流表中的规则匹配信息 匹配。
报文与所述第一匹配流表集中的任意一个端口匹配流表匹配，并且该报文与所述第二匹配流表集中的任意一个规则匹配流表匹配，则该报文与所述安全组匹配成功。
可选的，所述安全组的动作流表中还包括了方向信息。此种情况下，步骤406中SDN控制器生成的所述安全组的动作流表的数量为2，分别包括了报文外出方向的方向信息、所述安全组的标识、报文外出方向的报文动作，和报文进入方向的方向信息、所述安全组的标识、报文进入方向的报文动作。
需要说明的是，步骤402、404、406之间没有时序先后之分，步骤402、404、406可以按照任意顺序执行或并行执行。
步骤408，SDN控制器将所述第一匹配流表集，所述第二匹配流表集以及所述安全组的动作流表发送至交换设备。
SDN控制器将生成的所述第一匹配流表集，所述第二匹配流表集以及所述安全组的动作流表发送至交换设备，以供该交换设备接收到报文后能够按照上述流表的指示处理。该交换设备可以包括一个或多个虚拟交换机。
下面以图5为例介绍流表的构造，实际运用中的流表结构可以与图5所示的流表结构不同，各个字段的命名也可以按照需求自行设计，其中sgA指示安全组A。
报文外出方向：
端口匹配流表中的table＝$sg_egress_table为指示报文外出方向的方向信息。priority＝$sgA_priority为安全组A的优先级信息。in_port＝$vm1_port为外出方向的端口匹配信息，其指示vm1_port属于安全组A，因此vm1_port发出的报文能够匹配本条端口匹配流表。ct_state＝+trk+new为联结追踪信息，用于指示新建会话的报文才能匹配成功本端口匹配流表。actions＝conjunction($sgA_conj_id,1/2)中的$sgA_conj_id为安全组A的标识，1/2为第一连接标识。该action指示，如果报文匹配成功本端口匹配流表，则记录$sgA_conj_id与1/2。
rule1:egress，ipv4,22/tcp，remote_group:sgA为安全组A内的规则之一。其中，egress指示了该规则用于外出方向的报文，ipv4,22/tcp，remote_group:sgA为rule1 的匹配条件。Rule1对应的规则匹配流表中table$＝sg_egress_table，priority＝$sgA_priority两个字段与端口匹配流表类似，不再赘述。ip，nw_proto＝6，tcp_dst＝22，nw_dst＝$vm1_fixed_ip，为该规则匹配流表的规则匹配信息，匹配条件中的remote_group:sgA指示将安全组A关联的所有虚拟机端口的地址聚合以作为规则匹配信息，由于图5的示例中安全组A仅与VM1端口关联，因此规则匹配信息包括VM1端口的IP地址，即vm1_fixed_ip。actions＝conjunction($sgA_conj_id,2/2)中的2/2为第二连接标识。该action指示，如果报文匹配成功本规则匹配流表，则记录$sgA_conj_id与2/2。
报文外出方向的动作流表1中的conj_id＝$sgA_conj_id用于指示安全组A，如果交换设备处理报文时记录了$sgA_conj_id与1/2，并且记录了$sgA_conj_id与2/2，则说明报文匹配成功安全组A，通过conj_id＝$sgA_conj_id可以获取安全组A的动作流表，并根据actions＝ct(commit,zone＝NXM_NX_CT_ZONE[],table＝$next_process_table)处理该报文。报文外出方向的动作流表1中的action指示执行下一个流表，报文外出方向的动作流表2中的action指示报文从一个端口发出。实际中动作流表中的action指示的报文动作根据流表设计可以有多种，一般一个安全组设置有一个动作流表，匹配成功该安全组的报文均执行该动作流表中的报文动作。
报文进入方向：
主要参照前述报文外出方向的流表的介绍。主要区别包括，包括用于指示报文进入方向的方向信息table＝$sg_igress_table。同时，端口匹配流表中的端口匹配信息为前文所述的进入方向的端口匹配信息，也即tun_id＝2000，dl_mac＝11:22:33:44:55:66，两者分别为VNI和报文的目的虚拟机端口的MAC地址。
可选的，该流表处理方法还包括：SDN控制器接收到新虚拟机端口加入所述安全组的消息，所述新虚拟机端口为第M+1个加入所述安全组的虚拟机端口；SDN控制器生成所述新虚拟机端口对应的端口匹配流表。SDN控制器将所述新虚拟机端口对应的端口匹配流表发送至所述交换设备。
所述新虚拟机端口对应的端口匹配流表包括所述新虚拟机端口的端口匹配信息和所述安全组的标识。
SDN控制器内记录了历史虚拟机端口加入各个安全组的情况，如果SDN控 制器接收到新虚拟机端口加入安全组A的消息后，SDN控制器发现其记录了已经有历史虚拟机端口加入了安全组A，并且历史虚拟机端口加入安全组A时生成的端口匹配流表、规则匹配流表和安全组A的动作流表已经发送至所述交换设备，那么SDN控制器无须再生成安全组A的规则匹配流表和动作流表，仅需生成所述新虚拟机端口对应的端口匹配流表并发送至所述交换设备。
可选的，如果该安全组包括报文进入方向的规则和报文外出方向的规则且所述新虚拟机端口对应的端口匹配流表中还包括方向信息。此种情况下，SDN控制器生成的所述新虚拟机端口对应的端口匹配流表的数量为2，分别包括了报文外出方向的方向信息、所述安全组的标识、所述新虚拟机端口的报文外出方向的端口匹配信息，和报文进入方向的方向信息、所述安全组的标识、所述新虚拟机端口的报文进入方向的端口匹配信息。
通过采用本申请提供的流表处理方法，在有新虚拟机端口加入到安全组的场景下，流表生成以及的后续匹配过程都更加简单，并且可以采用数量较少的流表即可实现新虚拟机端口加入安全组，与现有技术需要生成至少N条流表相比，提升了SDN控制器的工作效率。
可选的，SDN控制器接收新规则加入所述安全组的消息，所述新规则为所述安全组的第N+1条规则；SDN控制器生成所述新规则对应的规则匹配流表；SDN控制器将所述新规则对应的规则匹配流表发送至所述交换设备。
所述新规则对应的规则匹配流表包括新规则匹配信息、所述安全组的标识，所述新规则匹配信息对应于所述新规则。
SDN控制器接收到将新规则加入安全组A的消息，由于安全组A的历史规则对应的规则匹配流表已经发送至所述交换设备，因此SDN控制器仅需生成所述新规则对应的规则匹配流表并发送至所述交换设备。由于所述新规则可以对应多个规则匹配信息，因此SDN控制器生成的所述新规则对应的规则匹配流表的数量大于或等于1。
通过采用本申请提供的流表处理方法，使得在有新规则加入到安全组的场景下，流表的生成以及后续匹配过程都更加简单，并且可以采用数量较少的流表即可实现新规则加入安全组，与现有技术需要生成至少M条流表相比，提升了 SDN控制器的工作效率。
以上提供的流表处理方法降低了用于实现报文的安全组匹配的流表的复杂程度，提升了用于实现报文的安全组匹配的流表的生成和使用效率，并且降低了虚拟机端口加入安全组的时SDN控制器需要生成的流表的数量，降低了SDN控制器的工作负担、SDN控制器与交换设备之间通信网络的传输负担。
本申请还提供了一种报文处理方法，图1a至图1c中部署了交换设备的节点运行时执行该方法，其流程示意图如图4所示。
步骤602，交换设备接收待处理报文。
步骤604，所述交换设备将所述待处理报文与安全组匹配信息进行匹配。
所述安全组匹配信息包括：第一匹配流表集、第二匹配流表集和安全组的动作流表，M个虚拟机端口加入所述安全组，所述安全组包括N条规则，所述M和N分别为大于0的整数，所述第一匹配流表集包括所述M个虚拟机端口对应的至少M个端口匹配流表，每个虚拟机端口对应至少一个端口匹配流表，每个端口匹配流表包括端口匹配信息和所述安全组的标识，所述第二匹配流表集包括所述N条规则对应的至少N个规则匹配流表，每条规则对应至少一个规则匹配流表，每个规则匹配流表包括规则匹配信息和所述安全组的标识，所述安全组的动作流表包括所述安全组的标识和报文动作，所述报文动作指示报文与所述安全组匹配成功后执行的操作，所述报文与所述安全组匹配成功包括：所述报文与所述第一匹配流表集中的任一端口匹配流表匹配且与所述第二匹配流表集中的任一规则匹配流表匹配。
所述安全组匹配信息包括步骤402至步骤406中及其各个可选方案中生成的所述第一匹配流表集、所述第二匹配流表集和所述安全组的动作流表。
该报文处理方法与图3所示的流表处理方法结合使用，执行该报文处理方法的节点与执行图3所示的流表处理方法的节点属于同一SDN。步骤602中的交换设备，接收图3所示的流表处理方法中SDN控制器生成的第一匹配流表集和第二匹配流表集和安全组的动作流表，其实施细节及各种可选的流表内容参考图3对应的流表处理方法。
可选的，参考图3所示的流表处理方法，每个端口匹配流表还包括第一连接标识，每个规则匹配流表还包括第二连接标识。
交换设备获取了待处理报文后，确定待处理报文与第一匹配流表集中的任意一个端口匹配流表匹配后，记录该安全组的标识与该第一连接标识，如图5所示的端口匹配流表中的$sgA_conj_id与1/2。交换设备确定待处理报文与第二匹配流表集中的任意一个规则匹配流表匹配后，记录该安全组的标识与该第二连接标识，如图5所示的规则匹配流表中的$sgA_conj_id与2/2。
交换设备根据记录的$sgA_conj_id与1/2、$sgA_conj_id与2/2确定待处理报文与安全组A匹配成功。
本发明实施例中将安全组的匹配拆分为两部分，拆分出来的端口匹配流表和规则匹配流表中都只有单个匹配域，因此交换设备在将所述待处理报文与安全组匹配信息的匹配过程也较为简单。同时，现有技术中需要匹配M*N个流表相比，本发明实施例中需要匹配的流表数量为M+N或2M+N，降低了需要匹配的流表的数量，减轻了交换设备的工作负担，提升了待处理报文匹配安全组的速度。
可选的，第一匹配流表集中的每个端口匹配流表还包括方向信息。报文外出方向的端口匹配信息可以为虚拟机端口的标识，交换设备接收到外出方向的待处理报文后，获取交换设备接收该外出方向的待处理报文的虚拟机端口的标识，用于与外出方向端口匹配流表匹配。以报文进入方向的端口匹配信息为VNI和MAC地址为例，交换设备接收到进入方向的待处理报文后，根据报文中携带的信息，获取该报文的目的虚拟机端口的VNI和MAC地址，用于与进入方向端口匹配流表匹配。
待处理报文中还会携带其采用的协议类型、目的IP地址等信息，交换设备根据这些信息，与规则匹配流表中的规则匹配信息进行匹配。
步骤606，所述交换设备在所述待处理报文与所述安全组匹配成功后，所述交换设备按照所述报文动作处理所述待处理报文。
可选的，所述交换设备在执行步骤602之前，还接收所述安全组匹配信息。该安全组匹配信息由SDN控制器发送至所述交换设备，所述交换设备可以接收 一次安全组匹配信息后，执行多次步骤602至步骤606。
交换设备确定了待处理报文与安全组A匹配成功后，通过安全组的标识$sgA_conj_id获取该安全组的动作流表，也即包括conj_id＝$sgA_conj_id的动作流表，并按照该动作流表中的报文动作处理该待处理报文。
可选的，所述安全组的动作流表中还包括了方向信息。此种情况下，步骤602中接收到的所述安全组的动作流表的数量为2，分别包括了报文外出方向的方向信息、所述安全组的标识、报文外出方向的报文动作，和报文进入方向的方向信息、所述安全组的标识、报文进入方向的报文动作。交换设备确定待处理报文与安全组A匹配成功后，如果该待处理报文为外出方向，则根据所述报文外出方向的报文动作处理该待处理报文，如果该待处理报文为进入方向，则根据所述报文进入方向的报文动作处理该待处理报文。
以上提供的报文处理方法中，交换设备通过第一匹配流表集、第二匹配流表集实现报文的安全组匹配，并通过动作流表实现匹配成功该安全组的报文动作，降低了安全组匹配过程的复杂程度，并且降低了交换设备处理待处理报文时需要匹配的流表的数量，提升了交换设备的工作效率。
本申请还提供了流表处理装置800，该装置可以作为SDN架构中的网络节点。该装置可以通过图2所示的计算设备200实现，还可以通过专用集成电路(英文：application-specific integrated circuit，缩写：ASIC)实现，或可编程逻辑器件(英文：programmable logic device，缩写：PLD)实现。上述PLD可以是复杂可编程逻辑器件(英文：complex programmable logic device，缩写：CPLD)，FPGA，通用阵列逻辑(英文：generic array logic,缩写：GAL)或其任意组合。该流表处理装置800用于实现图3所示的流表处理方法。通过软件实现图3所示的流表处理方法时，流表处理装置800及其各个模块也可以为软件模块，例如实现SDN控制器的软件模块。
流表处理装置800的组织结构示意图如图6所示，包括：生成模块802和发送模块804。生成模块802工作时，执行图3所示流表处理方法中的步骤402、步骤404以及步骤406及其各种可选方案，发送模块804工作时，执行图3所示的流表处理 方法中的步骤408。
以上提供的流表处理装置降低了用于实现报文的安全组匹配的流表的复杂程度，提升了用于实现报文的安全组匹配的流表的生成和使用效率，并且降低了虚拟机端口加入安全组的时SDN控制器需要生成的流表的数量，降低了流表处理装置的工作负担、流表处理装置与交换设备之间通信网络的传输负担。
本发明实施例还提供了报文处理装置1000，该装置可以作为SDN架构中的计算节点。该装置可以通过图4所示的计算设备200实现，还可以通过ASIC实现，或PLD实现。上述PLD可以是复杂可编程CPLD，FPGA，GAL或其任意组合。该报文处理装置1000用于实现图8所示的镜像部署方法。通过软件实现图4所示的报文处理方法时，报文处理装置1000及其各个模块也可以为软件模块，例如实现虚拟交换机的软件模块。
报文处理装置1000的组织结构示意图如图7所示，包括：接收模块1002和处理模块1004。接收模块1002工作时，执行图4所示的报文处理方法中的步骤602及步骤602之前的获取安全组匹配信息的动作，处理模块1004工作时，执行图4所示的报文处理方法中的步骤604和步骤606。
以上提供的报文处理装置通过第一匹配流表集、第二匹配流表集实现报文的安全组匹配，并通过动作流表实现匹配成功该安全组的报文动作，降低了安全组匹配过程的复杂程度，并且降低了交换设备处理待处理报文时需要匹配的流表的数量，提升了交换设备的工作效率。
在上述实施例中，对各个实施例的描述都各有侧重，某个实施例中没有详述的部分，可以参见其他实施例的相关描述。图3所示的流表处理方法的实现细节，可以用于流表处理装置800。图4所示的报文处理方法的实现细节，可以用于报文处理装置1000。
结合本申请公开内容所描述的方法可以由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于RAM、快闪存储器、ROM、可擦除可编程只读存储器(英文：erasable programmable read only  memory，缩写：EPROM)、电可擦可编程只读存储器(英文：electrically erasable programmable read only memory，缩写：EEPROM)、硬盘、光盘或者本领域熟知的任何其它形式的存储介质中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请所描述的功能可以用硬件或软件来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述的具体实施方式，对本申请的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本申请的具体实施方式而已，并不用于限定本申请的保护范围，凡在本申请的技术方案的基础之上，所做的任何修改、改进等，均应包括在本申请的保护范围之内。

Claims (18)

  1. 一种流表处理方法，其特征在于，包括：
    软件定义网络SDN控制器生成安全组的第一匹配流表集，M个虚拟机端口加入所述安全组，所述第一匹配流表集包括所述M个虚拟机端口对应的至少M个端口匹配流表，每个虚拟机端口对应至少一个端口匹配流表，每个端口匹配流表包括端口匹配信息和所述安全组的标识，所述M为大于0的整数；
    所述SDN控制器生成第二匹配流表集，所述安全组包括N条规则，所述第二匹配流表集包括所述N条规则对应的至少N个规则匹配流表，每条规则对应至少一个规则匹配流表，每个规则匹配流表包括规则匹配信息和所述安全组的标识，所述N为大于0的整数；
    所述SDN控制器生成所述安全组的动作流表，所述安全组的动作流表包括所述安全组的标识和报文动作，所述报文动作指示报文与所述安全组匹配成功后执行的操作，所述报文与所述安全组匹配成功包括：所述报文与所述第一匹配流表集中的任一端口匹配流表匹配且与所述第二匹配流表集中的任一规则匹配流表匹配；
    所述SDN控制器将所述第一匹配流表集，所述第二匹配流表集以及所述安全组的动作流表发送至交换设备。
  2. 如权利要求1所述的流表处理方法，其特征在于，所述每个端口匹配流表还包括第一连接标识，所述第一连接标识用于指示所述报文的安全组匹配包括两部分，在所述报文与所述第一匹配流表集中的任意一个端口匹配流表匹配时，所述报文的安全组匹配完成第一部分；
    所述每个规则匹配流表还包括第二连接标识，所述第二连接标识用于指示所述报文的安全组匹配包括两部分，在所述报文与所述第二匹配流表集中的任意一个规则匹配流表匹配时，所述报文的安全组匹配完成第二部分。
  3. 如权利要求1或2所述的流表处理方法，其特征在于，所述SDN控制器生成安全组的第一匹配流表集包括：
    所述SDN控制器根据获取到的所述M个虚拟机端口加入所述安全组的消息，分别生成所述每个端口匹配流表。
  4. 如权利要求1或2或3所述的流表处理方法，其特征在于，还包括：
    所述SDN控制器接收到新虚拟机端口加入所述安全组的消息，所述新虚拟机端口为第M+1个加入所述安全组的虚拟机端口；
    所述SDN控制器生成所述新虚拟机端口对应的端口匹配流表；
    所述SDN控制器将所述新虚拟机端口对应的端口匹配流表发送至所述交换设备。
  5. 如权利要求1或2或3所述的流表处理方法，其特征在于，还包括：
    所述SDN控制器接收新规则加入所述安全组的消息，所述新规则为所述安全组的第N+1条规则；
    所述SDN控制器生成所述新规则对应的规则匹配流表；
    所述SDN控制器将所述新规则对应的规则匹配流表发送至所述交换设备。
  6. 一种报文处理方法，其特征在于，包括：
    交换设备接收待处理报文；
    所述交换设备将所述待处理报文与安全组匹配信息进行匹配，所述安全组匹配信息包括：第一匹配流表集、第二匹配流表集和安全组的动作流表，M个虚拟机端口加入所述安全组，所述安全组包括N条规则，所述M和N分别为大于0的整数，所述第一匹配流表集包括所述M个虚拟机端口对应的至少M个端口匹配流表，每个虚拟机端口对应至少一个端口匹配流表，每个端口匹配流表包括端口匹配信息和所述安全组的标识，所述第二匹配流表集包括所述N条规则对应的至少N个规则匹配流表，每条规则对应至少一个规则匹配流表，每个规则匹配流表包括规则匹配信息和所述安全组的标识，所述安全组的动作流表包括所述安全组的标识和报文动作，所述报文动作指示报文与所述安全组匹配成功后执行的操作，所述报文与所述安全组匹配成功包括：所述报文与所述第一匹配流表集中的任一端口匹配流表匹配且与所述第二匹配流表集中的任一规则匹配流表匹配；
    在所述待处理报文与所述安全组匹配成功后，所述交换设备按照所述报文 动作处理所述待处理报文。
  7. 如权利要求6所述的报文处理方法，其特征在于，所述交换设备接收待处理报文之前，所述方法还包括：接收所述安全组匹配信息。
  8. 如权利要求6或7所述的报文处理方法，其特征在于，所述每个端口匹配流表还包括第一连接标识，所述第一连接标识用于指示所述报文的安全组匹配包括两部分，在所述报文与所述第一匹配流表集中的任意一个端口匹配流表匹配时，所述报文的安全组匹配完成第一部分；所述每个规则匹配流表还包括第二连接标识，所述第二连接标识用于指示所述报文的安全组匹配包括两部分，在所述报文与所述第二匹配流表集中的任意一个规则匹配流表匹配时，所述报文的安全组匹配完成第二部分；
    所述交换设备将所述待处理报文与安全组匹配信息进行匹配，在所述待处理报文与所述安全组匹配成功后，所述交换设备按照所述报文动作处理所述待处理报文，包括：
    所述交换设备将所述待处理报文与所述第一匹配流表集中的流表进行匹配，确定所述待处理报文与所述第一匹配流表集中的任意一个端口匹配流表匹配成功，记录所述第一连接标识；
    所述交换设备确定所述待处理报文与所述第二匹配流表集中的流表进行匹配，确定所述待处理报文与所述第二匹配流表集中的任意一个规则匹配流表匹配成功，记录所述第二连接标识；
    所述交换设备根据记录的所述第一连接标识与所述第二连接标识，按照所述报文动作处理所述待处理报文。
  9. 一种流表处理装置，其特征在于，包括：
    生成模块，用于生成安全组的第一匹配流表集，M个虚拟机端口加入所述安全组，所述第一匹配流表集包括所述M个虚拟机端口对应的至少M个端口匹配流表，每个虚拟机端口对应至少一个端口匹配流表，每个端口匹配流表包括端口匹配信息和所述安全组的标识，所述M为大于0的整数；还用于生成第二匹配流表集，所述安全组包括N条规则，所述第二匹配流表集包括所述N条规则对应 的至少N个规则匹配流表，每条规则对应至少一个规则匹配流表，每个规则匹配流表包括规则匹配信息和所述安全组的标识，所述N为大于0的整数；还用于生成所述安全组的动作流表，所述安全组的动作流表包括所述安全组的标识和报文动作，所述报文动作指示报文与所述安全组匹配成功后执行的操作，所述报文与所述安全组匹配成功包括：所述报文与所述第一匹配流表集中的任一端口匹配流表匹配且与所述第二匹配流表集中的任一规则匹配流表匹配；
    发送模块，用于将所述第一匹配流表集，所述第二匹配流表集以及所述安全组的动作流表发送至交换设备。
  10. 如权利要求9所述的流表处理装置，其特征在于，所述每个端口匹配流表还包括第一连接标识，所述第一连接标识用于指示所述报文的安全组匹配包括两部分，在所述报文与所述第一匹配流表集中的任意一个端口匹配流表匹配时，所述报文的安全组匹配完成第一部分；
    所述每个规则匹配流表还包括第二连接标识，所述第二连接标识用于指示所述报文的安全组匹配包括两部分，在所述报文与所述第二匹配流表集中的任意一个规则匹配流表匹配时，所述报文的安全组匹配完成第二部分。
  11. 如权利要求9或10所述的流表处理装置，其特征在于，所述生成模块生成安全组的第一匹配流表集包括：根据获取到的所述M个虚拟机端口加入所述安全组的消息，分别生成所述每个端口匹配流表。
  12. 如权利要求9或10或11所述的流表处理装置，其特征在于，所述生成模块，还用于接收到新虚拟机端口加入所述安全组的消息，所述新虚拟机端口为第M+1个加入所述安全组的虚拟机端口；还用于生成所述新虚拟机端口对应的端口匹配流表；
    所述发送模块，还用于将所述新虚拟机端口对应的端口匹配流表发送至所述交换设备。
  13. 如权利要求9或10或11所述的流表处理装置，其特征在于，所述生成模块，还用于接收新规则加入所述安全组的消息，所述新规则为所述安全组的第N+1条规则；还用于生成所述新规则对应的规则匹配流表；
    所述发送模块，还用于将所述新规则对应的规则匹配流表发送至所述交换 设备。
  14. 一种报文处理装置，其特征在于，包括：
    接收模块，用于接收待处理报文；
    处理模块，用于将所述待处理报文与安全组匹配信息进行匹配，所述安全组匹配信息包括：第一匹配流表集、第二匹配流表集和安全组的动作流表，M个虚拟机端口加入所述安全组，所述安全组包括N条规则，所述M和N分别为大于0的整数，所述第一匹配流表集包括所述M个虚拟机端口对应的至少M个端口匹配流表，每个虚拟机端口对应至少一个端口匹配流表，每个端口匹配流表包括端口匹配信息和所述安全组的标识，所述第二匹配流表集包括所述N条规则对应的至少N个规则匹配流表，每条规则对应至少一个规则匹配流表，每个规则匹配流表包括规则匹配信息和所述安全组的标识，所述安全组的动作流表包括所述安全组的标识和报文动作，所述报文动作指示报文与所述安全组匹配成功后执行的操作，所述报文与所述安全组匹配成功包括：所述报文与所述第一匹配流表集中的任一端口匹配流表匹配且与所述第二匹配流表集中的任一规则匹配流表匹配；还用于在所述待处理报文与所述安全组匹配成功后，所述交换设备按照所述动作流表包括的报文动作处理所述待处理报文。
  15. 如权利要求14所述的报文处理装置，其特征在于，所述接收模块，还用于接收所述安全组匹配信息。
  16. 如权利要求14或15所述的报文处理装置，其特征在于，所述每个端口匹配流表还包括第一连接标识，所述第一连接标识用于指示所述报文的安全组匹配包括两部分，在所述报文与所述第一匹配流表集中的任意一个端口匹配流表匹配时，所述报文的安全组匹配完成第一部分；所述每个规则匹配流表还包括第二连接标识，所述第二连接标识用于指示所述报文的安全组匹配包括两部分，在所述报文与所述第二匹配流表集中的任意一个规则匹配流表匹配时，所述报文的安全组匹配完成第二部分；
    所述处理模块，用于将所述待处理报文与所述第一匹配流表集中的流表进行匹配，确定所述待处理报文与所述第一匹配流表集中的任意一个端口匹配流 表匹配成功，记录所述第一连接标识；还用于确定所述待处理报文与所述第二匹配流表集中的流表进行匹配，确定所述待处理报文与所述第二匹配流表集中的任意一个规则匹配流表匹配成功，记录所述第二连接标识；还用于根据记录的所述第一连接标识与所述第二连接标识，按照所述报文动作处理所述待处理报文。
  17. 一种计算设备，其特征在于，包括处理器、存储器，所述处理器与所述存储器建立通信连接；
    所述处理器用于读取所述存储器中的程序执行如权利要求1至5任一项所述的流表处理方法。
  18. 一种计算设备，其特征在于，包括处理器、存储器，所述处理器与所述存储器建立通信连接；
    所述处理器用于读取所述存储器中的程序执行如权利要求6或7或8所述的报文处理方法。
PCT/CN2016/075982 2016-03-09 2016-03-09 流表处理方法及装置 WO2017152396A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
PCT/CN2016/075982 WO2017152396A1 (zh) 2016-03-09 2016-03-09 流表处理方法及装置
EP18203905.7A EP3522460B1 (en) 2016-03-09 2016-03-09 Flow table processing method and apparatus
CN201680068616.XA CN108293019B (zh) 2016-03-09 2016-03-09 流表处理方法及装置
EP16856471.4A EP3249862B1 (en) 2016-03-09 2016-03-09 Flow table processing method and device
US16/125,330 US10715492B2 (en) 2016-03-09 2018-09-07 Flow table processing method and apparatus

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2016/075982 WO2017152396A1 (zh) 2016-03-09 2016-03-09 流表处理方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/125,330 Continuation US10715492B2 (en) 2016-03-09 2018-09-07 Flow table processing method and apparatus

Publications (1)

Publication Number Publication Date
WO2017152396A1 true WO2017152396A1 (zh) 2017-09-14

Family

ID=59788967

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/075982 WO2017152396A1 (zh) 2016-03-09 2016-03-09 流表处理方法及装置

Country Status (4)

Country Link
US (1) US10715492B2 (zh)
EP (2) EP3249862B1 (zh)
CN (1) CN108293019B (zh)
WO (1) WO2017152396A1 (zh)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108306822A (zh) * 2018-01-08 2018-07-20 国网江苏省电力有限公司 一种适用于软件定义网络的流表合并方法
CN110300060A (zh) * 2018-03-23 2019-10-01 北京京东尚科信息技术有限公司 用于软件定义网络的通信方法和装置
CN111586025A (zh) * 2020-04-30 2020-08-25 广州市品高软件股份有限公司 一种基于sdn的sdp安全组实现方法及安全系统
US11405426B2 (en) * 2019-11-04 2022-08-02 Salesforce.Com, Inc. Comparing network security specifications for a network to implement a network security policy for the network

Families Citing this family (48)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10749711B2 (en) 2013-07-10 2020-08-18 Nicira, Inc. Network-link method useful for a last-mile connectivity in an edge-gateway multipath system
US10454714B2 (en) 2013-07-10 2019-10-22 Nicira, Inc. Method and system of overlay flow control
US10135789B2 (en) 2015-04-13 2018-11-20 Nicira, Inc. Method and system of establishing a virtual private network in a cloud service for branch networking
US10498652B2 (en) 2015-04-13 2019-12-03 Nicira, Inc. Method and system of application-aware routing with crowdsourcing
US10425382B2 (en) 2015-04-13 2019-09-24 Nicira, Inc. Method and system of a cloud-based multipath routing protocol
US10506037B2 (en) * 2016-12-13 2019-12-10 Alcatel Lucent Discovery of ingress provider edge devices in egress peering networks
US20200036624A1 (en) 2017-01-31 2020-01-30 The Mode Group High performance software-defined core network
US11121962B2 (en) 2017-01-31 2021-09-14 Vmware, Inc. High performance software-defined core network
US11252079B2 (en) 2017-01-31 2022-02-15 Vmware, Inc. High performance software-defined core network
US20180219765A1 (en) 2017-01-31 2018-08-02 Waltz Networks Method and Apparatus for Network Traffic Control Optimization
US11706127B2 (en) 2017-01-31 2023-07-18 Vmware, Inc. High performance software-defined core network
US10992568B2 (en) 2017-01-31 2021-04-27 Vmware, Inc. High performance software-defined core network
US10992558B1 (en) 2017-11-06 2021-04-27 Vmware, Inc. Method and apparatus for distributed data network traffic optimization
US10778528B2 (en) 2017-02-11 2020-09-15 Nicira, Inc. Method and system of connecting to a multipath hub in a cluster
US10523539B2 (en) 2017-06-22 2019-12-31 Nicira, Inc. Method and system of resiliency in cloud-delivered SD-WAN
US11089111B2 (en) 2017-10-02 2021-08-10 Vmware, Inc. Layer four optimization for a virtual network defined over public cloud
US10608844B2 (en) 2017-10-02 2020-03-31 Vmware, Inc. Graph based routing through multiple public clouds
US10999100B2 (en) 2017-10-02 2021-05-04 Vmware, Inc. Identifying multiple nodes in a virtual network defined over a set of public clouds to connect to an external SAAS provider
US10959098B2 (en) 2017-10-02 2021-03-23 Vmware, Inc. Dynamically specifying multiple public cloud edge nodes to connect to an external multi-computer node
US11115480B2 (en) 2017-10-02 2021-09-07 Vmware, Inc. Layer four optimization for a virtual network defined over public cloud
US10999165B2 (en) 2017-10-02 2021-05-04 Vmware, Inc. Three tiers of SaaS providers for deploying compute and network infrastructure in the public cloud
US11223514B2 (en) 2017-11-09 2022-01-11 Nicira, Inc. Method and system of a dynamic high-availability mode based on current wide area network connectivity
US10476699B2 (en) * 2018-01-31 2019-11-12 Hewlett Packard Enterprise Development Lp VLAN to VXLAN translation using VLAN-aware virtual machines
US11121985B2 (en) 2019-08-27 2021-09-14 Vmware, Inc. Defining different public cloud virtual networks for different entities based on different sets of measurements
US11611507B2 (en) 2019-10-28 2023-03-21 Vmware, Inc. Managing forwarding elements at edge nodes connected to a virtual network
US11489783B2 (en) 2019-12-12 2022-11-01 Vmware, Inc. Performing deep packet inspection in a software defined wide area network
US11394640B2 (en) 2019-12-12 2022-07-19 Vmware, Inc. Collecting and analyzing data regarding flows associated with DPI parameters
CN111131071A (zh) * 2019-12-19 2020-05-08 紫光云技术有限公司 基于OpenStack实现云主机安全组规则优先级的实现方法及系统
CN111031056B (zh) * 2019-12-20 2021-10-12 紫光云(南京)数字技术有限公司 一种在安全组中实现安全域功能的方法
US11438789B2 (en) 2020-01-24 2022-09-06 Vmware, Inc. Computing and using different path quality metrics for different service classes
US11477127B2 (en) 2020-07-02 2022-10-18 Vmware, Inc. Methods and apparatus for application aware hub clustering techniques for a hyper scale SD-WAN
US11363124B2 (en) 2020-07-30 2022-06-14 Vmware, Inc. Zero copy socket splicing
US11575591B2 (en) 2020-11-17 2023-02-07 Vmware, Inc. Autonomous distributed forwarding plane traceability based anomaly detection in application traffic for hyper-scale SD-WAN
US11575600B2 (en) 2020-11-24 2023-02-07 Vmware, Inc. Tunnel-less SD-WAN
US11601356B2 (en) 2020-12-29 2023-03-07 Vmware, Inc. Emulating packet flows to assess network links for SD-WAN
US11792127B2 (en) 2021-01-18 2023-10-17 Vmware, Inc. Network-aware load balancing
US11979325B2 (en) 2021-01-28 2024-05-07 VMware LLC Dynamic SD-WAN hub cluster scaling with machine learning
US11637768B2 (en) 2021-05-03 2023-04-25 Vmware, Inc. On demand routing mesh for routing packets through SD-WAN edge forwarding nodes in an SD-WAN
US12009987B2 (en) 2021-05-03 2024-06-11 VMware LLC Methods to support dynamic transit paths through hub clustering across branches in SD-WAN
US11729065B2 (en) 2021-05-06 2023-08-15 Vmware, Inc. Methods for application defined virtual network service among multiple transport in SD-WAN
CN113347100B (zh) * 2021-05-31 2022-06-17 平安科技（深圳）有限公司 数据流传输方法、装置、计算机设备及存储介质
US12015536B2 (en) 2021-06-18 2024-06-18 VMware LLC Method and apparatus for deploying tenant deployable elements across public clouds based on harvested performance metrics of types of resource elements in the public clouds
US11489720B1 (en) 2021-06-18 2022-11-01 Vmware, Inc. Method and apparatus to evaluate resource elements and public clouds for deploying tenant deployable elements based on harvested performance metrics
US11375005B1 (en) 2021-07-24 2022-06-28 Vmware, Inc. High availability solutions for a secure access service edge application
US11943146B2 (en) 2021-10-01 2024-03-26 VMware LLC Traffic prioritization in SD-WAN
US11909815B2 (en) 2022-06-06 2024-02-20 VMware LLC Routing based on geolocation costs
CN116015827B (zh) * 2022-12-15 2024-06-04 北京秒如科技有限公司 一种实现安全组流表最小化的方法
CN116074250B (zh) * 2023-02-23 2023-08-22 阿里巴巴（中国）有限公司 流表处理方法、系统、设备和存储介质

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103164647A (zh) * 2013-02-28 2013-06-19 华为技术有限公司 一种网络安全组的访问控制方法和安全计算机
CN103581183A (zh) * 2013-10-30 2014-02-12 华为技术有限公司 一种虚拟化安全隔离方法与装置
CN104007997A (zh) * 2013-02-22 2014-08-27 中兴通讯股份有限公司 虚拟机安全组的配置方法及装置
CN104394080A (zh) * 2014-11-28 2015-03-04 杭州华三通信技术有限公司 实现安全组功能的方法及装置
CN104580027A (zh) * 2013-10-25 2015-04-29 杭州华三通信技术有限公司 一种OpenFlow报文转发方法及设备
US20150150087A1 (en) * 2013-11-27 2015-05-28 Vmware, Inc. Dynamic expression evaluation based grouping of vm objects for networking and security services in a virtualized computing system

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP3821086B2 (ja) * 2002-11-01 2006-09-13 ソニー株式会社 ストリーミングシステム及びストリーミング方法、クライアント端末及びデータ復号方法、並びにプログラム
JP6268943B2 (ja) * 2013-11-06 2018-01-31 富士通株式会社 情報処理システム，スイッチ装置及び情報処理システムの制御方法
US9912582B2 (en) * 2013-11-18 2018-03-06 Telefonaktiebolaget Lm Ericsson (Publ) Multi-tenant isolation in a cloud environment using software defined networking
US9705923B2 (en) * 2014-09-02 2017-07-11 Symantec Corporation Method and apparatus for automating security provisioning of workloads

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104007997A (zh) * 2013-02-22 2014-08-27 中兴通讯股份有限公司 虚拟机安全组的配置方法及装置
CN103164647A (zh) * 2013-02-28 2013-06-19 华为技术有限公司 一种网络安全组的访问控制方法和安全计算机
CN104580027A (zh) * 2013-10-25 2015-04-29 杭州华三通信技术有限公司 一种OpenFlow报文转发方法及设备
CN103581183A (zh) * 2013-10-30 2014-02-12 华为技术有限公司 一种虚拟化安全隔离方法与装置
US20150150087A1 (en) * 2013-11-27 2015-05-28 Vmware, Inc. Dynamic expression evaluation based grouping of vm objects for networking and security services in a virtualized computing system
CN104394080A (zh) * 2014-11-28 2015-03-04 杭州华三通信技术有限公司 实现安全组功能的方法及装置

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108306822A (zh) * 2018-01-08 2018-07-20 国网江苏省电力有限公司 一种适用于软件定义网络的流表合并方法
CN110300060A (zh) * 2018-03-23 2019-10-01 北京京东尚科信息技术有限公司 用于软件定义网络的通信方法和装置
CN110300060B (zh) * 2018-03-23 2022-06-07 北京京东尚科信息技术有限公司 用于软件定义网络的通信方法和装置
US11405426B2 (en) * 2019-11-04 2022-08-02 Salesforce.Com, Inc. Comparing network security specifications for a network to implement a network security policy for the network
US11716358B2 (en) 2019-11-04 2023-08-01 Salesforce, Inc. Comparing network security specifications for a network
CN111586025A (zh) * 2020-04-30 2020-08-25 广州市品高软件股份有限公司 一种基于sdn的sdp安全组实现方法及安全系统
CN111586025B (zh) * 2020-04-30 2021-03-23 广州市品高软件股份有限公司 一种基于sdn的sdp安全组实现方法及安全系统

Also Published As

Publication number Publication date
EP3522460B1 (en) 2021-12-01
EP3249862A1 (en) 2017-11-29
CN108293019A (zh) 2018-07-17
EP3522460A1 (en) 2019-08-07
EP3249862B1 (en) 2019-01-09
US10715492B2 (en) 2020-07-14
US20190020627A1 (en) 2019-01-17
EP3249862A4 (en) 2018-02-28
CN108293019B (zh) 2020-06-02

Similar Documents

Publication Publication Date Title
WO2017152396A1 (zh) 流表处理方法及装置
US10116559B2 (en) Operations, administration and management (OAM) in overlay data center environments
CN113132201B (zh) 一种vpc之间的通信方法及装置
EP3611883A1 (en) Secure forwarding of tenant workloads in virtual networks
US10389542B2 (en) Multicast helper to link virtual extensible LANs
CN103580980B (zh) 虚拟网络自动发现和自动配置的方法及其装置
WO2018023499A1 (zh) 网络接口卡、计算设备以及数据包处理方法
US10091102B2 (en) Tunnel sub-interface using IP header field
CN110838992B (zh) 在不同网络堆栈中的内核模块间传送分组的系统和方法
EP3883217A1 (en) Data transmission method and computer system
US11936613B2 (en) Port and loopback IP addresses allocation scheme for full-mesh communications with transparent TLS tunnels
CN112671938B (zh) 业务服务提供方法及系统、远端加速网关
US9716688B1 (en) VPN for containers and virtual machines in local area networks
EP3944568A1 (en) Generating route distinguishers for virtual private network addresses based on physical hardware addresses
US20230254183A1 (en) Generating route target values for virtual private network routes
EP4199596A1 (en) Routing information transmission method and apparatus
CN115002029A (zh) 一种流量转发方法、装置、设备及存储介质
US9548964B1 (en) VPN for containers and virtual machines in local area networks
Tulloch et al. Microsoft System Center-Network Virtualization and Cloud Computing
CN115150326B (zh) 为虚拟专用网络路由生成路由目标值
Ramesh Securing VXLAN-based overlay network using SSH tunnel

Legal Events

Date Code Title Description
REEP Request for entry into the european phase

Ref document number: 2016856471

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE