WO2019127134A1 - 一种数据传送的方法和虚拟交换机 - Google Patents

一种数据传送的方法和虚拟交换机 Download PDF

Info

Publication number
WO2019127134A1
WO2019127134A1 PCT/CN2017/119103 CN2017119103W WO2019127134A1 WO 2019127134 A1 WO2019127134 A1 WO 2019127134A1 CN 2017119103 W CN2017119103 W CN 2017119103W WO 2019127134 A1 WO2019127134 A1 WO 2019127134A1
Authority
WO
WIPO (PCT)
Prior art keywords
data packet
virtual switch
data
security verification
feature information
Prior art date
Application number
PCT/CN2017/119103
Other languages
English (en)
French (fr)
Inventor
黄靖
徐聪
陈帅
徐跃飞
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN201780040463.2A priority Critical patent/CN109496409B/zh
Priority to EP17936903.8A priority patent/EP3720075B1/en
Priority to PCT/CN2017/119103 priority patent/WO2019127134A1/zh
Publication of WO2019127134A1 publication Critical patent/WO2019127134A1/zh
Priority to US16/910,954 priority patent/US11689501B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4604—LAN interconnection over a backbone network, e.g. Internet, Frame Relay
    • H04L12/462—LAN interconnection over a bridge based backbone
    • H04L12/4625—Single bridge functionality, e.g. connection of two networks over a single bridge
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0245—Filtering by information in the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4604—LAN interconnection over a backbone network, e.g. Internet, Frame Relay
    • H04L12/462—LAN interconnection over a bridge based backbone
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/58—Association of routers
    • H04L45/586—Association of routers of virtual routers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/31—Flow control; Congestion control by tagging of packets, e.g. using discard eligibility [DE] bits
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00—Packet switching elements
    • H04L49/70—Virtual switches
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/166—Implementing security features at a particular protocol layer at the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers

Definitions

  • the present invention relates to the field of information technology, and in particular, to a data transmission method and a virtual switch.
  • Network security verification of data streams can be achieved by configuring IPTABLES rules in the Linux bridge.
  • IPTABLES rules As shown in FIG. 1, when the first virtual machine 100 sends a data stream to the second virtual machine 130, the data stream first enters the Linux bridge 110 before being forwarded by the virtual switch 120, and is in the Linux bridge 110.
  • the data stream that passes the security verification in the Linux bridge 110 is imported into the virtual switch for traffic forwarding, and the data stream that has not passed the security verification is discarded in the Linux bridge 110.
  • the IPTABELS rules configured in the Linux bridge can implement rich network security functions. However, in order to consider compatibility and rich functions, some implementations of security verification may result in a decline in data forwarding performance. At the same time, since the security verification in the Linux bridge is performed in the kernel mode, and the virtual switch forwards the data stream in the user mode, the process of forwarding the data through the virtual machine switch must pass through the kernel state to the user state. Switch. Switching from kernel mode to user mode can cause cache pollution, which further leads to a decrease in data stream forwarding efficiency.
  • the present invention provides a data transmission method and a virtual switch.
  • part of the data packet can bypass the security verification module and be directly forwarded by the virtual switch, thereby reducing the data message in the user state and the kernel during the data stream forwarding process.
  • the number of times of switching between states improves the efficiency of the virtual switch to forward data streams.
  • a first aspect of the present invention provides a data transmission method, the method comprising: receiving, by a virtual switch, a first data packet, and extracting feature information of the first data packet, according to the extracted feature information of the first data packet And determining whether the data flow to which the first data packet belongs is configured with an accelerated forwarding rule.
  • the accelerated forwarding rule indicates that the second data packet in the data flow to which the first data packet belongs has been verified by the security verification module and the verification result is secure. If the data flow to which the first data packet belongs is configured with an accelerated forwarding rule, the virtual switch bypasses the security verification module and sends the first data packet to the receiving end.
  • the security verification module includes, but is not limited to, a Linux bridge, for verifying whether the first data packet is secure.
  • the sending end when the sending end sends a data packet to the receiving end, the data packet whose data stream is configured with the accelerated forwarding rule can bypass the security verification module, and is directly forwarded by the virtual switch without security verification.
  • the number of times of switching between the kernel state and the user state of the data packet is reduced, and the efficiency of data packet forwarding is improved.
  • the security verification module verifies whether the first data packet is secure, and if the verification result of the first data is security, the security verification module uses the first The data packet is forwarded to the receiving end. If not, the security verification module discards the first data packet. This implementation provides a direction of the first data packet if the security verification cannot be performed.
  • the virtual switch A data message is forwarded to the security verification module.
  • the implementation of the data packet of the associated data flow is not configured with the accelerated forwarding rule, and provides security verification in the security verification module to ensure the security of all forwarded data flows.
  • a third implementation manner of the first aspect before the virtual switch extracts the feature information of the first data packet, determining whether the first data packet is After the security verification, the first data packet is not subjected to security verification to extract the feature information of the first data packet.
  • This implementation complements the method of data transfer of the present invention to make the method more complete.
  • the virtual switch extracts the first data packet if the virtual switch determines that the first data packet is subjected to security verification. And the feature information, the acceleration forwarding rule of the data flow to which the first data packet belongs is established according to the feature information of the first data packet, and the first data packet is sent to the receiving end.
  • the present embodiment further supplements the data transmission method of the present invention, and configures an accelerated forwarding rule for the data flow to which the first data packet belongs, so that when the second data packet in the data stream is forwarded by the virtual switch, the method can bypass the
  • the security verification module further improves the efficiency of data stream forwarding.
  • a fifth implementation manner of the first aspect if the virtual switch determines that the first data packet is subjected to security verification, the virtual machine determines that the first data packet is not based on The packet of the Internet Protocol (IP) protocol, the virtual machine sends the first data packet to the receiving end.
  • IP Internet Protocol
  • the implementation method supplements the method for the virtual switch to forward data packets when the data packet received by the virtual switch has a non-IP special packet, so that the method is more complete.
  • the virtual switch determines whether the first data packet is an IP protocol packet. If yes, the virtual switch performs the step of extracting feature information of the first data packet.
  • the implementation method further complements the method for the virtual switch to forward the data packet when the data packet received by the virtual switch has a non-IP special packet, so that the method is more complete.
  • the virtual switch determines that the first data packet is a non-IP-based packet, the virtual switch The data message is forwarded to the security verification module. This implementation further complements the method for the virtual switch to forward special packets of the non-IP protocol, so that the method is more complete.
  • the feature information includes IP quintuple information
  • the quintuple information includes: Transmitting, by the virtual switch, an IP address of the sending end of the first data packet, an IP address of the receiving end, a port number of the sending end, a port number of the receiving end, and a transport layer protocol of the first data packet;
  • the IP quintuple information is included.
  • a second aspect of the present invention provides a data transmission method, the method comprising: receiving, by a virtual switch, a first data packet, and extracting feature information of the first data packet, according to the extracted feature information of the first data packet And determining whether the data flow to which the first data packet belongs is configured with an accelerated forwarding rule.
  • the accelerated forwarding rule indicates that the second data packet in the data flow to which the first data packet belongs has been verified by the security verification module and the verification result is secure. If the data flow to which the first data packet belongs is configured with an accelerated forwarding rule, the virtual switch bypasses the security verification module and sends the first data packet to the receiving end.
  • the security verification module includes, but is not limited to, a Linux bridge, for verifying whether the first data packet is secure.
  • the sending end when the sending end sends a data packet to the receiving end by the virtual switch, the data packet with the accelerated forwarding rule configured in the data stream can bypass the security verification module, and is directly forwarded by the virtual switch without security verification.
  • the number of times of switching between the kernel state and the user state of the data packet is reduced, and the efficiency of data packet forwarding is improved.
  • the security verification module verifies whether the first data packet is secure, and if the verification result of the first data is security, the security verification module uses the first The data packet is forwarded to the receiving end. If not, the security verification module discards the first data packet.
  • the implementation manner provides the direction of the first data packet in the case that the first data packet cannot pass the security verification in the security verification module.
  • the virtual switch A data message is forwarded to the security verification module.
  • the implementation of the data packet of the associated data flow is not configured with the accelerated forwarding rule, and provides security verification in the security verification module to ensure the security of all forwarded data flows.
  • the virtual switch determines whether the first data packet is an IP-based protocol. If yes, the virtual switch performs the step of extracting feature information of the first data packet.
  • the implementation method supplements the method for the virtual switch to forward data packets when the data packet received by the virtual switch has a non-IP special packet, so that the method is more complete.
  • the virtual switch determines the first if the virtual switch determines that the first data packet is a non-IP-based packet. Whether the data packet is securely verified. If the first data packet is not securely verified, the first data packet is forwarded to the security verification module.
  • the implementation method further complements the method for the virtual switch to forward the data packet when the data packet received by the virtual switch has a non-IP special packet, so that the method is more complete.
  • the virtual switch determines that the first data packet is a non-IP-based packet, and the first data packet is After the security verification, the virtual switch forwards the first data packet to the receiving end.
  • the implementation method further complements the method for the virtual switch to forward the data packet when the data packet received by the virtual switch has a non-IP special packet, so that the method is more complete.
  • the virtual switch determines that the first data packet is an IP-based packet
  • the first data packet is extracted.
  • the virtual switch determines whether the first data packet is subjected to security verification. If the first data packet is not verified by security, the virtual switch performs the step of extracting feature information of the first data packet.
  • a seventh implementation manner of the second aspect if the virtual switch determines that the first data packet is subjected to security verification, the virtual switch extracts the feature of the first data packet The information is obtained according to the feature information of the first data packet, and the accelerated forwarding rule of the data stream to which the first data packet belongs is established, and the first data packet is forwarded to the receiving end.
  • the present embodiment further supplements the data transmission method of the present invention, and configures an accelerated forwarding rule for the data flow to which the data packet belongs, so that the second data packet in the data stream can bypass the security verification when being forwarded by the virtual switch. Modules further improve the efficiency of data stream forwarding.
  • the feature information includes IP quintuple information
  • the quintuple information includes: Transmitting, by the virtual switch, an IP address of the sending end of the first data packet, an IP address of the receiving end, a port number of the sending end, a port number of the receiving end, and a transport layer protocol of the first data packet; Includes the IP quintuple information.
  • This implementation further complements the method of data transfer of the present invention, making the method more complete.
  • the present invention provides a virtual switch including an interface unit, a forwarding unit, and a determining unit, wherein the forwarding unit and the determining unit are configured to perform any of the methods of the first aspect of the present invention.
  • the present invention provides a virtual switch including an interface unit, a forwarding unit, and a determining unit, wherein the forwarding unit and the determining unit are configured to perform any of the methods of the second aspect of the present invention.
  • the present invention also provides a computer program product and a non-transitory computer readable storage medium, wherein the computer program product and the non-transitory computer readable storage medium comprise computer instructions, and the processor executes the computer instructions to implement the present invention Any of the methods of the first aspect.
  • the present invention also provides a computer program product and a non-transitory computer readable storage medium, wherein the computer program product and the non-transitory computer readable storage medium comprise computer instructions, and the processor executes the computer instructions to implement the present invention Any of the methods of the second aspect.
  • the present invention also provides a computing device, the computing device comprising a processor and a memory, wherein the memory is for storing execution instructions, the processor executing the execution of the memory storage when the computing device is running An instruction to cause the computing device to perform the method of any of the first aspects.
  • the present invention also provides a computing device, the computing device comprising a processor and a memory, wherein the memory is for storing execution instructions, the processor executing the execution of the memory storage when the computing device is running An instruction to cause the computing device to perform the method of any of the second aspects.
  • FIG. 1 is a schematic diagram of security verification on a Linux bridge before a data stream enters a virtual switch in the prior art
  • 2(a) is a schematic diagram of data transfer between two virtual machines on the same computing node
  • 2(b) is a schematic diagram of data transfer between two virtual machines on different computing nodes
  • 2(c) is a schematic diagram of data transfer between a virtual machine and a bare metal
  • FIG. 3 is a schematic diagram of a connection relationship between a virtual switch and a Linux bridge, a transmitting end, and a receiving end according to an embodiment of the present invention
  • FIG. 4 is a schematic diagram of a host according to an embodiment of the present disclosure.
  • FIG. 5 is a schematic flowchart of data transmission according to an embodiment of the present disclosure.
  • FIG. 6 is a schematic flowchart of another data transmission according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram of a virtual switch according to an embodiment of the present invention.
  • the transfer of data between the two virtual machines and between the virtual machine and the bare metal requires the participation of the virtual switch.
  • the two virtual machines that perform data transfer may be virtual machines on the same compute node or on different compute nodes. That is to say, both the sender and the receiver can be virtual machines or bare metal.
  • the process of forwarding, by the sending end, the data stream or the data packet to the receiving end includes a process in which the first virtual machine sends a data stream or a data packet to the second virtual machine or the bare machine, and the first virtual machine receives the data from the second virtual machine or the bare machine.
  • the process of streaming or data messaging details as follows:
  • the process of forwarding the data packet by the first virtual machine 211 is: the first virtual switch 211 from the first A virtual machine 201 receives the data packet and forwards it to the second virtual switch 212.
  • the second virtual machine 212 receives the data packet: the second virtual switch 212 receives the data packet from the first virtual switch 211, and Forwarded to the second virtual machine 202.
  • the data packet when data is transferred between the first virtual machine 201 on the first computing node and the third virtual machine 203 on the second computing node, the data packet needs to pass through the physical switch 220: the first virtual machine 201
  • the process of forwarding the data packet is: the first virtual switch 211 receives the data packet from the first virtual machine 201, and forwards the physical switch 220, and the physical switch 220 forwards the data packet to the third virtual switch 203;
  • the process of the device 203 receiving the data packet is: the third virtual switch 213 receives the data packet from the physical switch 220 and forwards the data packet to the third virtual machine 203.
  • the physical switch 220 can also be replaced with a plurality of physical switch groups.
  • the physical switch group is responsible for data forwarding between the virtual switch 211 and the virtual switch 213.
  • the first virtual machine 201 forwards the data packet to the bare metal device 204.
  • the first virtual switch 201 receives the data packet from the first virtual machine 201, and forwards the physical switch 220, and the physical switch 220 The data packet is forwarded to the bare metal 204.
  • the first virtual machine 201 receives the data packet of the bare metal 204.
  • the first virtual switch machine 211 receives the data packet from the bare metal 204 from the physical switch 220 and forwards the data packet to the first virtual device.
  • the physical switch 220 can also be replaced by a plurality of physical switch groups.
  • the physical switch group is responsible for data forwarding between the virtual switch 211 and the bare metal 204.
  • the physical switch group can include a gateway.
  • the transmitted data stream can contain several data packets.
  • a data message having the same feature information belongs to one data stream.
  • the secure verification of the data stream is the secure verification of the data message of the data stream.
  • the security verification of the data stream is implemented by performing security verification on the data packet included in the data stream. If the data packet is verified to be secure, the data stream to which the data packet belongs is considered to be secure, then the datagram is Other data messages of the data stream to which the text belongs are also considered to be secure.
  • the virtual switch needs to forward the data packet to the security verification module, so that the data packet is verified in the security verification module.
  • the security verification module include, but are not limited to, a Linux bridge.
  • the IPTABLES configured in the Linux bridge can perform security verification of data streams or data packets.
  • the security verification module in this embodiment may be any module capable of performing security verification on a data stream or a data packet, such as a verification module, a security verification module, and a packet detection module.
  • the present invention provides an embodiment, in which a part of the data stream forwarded by the sending end to the receiving end does not enter the security verification module when being forwarded by the virtual switch, and is directly forwarded by the virtual switch, thereby improving data transmission efficiency and reducing users.
  • the virtual switch 120 is connected to the security verification module 140, the transmitting end 300, and the receiving end 310, respectively.
  • the sending end 300 forwards the first data packet to the receiving end 310 through the virtual switch 120
  • the first data packet sent by the sending end 300 bypasses the security verification module 140 and enters the virtual switch 120.
  • the virtual switch 120 identifies whether the data flow to which the first data packet sent by the sending end 300 belongs is configured with an accelerated forwarding rule. If the first data packet belongs to the data stream, an accelerated forwarding rule is configured, and the virtual switch 120 forwards it to the receiving end 310.
  • the accelerated forwarding rule indicates that the second data packet of the data flow to which the first data packet belongs has been verified by the security verification module and the verification result is secure. If the verification result of the second data packet is secure, the first data packet belonging to the same data stream as the second data packet is also considered to be secure. That is, if the data flow to which the first data packet belongs is configured with an accelerated forwarding rule, the first data packet is considered to be secure, and the virtual switch can bypass the security verification module to the next forwarding node.
  • the specific implementation manner of determining whether the data flow to which the data packet belongs is configured to be an accelerated forwarding rule includes, but is not limited to, querying the connection tracking table according to the feature information of the extracted data packet.
  • connection tracking table capable of recording the feature information can record the data stream in which the accelerated forwarding rule is configured.
  • the connection tracking table is a table in the virtual switch 120.
  • the entry of the connection tracking table includes the feature information of the data flow.
  • the feature tracking information of the extracted data packet is used to query the connection tracking table, and it can be known whether the data flow to which the data packet belongs is configured with an accelerated forwarding rule.
  • the characteristic information of the data stream may include IP quintuple information of the data packet, and the IP quintuple information includes: an Internet Protocol (IP) address of the transmitting end 300, an IP address of the receiving end 310, and a sending end 300.
  • IP Internet Protocol
  • the transport layer protocol may be a TCP protocol or a UDP protocol, and corresponds to a TCP packet and a UDP packet, respectively.
  • the accelerated forwarding rule in this embodiment may be called a direct forwarding rule, a direct forwarding identification feature, or the like, and any forwarding rule or feature that enables the virtual switch to identify a data message that can be directly forwarded to the receiving end.
  • the sending end 300 when the sending end 300 sends a data packet to the receiving end 310 via the virtual switch 120, the data packet with the accelerated forwarding rule configured in the data stream can bypass the security verification module, and the virtual switch is not authenticated by the security switch.
  • the forwarding of the data packet reduces the number of times the data packet is switched between the kernel mode of the security verification module 140 and the user mode of the virtual switch 120, thereby improving the efficiency of data packet forwarding.
  • the security verification module 140 discards the first data packet. After the first data packet passes the security verification, the security verification module returns the first data packet to the virtual switch 120, and is forwarded by the re-virtual switch 120 to the receiving end 310.
  • the data packet received by the virtual switch 120 may be from the sending end 300, or may be from the security verification module 140, that is, the first data packet received by the virtual switch 120 may be a data packet to be forwarded. It may also be a data message that has been verified by security in the security verification module. Therefore, after the virtual switch 120 receives the first data packet, the virtual switch 120 needs to determine whether the first data packet has undergone security verification. If the first data packet is not verified by the security, the first data packet is sent from the sending end 300, and the virtual switch performs the step of extracting the feature information of the first data packet. If the first data packet has been securely verified, the virtual switch 120 forwards the first data packet to the receiving end 310.
  • the virtual switch 120 bypasses the security verification module, and the virtual switch 120 establishes the data to which the data packet belongs according to the feature information of the first data packet. Accelerated forwarding rules for flows.
  • the virtual switch 120 can determine whether the data packet has undergone security verification by determining whether the data packet is from the security verification module. Data packets from the security verification module can be considered as security-verified data messages.
  • the special packet does not have the IP quintuple information, and the data stream to which the special packet belongs cannot be recorded in the data packet.
  • the virtual switch 120 cannot determine whether the data flow to which the special packet belongs matches the accelerated forwarding rule. Therefore, each special packet received by the virtual switch 120 can be forwarded by the virtual switch 120 to the security verification module for security verification in the security verification module. details as follows:
  • the virtual switch 120 Before the virtual switch 120 extracts the feature information of the first data packet, if the virtual switch 120 determines that the first data packet has not been verified by the security, the virtual switch 120 determines whether the first data packet is an IP protocol-based packet. If the first data packet is an IP-based packet, the virtual switch 120 performs the step of extracting the feature information of the first data packet; if the first data packet is a special packet other than the IP protocol, the virtual switch 120 A data message is forwarded to the security verification module.
  • the virtual switch 120 may continue to determine whether the first data packet is an IP protocol-based packet. . If the first data packet is a packet based on the IP protocol, the virtual switch 120 extracts the feature information of the first data packet, and establishes an accelerated forwarding rule of the data flow to which the data packet belongs according to the feature information of the first data packet. And forwarding the first data packet to the receiving end; if the first data packet is a special packet of the non-IP protocol, the virtual switch 120 directly forwards the first data packet to the receiving end.
  • the special packet that is not based on the IP protocol includes, but is not limited to, an IP fragment packet and a traceroute packet.
  • the performing step of the virtual switch may include two determining steps, that is, determining whether the data packet has undergone security verification, and determining whether the data packet is an IP protocol-based message.
  • the virtual switch 120 first performs the step of determining whether the data packet has undergone security verification. The following describes first determining whether the first data packet is an IP-based packet, and then A specific implementation method for determining whether the first data packet has been securely verified.
  • the first data packet sent by the sender 300 bypasses the security verification module 140 and enters the virtual switch 120.
  • the virtual switch 120 identifies whether the data flow to which the first data packet sent by the sending end 300 belongs is configured with an accelerated forwarding rule. If the first data packet belongs to the data stream, an accelerated forwarding rule is configured, and the virtual switch 120 forwards it to the receiving end 310.
  • the virtual switch 120 forwards it to the security verification module 140 for security verification. If the first data packet fails the security verification, the security verification module 140 discards the data message. After the first data packet passes the security verification, the security verification module returns the first data packet to the virtual switch 120, and is forwarded by the re-virtual switch 120 to the receiving end 310.
  • the virtual switch 120 determines whether the first data packet is an IP protocol-based packet, and if so, the virtual switch 120 performs the function of extracting the feature information of the first data packet. step. If not, the virtual switch 120 determines if the first data message has been securely verified. If the first data packet is not verified by security, the first data packet is forwarded to the security verification module. If the virtual switch 120 determines that the first data packet is a non-IP-based special packet, and the data packet passes the security verification, the virtual switch 120 forwards the first data packet to the receiving end.
  • the virtual switch 120 determines whether the first data packet has undergone security verification before extracting the feature information of the first data packet. If the first data packet is not authenticated, the first data packet is sent from the sender 300. Then, for the first data packet based on the IP protocol from the sender 300, the virtual switch 120 performs the extraction of the first data packet. The steps of the feature information. If the first data packet is subjected to the security verification, the data flow to which the first data packet belongs to the IP protocol is not configured with the accelerated forwarding rule. In this case, the virtual switch 120 forwards the first data packet that has undergone the security verification. The accelerated forwarding rule of the data flow to which the data packet belongs may be established according to the feature information of the first data packet.
  • the virtual switch receives the data packet forwarded by the sending end, and the virtual switch forwards the data packet to the receiving end, which includes the process that the transmitting end forwards the data stream or the data packet to the receiving end, and the virtual switch is required.
  • the virtual switch receives the data packet forwarded by the sending end, and the virtual switch receives the data packet from the sending end, and the virtual switch receives the data packet of the sending end by the other node; the virtual switch forwards the data packet to the receiving end, including forwarding to the receiving end.
  • Other nodes include, but are not limited to, network devices such as physical switches, other virtual switches, gateways, and routers.
  • the security verification module may be a Linux bridge.
  • FIG. 4 is a block diagram showing the structure of a computing device 400 in accordance with an embodiment of the present invention.
  • the server 400 includes a processor 401 that is coupled to the system memory 402.
  • the processor 201 can be a central processing unit (CPU), a graphics processing unit (GPU), a field programmable gate array (FPGA), or a digital signal processor (English: digital signal processor) , DSP) and other computing logic or a combination of any of the above computing logic.
  • the processor 201 can be a single core processor or a multi-core processor.
  • the bus 401 is used to transfer information between the components of the server 400.
  • the bus 403 can use a wired connection or a wireless connection. This application does not limit this.
  • the bus 403 is also connected to a communication interface 404.
  • Communication interface 404 enables communication with other devices or networks using transceivers such as, but not limited to, transceivers, which may be interconnected to the network by wire or wireless form.
  • transceivers such as, but not limited to, transceivers, which may be interconnected to the network by wire or wireless form.
  • the method of the embodiment of the present invention may be implemented by the processor 401 executing software code in the system memory 402.
  • FIG. 4 is merely an example of a server 400 that may include more or fewer components than shown in FIG. 4, or have different component configurations.
  • the various components shown in Figure 2 can be implemented in hardware, software, or a combination of hardware and software.
  • the virtual switch after receiving the data stream, the virtual switch first determines whether the data stream is from the security verification module, and then determines whether the received data stream is an IP protocol-based message.
  • the specific process is shown in Figure 5:
  • S501 The virtual switch receives the data packet.
  • the virtual switch determines whether the data packet is securely verified. Specifically, the virtual switch can determine whether the data packet is securely verified by determining whether the data packet is from a Linux bridge.
  • the virtual switch determines whether the data packet is an IP-based packet.
  • the virtual switch performs this step after determining that the data packet has not been verified by security in s502. Specifically, by determining whether the data flow to which the data packet belongs has characteristic information, it can be determined whether the data packet is an IP protocol-based message.
  • the packet with the feature information of the associated data stream is a packet based on the IP protocol. Otherwise, it is a special packet of the non-IP protocol. In this step, the packets based on the IP protocol are separated from the special packets of the non-IP protocol to implement different processing methods for the two types of packets, ensuring the integrity of the method.
  • the characteristic information of the data stream includes IP quintuple information, which may be a data packet, and the IP quintuple information includes: an Internet Protocol (IP) address of the transmitting end 300, an IP address of the receiving end 310, and a sending end 300.
  • IP Internet Protocol
  • the port number, the port number of the receiving end 310, and the transport layer protocol of the data message may be a TCP protocol or a UDP protocol, and corresponds to a TCP packet and a UDP packet, respectively.
  • S504 The virtual switch extracts feature information of the data flow to which the data packet belongs, and is used in step s505. The virtual switch performs this step after determining that the data packet is an IP-based packet in s503.
  • the virtual switch determines whether the data flow to which the data packet belongs is configured with an accelerated forwarding rule. In this step, the virtual switch determines whether the data packet can be bypassed by the Linux bridge and forwarded directly to the receiving end. Specifically, the virtual switch queries the connection tracking table according to the feature information extracted in step s504.
  • the connection tracking table is a table in the virtual switch for recording accelerated forwarding rules.
  • the entry of the connection tracking table includes the feature information of the data flow. Querying the connection tracking table by using the feature of the extracted data stream can be used to know whether the data flow described in the data packet is configured with an accelerated forwarding rule.
  • S506 The virtual switch forwards the data packet to the receiving end. After the virtual switch determines that the data flow to which the data packet belongs is configured with the accelerated forwarding rule, the virtual switch performs this step.
  • S501, s502, s503, s504, s505, and s506 are processes for forwarding the data packet when the virtual switch receives the data packet of the accelerated forwarding rule, and the data stream is an IP protocol-based packet.
  • the virtual switch bypasses the Linux bridge and directly sends the data packet to the receiving end, thereby reducing the number of times the data packet is switched between the kernel state and the user state, and improving the data. The efficiency of message forwarding.
  • S507 The virtual switch forwards the data packet to the Linux bridge for security verification.
  • the virtual switch performs this step.
  • Data packets are securely verified in the Linux bridge. That is, if the data packet received by the virtual switch is not securely verified and is a special packet of the non-IP protocol, the virtual switch performs this step after s502, s503, s504, and s505.
  • the virtual switch determines the datagram in s502.
  • the file is not verified by security.
  • s503 it is determined that the data packet is not a packet based on the IP protocol, and the step is performed.
  • S508 The Linux bridge performs security verification on the data packet and confirms whether it passes the verification.
  • the IPTABLES configured in the Linux bridge can perform security verification of the data stream.
  • S509 The Linux bridge forwards the data packet to the virtual switch, so that the virtual switch can forward the data packet that passes the security verification to the receiving end.
  • the Linux bridge performs this step.
  • the process proceeds to s501 and s502, that is, the virtual switch receives the data packet, and determines whether the data packet has undergone security verification.
  • S510 The Linux bridge discards the data packet, and the data packet at this time refers to a data packet that has not passed the security verification, thereby ensuring the integrity of the solution. If the data packet in s508 does not pass the security verification in the Linux bridge, the Linux bridge performs this step to end the forwarding of the data packet.
  • the virtual switch determines whether the data packet is an IP protocol-based packet. If the virtual switch determines that the data packet has been verified by security in s502, perform this step. This step distinguishes the data packets that have been verified by security. For the packets based on the IP protocol and the special packets, different forwarding processes are adopted in s512 and s511 respectively.
  • S512 The virtual switch establishes an accelerated forwarding rule of the data flow to which the data packet belongs according to the feature information of the data packet, and sends the data packet to the receiving end. In this step, when the data packet is forwarded, the virtual switch can bypass the Linux bridge when forwarding other data packets in the data stream. In s511, the virtual switch determines that the data packet is an IP protocol-based packet, and performs this step.
  • S513 The virtual switch sends the data packet to the receiving end. If the virtual switch determines that the data packet is not a packet based on the IP protocol, the s511 performs this step.
  • the virtual switch after receiving the data packet, the virtual switch first determines whether the data packet is from a Linux bridge, and then determines whether the data packet is an IP protocol-based packet.
  • the specific process is shown in Figure 6:
  • S601 The virtual switch receives the data packet.
  • the virtual switch determines whether the data packet is an IP protocol-based packet. If the virtual switch determines that the data packet is an IP-based packet in s602, perform this step. In this step, the packets based on the IP protocol are separated from the special packets of the non-IP protocol to implement different processing methods for the two types of packets, ensuring the integrity of the method.
  • the virtual switch determines whether the data packet is securely verified. This step separates the data packets that have not passed through the Linux bridge from the data packets that have been verified in the Linux bridge to ensure the integrity of the solution.
  • the virtual switch extracts feature information of the data packet, and is used in step s605. If the virtual switch determines that the data packet has not been verified by security in s603, perform this step.
  • the virtual switch determines whether an accelerated forwarding rule is configured for the data flow to which the data packet belongs. Specifically, the virtual switch queries the connection tracking table according to the feature information extracted in step s604. In this step, the virtual switch determines whether the data packet can be bypassed by the Linux bridge and forwarded directly to the receiving end.
  • S606 The virtual switch forwards the data packet to the receiving end. After the virtual switch determines that the data flow to which the data packet belongs is configured with the accelerated forwarding rule, the virtual switch performs this step.
  • S601, s602, s603, s604, s605, and s606 are processes for forwarding the data packet when the virtual switch receives the data packet of the accelerated forwarding rule, and the data stream is an IP protocol-based packet.
  • the virtual switch bypasses the Linux bridge and directly sends the data packet to the receiving end, thereby reducing the number of times the data packet is switched between the kernel state and the user state, and improving the data. The efficiency of message forwarding.
  • the virtual switch determines whether the data packet is securely verified. If the virtual switch determines that the data packet is not an IP-based packet in s602, perform this step. Similar to s603, this step separates the data packets that have not passed through the Linux bridge from the data packets that have been verified in the Linux bridge to ensure the integrity of the solution.
  • S608 The virtual switch forwards the data packet to the receiving end. If the virtual switch determines that the data packet has been verified by security in s607, perform this step. If the data packet is not a packet based on the IP protocol and has been verified by security, the data packet is directly forwarded.
  • S609 The virtual switch forwards the data packet to the Linux bridge for security verification. If the data packet received by the virtual switch is a non-IP special packet, and the security packet is not authenticated, the virtual switch determines that the data packet is not an IP-based packet, and determines the s607 in s607. The data packet is not verified by security. Perform this step. If the data packet received by the virtual switch is an IP-based packet and has not been verified by security, and the data flow to which the data packet belongs is not configured with an acceleration forwarding rule, the virtual switch determines the datagram in s602. The text is an IP-based packet, and the s603 determines that the data packet has not been verified by security. After determining that the data flow to which the data packet belongs is not configured with the accelerated forwarding rule, the step is performed.
  • S610 The Linux bridge performs security verification on the data packet and confirms whether it passes the verification.
  • the IPTABLES configured in the Linux bridge can perform security verification of the data stream.
  • S611 The Linux bridge forwards the data packet to the virtual switch, so that the virtual switch can forward the data packet that passes the security verification to the receiving end.
  • the Linux bridge performs this step.
  • the process proceeds to s601 and s602, that is, the virtual switch receives the data packet, and determines whether the data packet is an IP-based packet.
  • the Linux bridge discards the data packet. If the data packet in the s610 does not pass the security verification in the Linux bridge, the Linux bridge performs this step to end the forwarding of the data packet.
  • the virtual switch establishes an accelerated forwarding rule of the data flow to which the data packet belongs according to the feature information of the data packet, and sends the data packet to the receiving end. If the virtual switch determines that the data packet has been verified by security in s603, perform this step.
  • An embodiment of the present invention also provides a virtual switch 700, as shown in FIG.
  • the virtual switch 700 includes a forwarding unit 710, a determining unit 720, and an interface unit 730.
  • the interface unit 730 is configured to receive a data packet.
  • the determining unit 720 is configured to:
  • the forwarding unit 710 is configured to: bypass the security verification module, and send the data packet to the receiving end.
  • the forwarding unit 710 is further configured to: forward the data packet to the security verification module.
  • the determining unit 720 is further configured to:
  • the step of extracting the feature information of the data packet is performed.
  • the forwarding unit 710 is further configured to: extract the feature information of the data packet, and establish an accelerated forwarding rule of the data flow to which the data packet belongs according to the feature information of the data packet, and the forwarding unit Also used to: send the data message to the receiving end.
  • the determining unit 720 is further configured to: determine whether the data packet is a packet based on the IP protocol, and if yes, the determining unit 720 The step of extracting the feature information of the data message is performed.
  • the forwarding unit 710 is further configured to: forward the data packet to the security verification module.
  • the receiving unit 730 is configured to receive a data message.
  • the determining unit 720 is configured to:
  • the forwarding unit 710 is configured to: bypass the security verification module, and send the data packet to the receiving end.
  • the forwarding unit 710 is further configured to: forward the data packet to the security verification module.
  • the determining unit 720 is further configured to:
  • the data packet is determined to be a non-IP-based packet, it is determined whether the data packet is securely verified.
  • the forwarding unit 710 is further configured to: forward the first data packet to the security verification module.
  • the determining unit 720 is further configured to:
  • the data packet After determining that the data packet is an IP-based packet, before extracting the feature information of the data packet, determine whether the data packet has undergone security verification.
  • the step of extracting the feature information of the data packet is performed.
  • the determining unit 720 is further configured to: extract feature information of the data packet, and establish an accelerated forwarding rule of the data stream to which the data packet belongs according to the feature information of the data packet.
  • the forwarding unit 710 is further configured to: according to the determining unit, determine, by the determining unit, the result of the security verification, and send the data packet to the receiving end.
  • each unit in the virtual switch 700 can be implemented by a corresponding hardware chip. In another implementation, two or three units can be integrated on a single hardware chip. In another implementation, the various units in virtual switch 700 can also be implemented by the processor executing computer instructions. This embodiment of the present invention does not limit this.
  • an embodiment of the present invention provides a non-volatile storage medium and a computer program product including computer instructions, and the controller executes computer instructions for implementing the solution described in the embodiments of the present invention.
  • the disclosed apparatus and method may be implemented in other manners.
  • the division of the units described in the device embodiments described above is only one logical function division, and may be further divided in actual implementation, for example, multiple units or components may be combined or may be integrated into another system, or Some features can be ignored or not executed.
  • the coupling or direct coupling or communication connection of the various units shown or discussed may be through some interfaces.
  • each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提供了一种数据传送的方法和虚拟交换机。虚拟交换机接收数据报文时，提取数据报文的特征信息，根据提取的数据报文的特征信息，确定数据报文所属的数据流是否配置了加速转发规则。若数据报文所属的数据流配置了加速转发规则，虚拟交换机绕过Linux网桥，直接向接收端发送所述第一数据报文，从而减少了数据报文在内核态和用户态之间的切换次数，提高数据报文转发的效率。

Description

一种数据传送的方法和虚拟交换机 技术领域
本发明涉及信息技术领域，尤其涉及一种数据传送的方法和虚拟交换机。
背景技术
公有云场景下，各种应用和服务都在同一个平台上运行，这对网络安全提出了较高的要求。对数据流的网络安全验证，可通过在Linux网桥中配置IPTABLES规则来实现。如图1所示，第一虚拟机100向第二虚拟机130发送数据流时，数据流在到达虚拟交换机120并由虚拟交换机120转发之前，首先进入Linux网桥110，在Linux网桥110中利用IPTABLES规则来实现安全验证。在Linux网桥110中通过安全验证的数据流被导入虚拟交换机进行流量转发，而未通过安全验证的数据流在Linux网桥110中被丢弃。
在Linux网桥中配置的IPTABELS规则可以实现丰富的网络安全功能，然而，IPTABLES为了考虑兼容性以及丰富的功能，有些安全验证的实现会导致数据流转发性能的下降。同时，由于Linux网桥中的安全验证在内核态进行，虚拟交换机对数据流的转发在用户态进行，那么每次数据流经虚拟机交换机转发的过程，都要经过由内核态至用户态的切换。而内核态至用户态的切换会导致缓存的污染，从而进一步导致数据流转发效率的下降。
发明内容
本发明提供了一种数据传送的方法和虚拟交换机，本发明中，部分数据报文可以绕过安全验证模块，直接由虚拟交换机转发，减少了数据流转发过程中数据报文在用户态和内核态间的切换次数，提高了虚拟交换机转发数据流的效率。
本发明的第一方面提供一种数据传送方法，该方法包括：虚拟交换机接收第一数据报文，提取该第一数据报文的特征信息后，根据提取的该第一数据报文的特征信息，确定该第一数据报文所属的数据流是否配置了加速转发规则。该加速转发规则指示该第一数据报文所属的数据流中的第二数据报文已经经过安全验证模块的验证且验证结果为安全。若该第一数据报文所属的数据流配置了加速转发规则，该虚拟交换机绕过该安全验证模块向接收端发送该第一数据报文。该安全验证模块包括但不限于是Linux网桥，用于验证该第一数据报文是否安全。
在本实现方式中，发送端经该虚拟交换机向接收端发送数据报文时，所属数据流配置了加速转发规则的数据报文可以绕过安全验证模块，不经安全验证，直接由虚拟交换机转发，减少了数据报文在内核态和用户态之间的切换次数，提高数据报文转发的效率。
结合第一方面，在第一方面的第一种实现方式中，该安全验证模块验证该第一数据报文是否安全，如果该第一数据的验证结果为安全，该安全验证模块将该第一数据报文转发给接收端，如果不安全，该安全验证模块丢弃该第一数据报文。本实现方式 提供了在不能通过安全验证的情况下，该第一数据报文的走向。
结合第一方面或第一方面的第一种实现方式，在第一方面的第二种实现方式中，若该第一数据报文所属的数据流未配置加速转发规则，该虚拟交换机将该第一数据报文转发到该安全验证模块。本实现方式提供了所属的数据流未配置加速转发规则的数据报文的走向，为其提供了安全验证模块中的安全验证，保证了所有转发的数据流的安全。
结合第一方面或第一方面的第一种实现方式，在第一方面的第三种实现方式中，该虚拟交换机提取该第一数据报文的特征信息之前，确定该第一数据报文是否经过安全验证，若该第一数据报文未经过安全验证提取该第一数据报文的特征信息的步骤。本实现方式补充了本发明数据传送的方法，使得方法更加完整。
结合第一方面的第三种实现方式，在第一方面的第四种实现方式中，若该虚拟交换机确定该第一数据报文经过安全验证，则该虚拟交换机提取该第一数据报文的特征信息，根据该第一数据报文的特征信息建立该第一数据报文所属的数据流的加速转发规则，并向该接收端发送所述第一数据报文。本实现方式进一步补充了本发明数据传送的方法，为第一数据报文所属的数据流配置加速转发规则，使得该数据流中的第二数据报文经该虚拟交换机转发时，可以绕过该安全验证模块，进一步提高了数据流转发的效率。
结合第一方面的第四种实现方式，在第一方面的第五种实现方式中，若该虚拟交换机确定该第一数据报文经过安全验证，该虚拟机确定该第一数据报文不是基于网络互连协议(Internet Protocol，IP)协议的报文，该虚拟机向该接收端发送所述第一数据报文。本实现方式补充了当虚拟交换机接收的数据报文中有非IP协议的特殊报文时，虚拟交换机转发数据报文的方法，使得方法更加完整。
结合第一方面的第三种实现方式，在第一方面的第六种实现方式中，在该虚拟交换机确定该第一数据报文未经过安全验证之后，以及提取该第一数据报文的特征信息之前，该虚拟交换机确定该第一数据报文是否为IP协议的报文，如果是，该虚拟交换机执行该提取所述第一数据报文的特征信息的步骤。本实现方式进一步补充了当虚拟交换机接收的数据报文中有非IP协议的特殊报文时，虚拟交换机转发数据报文的方法，使得方法更加完整。
结合第一方面的第六种实现方式，在第一方面的第七种实现方式中，若该虚拟交换机确定该第一数据报文为非基于IP协议的报文，该虚拟交换机将该第一数据报文转发到该安全验证模块。本实现方式进一步补充虚拟交换机转发非IP协议的特殊报文的方法，使得方法更加完整。
结合第一方面、第一方面的第一至七中任一种实现方式，在第一方面的第八种实现方式中，该特征信息包括IP五元组信息，该五元组信息包括：向该虚拟交换机发送该第一数据报文的发送端的IP地址、该接收端的IP地址、该发送端的端口号、该接收端的端口号和该第一数据报文的传输层协议；该加速转发规则中包括所述IP五元组信息。本实现方式进一步补充了本发明数据传送的方法，使得方法更加完整。
本发明的第二方面提供一种数据传送方法，该方法包括：虚拟交换机接收第一数据报文，提取该第一数据报文的特征信息后，根据提取的该第一数据报文的特征信息， 确定该第一数据报文所属的数据流是否配置了加速转发规则。该加速转发规则指示该第一数据报文所属的数据流中的第二数据报文已经经过安全验证模块的验证且验证结果为安全。若该第一数据报文所属的数据流配置了加速转发规则，该虚拟交换机绕过该安全验证模块向接收端发送该第一数据报文。该安全验证模块包括但不限于Linux网桥，用于验证该第一数据报文是否安全。
在该实现方式中，发送端经该虚拟交换机向接收端发送数据报文时，所属数据流配置了加速转发规则的数据报文可以绕过安全验证模块，不经安全验证，直接由虚拟交换机转发，减少了数据报文在内核态和用户态之间的切换次数，提高数据报文转发的效率。
结合第二方面，在第二方面的第一种实现方式中，该安全验证模块验证该第一数据报文是否安全，如果该第一数据的验证结果为安全，该安全验证模块将该第一数据报文转发给接收端，如果不安全，该安全验证模块丢弃该第一数据报文。本实现方式提供了该第一数据报文不能在安全验证模块中通过安全验证的情况下，该第一数据报文的走向。
结合第二方面或第二方面的第一种实现方式，在第二方面的第二种实现方式中，若该第一数据报文所属的数据流未配置加速转发规则，该虚拟交换机将该第一数据报文转发到该安全验证模块。本实现方式提供了所属的数据流未配置加速转发规则的数据报文的走向，为其提供了安全验证模块中的安全验证，保证了所有转发的数据流的安全。
结合第二方面，在第二方面的第三种实现方式中，在该虚拟交换机提取该第一数据报文的特征信息之前，该虚拟交换机确定该第一数据报文是否为基于IP协议的报文，如果是，该虚拟交换机执行该提取该第一数据报文的特征信息的步骤。本实现方式补充了当虚拟交换机接收的数据报文中有非IP协议的特殊报文时，虚拟交换机转发数据报文的方法，使得方法更加完整。
结合第二方面的第三种实现方式，在第二方面的第四种实现方式中，若该虚拟交换机确定该第一数据报文为非基于IP协议的报文，该虚拟交换机确定该第一数据报文是否经过安全验证，若该第一数据报文未经过安全验证，将该第一数据报文转发到该安全验证模块。本实现方式进一步补充了当虚拟交换机接收的数据报文中有非IP协议的特殊报文时，虚拟交换机转发数据报文的方法，使得方法更加完整。
结合第二方面的第四种实现方式，在第二方面的第五种实现方式中，若该虚拟交换机确定该第一数据报文为非基于IP协议的报文，且该第一数据报文经过安全验证，该虚拟交换机向接收端转发该第一数据报文。本实现方式进一步补充了当虚拟交换机接收的数据报文中有非IP协议的特殊报文时，虚拟交换机转发数据报文的方法，使得方法更加完整。
结合第二方面的第三种实现方式，在第二方面的第六种实现方式中，在该虚拟交换机确定该第一数据报文为基于IP协议的报文之后，提取该第一数据报文的特征信息之前，该虚拟交换机确定该第一数据报文是否经过安全验证，若该第一数据报文未经过安全验证，该虚拟交换机执行该提取该第一数据报文的特征信息的步骤。本实现方式进一步补充了本发明数据传送的方法，使得方法更加完整。
结合第二方面的第六种实现方式，在第二方面的第七种实现方式中，若该虚拟交换机确定该第一数据报文经过安全验证，该虚拟交换机提取该第一数据报文的特征信息，根据该第一数据报文的特征信息建立该第一数据报文所属的数据流的加速转发规则，并向接收端转发该第一数据报文。本实现方式进一步补充了本发明数据传送的方法，为数据报文所属的数据流配置加速转发规则，使得该数据流中的第二数据报文经该虚拟交换机转发时，可以绕过该安全验证模块，进一步提高了数据流转发的效率。
结合第二方面、第二方面的第一至七中任一种实现方式，在第二方面的第八种实现方式中，该特征信息包括IP五元组信息，该五元组信息包括：向该虚拟交换机发送该第一数据报文的发送端的IP地址、该接收端的IP地址、该发送端的端口号、该接收端的端口号和该第一数据报文的传输层协议；该加速转发规则中包括该IP五元组信息。本实现方式进一步补充了本发明数据传送的方法，使得方法更加完整。
第三方面，本发明提供了一种虚拟交换机，该虚拟交换机包括接口单元、转发单元和判断单元，其中该转发单元和该判断单元用于执行本发明第一方面中的任一项方法。
第四方面，本发明提供了一种虚拟交换机，该虚拟交换机包括接口单元、转发单元和判断单元，其中该转发单元和该判断单元用于执行本发明第二方面中的任一项方法。
第五方面，本发明还提供了计算机程序产品和非易失性计算机可读存储介质，其中计算机程序产品和非易失性计算机可读存储介质中包含计算机指令，处理器执行计算机指令实现本发明第一方面中的任一项方法。
第六方面，本发明还提供了计算机程序产品和非易失性计算机可读存储介质，其中计算机程序产品和非易失性计算机可读存储介质中包含计算机指令，处理器执行计算机指令实现本发明第二方面中的任一项方法。
第六方面，本发明还提供一种计算设备，该计算设备包括处理器和存储器，其中，所述存储器用于存储执行指令，当该计算设备运行时，该处理器执行该存储器存储的该执行指令，以使该计算设备执行第一方面中任一项的方法。
第七方面，本发明还提供一种计算设备，该计算设备包括处理器和存储器，其中，所述存储器用于存储执行指令，当该计算设备运行时，该处理器执行该存储器存储的该执行指令，以使该计算设备执行第二方面中任一项的方法。
附图说明
图1为现有技术中数据流进入虚拟交换机前在Linux网桥进行安全验证的示意图；
图2(a)为同一计算节点上的两个虚拟机之间数据传送的示意图；
图2(b)为不同计算节点上的两个虚拟机之间数据传送的示意图；
图2(c)为虚拟机与裸机之间数据传送的示意图；
图3为本发明实施例提供的一种虚拟交换机与Linux网桥、发送端及接收端的连接关系的示意图；
图4为本发明实施例提供的一种主机的示意图；
图5为本发明实施例提供的一种数据传送的流程示意图；
图6为本发明实施例提供的另一种数据传送的流程示意图；
图7为本发明实施例提供的一种虚拟交换机的示意图。
具体实施方式
两个虚拟机之间、以及虚拟机与裸机之间的数据传送都需要虚拟交换机的参与。进行数据传送的两个虚拟机可能在同一计算节点上的虚拟机，也可能在不同计算节点的上。也就是说，发送端和接收端都可以是虚拟机或者裸机。发送端向接收端转发数据流或者数据报文的过程包括第一虚拟机向第二虚拟机或裸机发送数据流或数据报文的过程，以及第一虚拟机从第二虚拟机或裸机接收数据流或数据报文的过程。具体如下：
如图2(a)，第一计算节点上的第一虚拟机201与第二虚拟机202之间数据传送时，第一虚拟机211转发数据报文的过程为：第一虚拟交换机211从第一虚拟机201接收数据报文，并转发给第二虚拟交换机212；第二虚拟机接212收数据报文的过程为：第二虚拟交换机212从第一虚拟交换机211接收该数据报文，并转发给第二虚拟机202。如图2(b)，第一计算节点上的第一虚拟机201与第二计算节点上的第三虚拟机203之间数据传送时，数据报文需经过物理交换机220：第一虚拟机201转发数据报文的过程为：第一虚拟交换机211从第一虚拟机201接收数据报文，并转发物理交换机220，物理交换机220再将该数据报文转发给第三虚拟交换机203；第三虚拟机203接收数据报文的过程为：第三虚拟交换机213从物理交换机220接收该数据报文，并转发给第三虚拟机203。第一虚拟机201与裸机204数据传送时，数据报文需经过物理交换机220。图2(b)中，物理交换机220也可以替换为若干物理交换机组，则此时负责虚拟交换机211与虚拟交换机213之间数据转发的，即为物理交换机组。如图2(c)，第一虚拟机201向裸机204转发数据报文的过程为：第一虚拟交换机201从第一虚拟机201接收数据报文，并转发物理交换机220，物理交换机220再将该数据报文转发给裸机204；第一虚拟机201接收裸机204的数据报文的过程为：第一虚拟交换机机211从物理交换机220接收来自裸机204的数据报文，并转发给第一虚拟机201。图2(c)中，物理交换机220也可以替换为若干物理交换机组，则此时负责虚拟交换机211与裸机204之间数据转发的，即为物理交换机组。该物理交换机组可以包括网关。
数据流或者数据报文在两个虚拟机或者虚拟机以及裸机之间进行报文转发时，需要验证数据流或者数据报文是否安全。两个虚拟机或虚拟机与裸机之间进行数据传送时，传送的数据流可以包含若干数据报文。具有相同特征信息的数据报文属于一个数据流。对数据流的安全验证即为对数据流的数据报文的安全验证。数据流的安全验证即通过对该数据流包含的数据报文进行安全验证来实现，若数据报文的验证结果为安全，则认为该数据报文所属的数据流是安全的，那么该数据报文所属的数据流的其他数据报文也被认为是安全的。若虚拟交换机无法对接收到的数据报文的安全进行验证，虚拟交换机需要将数据报文转发至安全验证模块，使得数据报文在安全验证模块中进行验证。安全验证模块的具体实施方式包括但不限于Linux网桥。Linux网桥中配置的IPTABLES可以完成数据流或者数据报文的安全验证。本实施例中的安全验证模块，可以是验证模块、安全校验模块、报文检测模块等任何能够对数据流或者数据报文进行安全验证的模块。
本发明提出一种实施例，使得发送端向接收端转发的部分数据流在经虚拟交换机 转发时，不进入安全验证模块，直接由虚拟交换机转发，从而提高数据的传输效率，另外也减少的用户态与内核态之间切换的次数，提高数据流转发的性能。
在本发明的实施例中，如图2所示，虚拟交换机120分别与安全验证模块140、发送端300和接收端310相连接。当发送端300通过虚拟交换机120向接收端310转发第一数据报文，发送端300发送的第一数据报文，绕过安全验证模块140，进入虚拟交换机120。虚拟交换机120识别接收发送端300发送的第一数据报文所属的数据流是否配置了加速转发规则。若第一数据报文所属额数据流配置了加速转发规则，虚拟交换机120将其转发至接收端310。
加速转发规则指示第一数据报文所属的数据流的第二数据报文已经经过安全验证模块的验证且验证结果为安全。若第二数据报文的验证结果为安全，那么，与第二数据报文同属一个数据流的第一数据报文也被认为是安全的。也就是说，如果第一数据报文所属的数据流配置了加速转发规则，那么，认为第一数据报文是安全的，且可由虚拟交换机绕过所述安全验证模块向下一个转发节点。本发明的实施例中，确定数据报文所属的数据流是否配置加速转发规则的具体实施方式包括但不限于：根据提取的数据报文的特征信息查询连接跟踪表。由于属于同一数据流的数据报文具有相同的特征信息，因此特征信息可以用于区别数据流。那么，能够记录特征信息的连接跟踪表即可以记录配置了加速转发规则的数据流。连接跟踪表是虚拟交换机120中的表。连接跟踪表的表项包括数据流的特征信息。用提取的数据报文的特征信息来查询连接跟踪表，可以获知数据报文所属的数据流是否配置了加速转发规则。数据流的特征信息可以包括数据报文的IP五元组信息，IP五元组信息包括：发送端300的网络互联协议(Internet Protocol，IP)地址、接收端310的IP地址、发送端300的端口号、接收端310的端口号和第一数据报文的传输层协议。传输层协议可以是TCP协议，也可以是UDP协议，分别对应TCP报文和UDP报文。本实施例中的加速转发规则，可以叫做直接转发规则、直接转发识别特征等任何能够使得虚拟交换机据此识别出可直接向接收端转发的数据报文的转发规则或特征。
本发明实施例中，发送端300经虚拟交换机120向接收端310发送数据报文时，所属数据流配置了加速转发规则的数据报文可以绕过安全验证模块，不经安全验证，由虚拟交换机120转发，减少了数据报文在安全验证模块140的内核态和虚拟交换机120的用户态之间的切换次数，提高数据报文转发的效率。
若虚拟交换机接收到的第一数据报文所属的数据流未配置加速转发规则，说明第一数据报文是虚拟交换机120接收的，该数据流中的首个数据报文，且第一数据报文未经过安全验证。那么虚拟交换机120将第一数据报文转发至安全验证模块140，进行安全验证。如果第一数据报文未通过安全验证，安全验证模块140丢弃第一数据报文。如果第一数据报文通过安全验证后，安全验证模块将第一数据报文返回至虚拟交换机120，由再虚拟交换机120转发至接收端310。
也就是说，虚拟交换机120收到的数据报文可能是来自于发送端300，也可能是来自安全验证模块140，即虚拟交换机120收到的第一数据报文可能是待转发的数据报文，也可能是已在安全验证模块中通过安全验证的数据报文。因此当虚拟交换机120接收到第一数据报文后，虚拟交换机120需判断第一数据报文是否经过安全验证。若第一数据 报文未经过安全验证，说明第一数据报文来自发送端300，则虚拟交换机执行所述提取第一数据报文的特征信息的步骤。若第一数据报文已经过安全验证，则虚拟交换机120向接收端310转发第一数据报文。为了使得第一数据报文所属的数据流的其他数据报文在由虚拟交换机120转发时，绕过安全验证模块，虚拟交换机120根据第一数据报文的特征信息建立该数据报文所属的数据流的加速转发规则。本实施例中，虚拟交换机120可以通过判断数据报文是否来自安全验证模块来确定数据报文是否经过安全验证。来自安全验证模块的数据报文可以认为经过安全验证的数据报文。
当发送端300经虚拟交换机120向接收端转发的第一数据报文为非IP协议的特殊报文，该特殊报文不具有IP五元组信息，则特殊报文所属的数据流无法记录在加速转发规则中，虚拟交换机120也就无法判断特殊报文所属的数据流是否匹配了加速转发规则。因此，虚拟交换机120接收的到每一条特殊报文，可由虚拟交换机120转发至安全验证模块，在安全验证模块中进行安全验证。具体如下：
虚拟交换机120提取第一数据报文的特征信息之前，若虚拟交换机120确定第一数据报文未经过安全验证，则虚拟交换机120判断第一数据报文是否为基于IP协议的报文。如果第一数据报文是基于IP协议的报文，虚拟交换机120执行提取第一数据报文的特征信息的步骤；如果第一数据报文是非IP协议的特殊报文，则虚拟交换机120将第一数据报文转发到安全验证模块。
虚拟交换机120提取第一数据报文的特征信息之前，若虚拟交换机120确定第一数据报文已经过安全验证，虚拟交换机120也可以继续判第一断数据报文是否为基于IP协议的报文。如果第一数据报文是基于IP协议的报文，则虚拟交换机120提取第一数据报文的特征信息，根据第一数据报文的特征信息建立数据报文所属的数据流的加速转发规则，并转发第一数据报文至接收端；如果第一数据报文是非IP协议的特殊报文，则虚拟交换机120直接将第一数据报文转发至接收端。
本发明实施例中，非基于IP协议的特殊报文包括但不限于IP分片报文和traceroute报文。
由上可见，在本发明的实施例中，虚拟交换机的执行步骤可以包含两个判断步骤，即，确定数据报文是否经过安全验证，和确定数据报文是否为基于IP协议的报文。上文中所述虚拟交换机120转发数据报文的方法中，虚拟交换机120首先执行确定数据报文是否经过安全验证的步骤，以下介绍先确定第一数据报文是否为基于IP协议的报文，再确定第一数据报文是否经过安全验证的具体实施方式。
发送端300发送的第一数据报文，绕过安全验证模块140，进入虚拟交换机120。虚拟交换机120识别接收发送端300发送的第一数据报文所属的数据流是否配置了加速转发规则。若第一数据报文所属额数据流配置了加速转发规则，虚拟交换机120将其转发至接收端310。
若虚拟交换机120接收到的第一数据报文所属的数据流未配置加速转发规则，则虚拟交换机120将其转发至安全验证模块140，进行安全验证。如果第一数据报文未通过安全验证，安全验证模块140丢弃数据报文。如果第一数据报文通过安全验证后，安全验证模块将第一数据报文返回至虚拟交换机120，由再虚拟交换机120转发至接收端310。
在虚拟交换机120提取第一数据报文的特征信息之前，虚拟交换机120确定第一数据报文是否为基于IP协议的报文，如果是，虚拟交换机120执行提取第一数据报文的特征信息的步骤。如果不是，虚拟交换机120确定第一数据报文是否经过安全验证。若第一数据报文未经过安全验证，将第一数据报文转发到安全验证模块。若虚拟交换机120确定第一数据报文为非基于IP协议的特殊报文，且该数据报文经过安全验证，则虚拟交换机120向接收端转发第一数据报文。
在虚拟交换机120确定第一数据报文为基于IP协议的报文之后，提取第一数据报文的特征信息之前，虚拟交换机120确定第一数据报文是否经过安全验证。若第一数据报文未经过安全验证，说明第一数据报文来自发送端300，那么，对于来自发送端300的基于IP协议的第一数据报文，虚拟交换机120执行提取第一数据报文的特征信息的步骤。若第一数据报文经过安全验证，说明基于IP协议的第一数据报文所属的数据流未配置加速转发规则，此时虚拟交换机120除了转发经过安全验证的第一数据报文之外，还可以根据第一数据报文的特征信息建立数据报文所属的数据流的加速转发规则。
本发明实施例中，虚拟交换机接收发送端转发的数据报文，以及虚拟交换机向接收端转发数据报文，都包含了发送端向接收端转发数据流或数据报文的过程中，需要虚拟交换机检查数据流或数据报文的各种情况。虚拟交换机接收发送端转发的数据报文，包括虚拟交换机从发送端接收数据报文，以及虚拟交换机经其他节点接收发送端的数据报文；虚拟交换机向接收端转发数据报文，包括向接收端转发数据报文，以及经其他节点向目接收端转发数据报文。其他节点包括但不限于物理交换机、其他虚拟交换机、网关、路由器等网络设备。本发明的实施例中，安全验证模块可以是Linux网桥。
图4为依据本发明一实施例的计算设备400的结构示意图。
如图4所示，服务器400包括处理器401，处理器401与系统内存402连接。处理器201可以为中央处理器(CPU)，图像处理器(Graphics Processing Unit，GPU),现场可编程门阵列(Field Programmable Gate Array，缩写：FPGA)，或数字信号处理器(英文：digital signal processor，DSP)等计算逻辑或以上任意计算逻辑的组合。处理器201可以为单核处理器或多核处理器。总线401用于在服务器400的各部件之间传递信息，总线403可以使用有线的连接方式或采用无线的连接方式，本申请并不对此进行限定。总线403还连接有通信接口404。通信接口404使用例如但不限于收发器一类的收发装置，来实现与其他设备或网络之间的通信，通信接口404可以通过有线或者无线的形式与网络互连。本发明实施例的方法可以由处理器401执行系统内存402中的软件代码来完成/支持
此外，图4仅仅是一个服务器400的例子，服务器400可能包含相比于图4展示的更多或者更少的组件，或者有不同的组件配置方式。同时，图2中展示的各种组件可以用硬件、软件或者硬件与软件的结合方式实施。
下面介绍本发明实施例中，虚拟交换机转发数据报文的流程。
在本发明的一个实施例中，虚拟交换机接收到数据流之后，首先判断数据流是否 来自安全验证模块，之后再判断接收到的数据流是否为基于IP协议的报文。具体流程如图5所示：
s501，虚拟交换机接收数据报文。
s502，虚拟交换机确定该数据报文是否经过安全验证。具体地，虚拟交换机可以通过判断该数据报文是否来自Linux网桥来确定数据报文是否经过安全验证。
s503，虚拟交换机判断该数据报文是否为基于IP协议的报文。虚拟交换机在s502中判断该数据报文未经过安全验证后执行本步骤。具体地，通过判断该数据报文所属的数据流是否具有特征信息，即可判断该数据报文是否为基于IP协议的报文。所属的数据流具有特征信息的报文为基于IP协议的报文，否则，则为非IP协议的特殊报文。本步骤将基于IP协议的报文和非IP协议的特殊报文区分开，以实现对两种报文的不同处理方式，保证了方法流程的完整性。数据流的特征信息包括可以是数据报文的IP五元组信息，IP五元组信息包括：发送端300的网络互联协议(Internet Protocol，IP)地址、接收端310的IP地址、发送端300的端口号、接收端310的端口号和该数据报文的传输层协议。传输层协议可以是TCP协议，也可以是UDP协议，分别对应TCP报文和UDP报文。
s504，虚拟交换机提取该数据报文所属的数据流的特征信息，用于步骤s505。虚拟交换机在s503中判断该数据报文为基于IP协议的报文后执行本步骤。
s505，虚拟交换机确定该数据报文所属的数据流是否配置了加速转发规则。本步骤中，虚拟交换机确定是否可以将数据报文绕过Linux网桥，直接向接收端转发。具体地，虚拟交换机根据步骤s504中提取的特征信息查询连接跟踪表。连接跟踪表是虚拟交换机中用于记录加速转发规则的表。连接跟踪表的表项包括数据流的特征信息。用提取的数据流的特征来查询连接跟踪表可以获知该数据报文所述的数据流是否配置了加速转发规则。
s506，虚拟交换机转发该数据报文至接收端。虚拟交换机在s505中确定该数据报文所属的数据流配置了加速转发规则后，执行本步骤。
s501、s502、s503、s504、s505、s506为虚拟交换机收到所属数据流配置了加速转发规则的数据报文时，转发该数据报文的流程，其中该数据流为基于IP协议的报文。在转发基于IP协议的报文时，虚拟交换机绕过Linux网桥，直接向接收端发送所述该数据报文，从而减少了数据报文在内核态和用户态之间的切换次数，提高数据报文转发的效率。
s507，虚拟交换机将该数据报文转发至Linux网桥进行安全验证。为保证方案的完整性，若虚拟交换机收到的基于IP协议的报文所属的数据流未配置加速转发规则，或者虚拟交换机收到的数据报文为特殊报文，虚拟交换机执行本步骤，使得数据报文在Linux网桥中进行安全验证。即，若虚拟交换机收到的该数据报文未经过安全验证，且为非IP协议的特殊报文，则虚拟交换机在s502、s503、s504、s505后执行本步骤。若虚拟交换机收到的该数据报文未经过安全验证，且为基于IP协议的报文，同时，该数据报文所属的数据流未配置加速转发规则，则虚拟交换机在s502中确定该数据报文未经过安全验证，在s503中判断该数据报文不是基于IP协议的报文，执行本步骤。
s508，Linux网桥对该数据报文进行安全验证并确认其是否通过验证。Linux网桥 中配置的IPTABLES可以完成数据流的安全验证。
s509，Linux网桥将该数据报文转发至虚拟交换机，使得虚拟交换机能够向接收端转发通过安全验证的数据报文。当s508中该数据报文在Linux网桥中通过安全验证，Linux网桥执行本步骤。本步骤完成之后，流程进行至s501、s502，即虚拟交换机接收该数据报文，并判断该数据报文是否经过安全验证。
s510，Linux网桥丢弃该数据报文，此时的该数据报文指的是未通过安全验证的数据报文，保证了方案的完整性。若s508中该数据报文在Linux网桥中未通过安全验证，Linux网桥执行本步骤，结束该数据报文的转发。
s511，虚拟交换机判断该数据报文是否为基于IP协议的报文。若s502中，虚拟交换机确定该数据报文已经过安全验证，则执行本步骤。本步骤区分已经过安全验证的数据报文，对基于IP协议的报文和特殊报文，分别在s512和s511中采取不同的转发流程。
s512，虚拟交换机根据该数据报文的特征信息建立该数据报文所属的数据流的加速转发规则，并向接收端发送该数据报文。本步骤在转发数据报文的同时，可以使得虚拟交换机此后转发该数据报文所述的数据流中的其他数据报文时，绕过Linux网桥。在若s511中，虚拟交换机判断该数据报文为基于IP协议的报文，执行本步骤。
s513，虚拟交换机向接收端发送该数据报文。若s511中，虚拟交换机判断该数据报文不是基于IP协议的报文，执行本步骤。
在本发明的另一个实施例中，虚拟交换机接收到数据报文之后，首先判断该数据报文是否来自Linux网桥，之后再判断该数据报文是否为基于IP协议的报文。具体流程如图6所示：
s601，虚拟交换机接收该数据报文。
s602，虚拟交换机确定该数据报文是否为基于IP协议的报文。若虚拟交换机在s602中判断该数据报文为基于IP协议的报文，执行本步骤。本步骤将基于IP协议的报文和非IP协议的特殊报文区分开，以实现对两种报文的不同处理方式，保证了方法流程的完整性。
s603，虚拟交换机确定该数据报文是否经过安全验证。本步骤将未经过Linux网桥的数据报文和已在Linux网桥中实现安全验证的数据报文区分开，保证了方案的完整性。
s604，虚拟交换机提取该数据报文的特征信息，用于步骤s605。若虚拟交换机在s603中确定该数据报文未经过安全验证，执行本步骤。
s605，虚拟交换机确定该数据报文所属的数据流是否配置了加速转发规则。具体地，虚拟交换机根据步骤s604中提取的特征信息查询连接跟踪表。本步骤中，虚拟交换机确定是否可以将数据报文绕过Linux网桥，直接向接收端转发。
s606，虚拟交换机转发该数据报文至接收端。虚拟交换机在s605中确定该数据报文所属的数据流配置了加速转发规则后，执行本步骤。
s601、s602、s603、s604、s605、s606为虚拟交换机收到所属数据流配置了加速转发规则的数据报文时，转发该数据报文的流程，其中该数据流为基于IP协议的报文。在转发基于IP协议的报文时，虚拟交换机绕过Linux网桥，直接向接收端发送所述该数 据报文，从而减少了数据报文在内核态和用户态之间的切换次数，提高数据报文转发的效率。
s607，虚拟交换机确定该数据报文是否经过安全验证。若虚拟交换机在s602中判断该数据报文不是基于IP协议的报文，执行本步骤。与s603相同，本步骤将未经过Linux网桥的数据报文和已在Linux网桥中实现安全验证的数据报文区分开，保证了方案的完整性。
s608，虚拟交换机将该数据报文转发至接收端。若s607中，虚拟交换机判断该数据报文已经过安全验证，执行本步骤。若该数据报文不是基于IP协议的报文，且已经过安全验证，则直接转发该数据报文。
s609，虚拟交换机将该数据报文转发至Linux网桥进行安全验证。若虚拟交换机收到的该数据报文为非IP协议的特殊报文，且未经过安全验证，则虚拟交换机在s602中确定该数据报文不是基于IP协议的报文，并在s607中确定该数据报文未经过安全验证，执行本步骤。若虚拟交换机收到的该数据报文为基于IP协议的报文，且未经过安全验证，同时，该数据报文所属的数据流未配置加速转发规则，则虚拟交换机在s602中确定该数据报文为基于IP协议的报文，并在s603中确定该数据报文未经过安全验证，在s305确定该数据报文所属的数据流未配置了加速转发规则后，执行本步骤。
s610，Linux网桥对该数据报文进行安全验证并确认其是否通过验证。Linux网桥中配置的IPTABLES可以完成数据流的安全验证。
s611，Linux网桥将该数据报文转发至虚拟交换机，使得虚拟交换机能够向接收端转发通过安全验证的数据报文。当s610中该数据报文在Linux网桥中通过安全验证，Linux网桥执行本步骤。本步骤完成之后，流程进行至s601、s602，即虚拟交换机接收该数据报文，并确定该数据报文是否为基于IP协议的报文。
s612，Linux网桥丢弃该数据报文。若s610中该数据报文在Linux网桥中未通过安全验证，Linux网桥执行本步骤，结束该数据报文的转发。
s613，虚拟交换机根据该数据报文的特征信息建立该数据报文所属的数据流的加速转发规则，并向接收端发送该数据报文。若虚拟交换机在s603中确定该数据报文已经过安全验证，执行本步骤。
本发明的实施例还提供一种虚拟交换机700，如图7所示。虚拟交换机700包括转发单元710、判断单元720和接口单元730。
在虚拟交换机700的一种具体实施方式中，
接口单元730用于接收数据报文；
判断单元720用于：
提取该数据报文的特征信息，根据提取的该数据报文的特征信息，确定该数据报文所属的数据流是否配置了加速转发规则。
若判断单元确定该数据报文所属的数据流配置了加速转发规则，转发单元710用于：绕过安全验证模块，向接收端发送该数据报文。
同时，若判断单元720确定该数据报文所属的数据流未配置加速转发规则，转发单元710还用于：将该数据报文转发到安全验证模块。
判断单元720还用于：
提取该数据报文的特征信息之前，确定该数据报文是否经过安全验证。
若确定该数据报文未经过安全验证，则执行提取该数据报文的特征信息的步骤。
若确定该数据报文经过安全验证，转发单元710还用于：提取该数据报文的特征信息，根据该数据报文的特征信息建立该数据报文所属的数据流的加速转发规则，转发单元还用于：向接收端发送该数据报文。
在确定该数据报文未经过安全验证之后，以及提取该数据报文的特征信息之前，判断单元720还用于：确定该数据报文是否为基于IP协议的报文，如果是，判断单元720执行提取该数据报文的特征信息的步骤。
若判断单元720确定该数据报文为非基于IP协议的报文，转发单元710还用于：将该数据报文转发到安全验证模块。
在虚拟交换机700的另一种具体实施方式中，
接收单元730用于接收数据报文；
判断单元720用于：
提取该数据报文的特征信息，根据提取的该数据报文的特征信息，确定该数据报文所属的数据流是否配置了加速转发规则。
若判断单元确定该数据报文所属的数据流配置了加速转发规则，转发单元710用于：绕过安全验证模块，向接收端发送该数据报文。
同时，若判断单元720确定该数据报文所属的数据流未配置加速转发规则，转发单元710还用于：将该数据报文转发到安全验证模块。
判断单元720还用于：
在提取该数据报文的特征信息之前，确定该数据报文是否为基于IP协议的报文，如果是，则执行提取该数据报文的特征信息的步骤。
若确定该数据报文为非基于IP协议的报文，则确定该数据报文是否经过安全验证。
若判断单元确认该数据报文未经过安全验证，转发单元710还用于：将第一数据报文转发到安全验证模块。
判断单元720还用于：
在确定该数据报文为基于IP协议的报文之后，提取该数据报文的特征信息之前，确定该数据报文是否经过安全验证。
若确认该数据报文未经过安全验证，则执行提取该数据报文的特征信息的步骤。
若确定该数据报文经过安全验证，判断单元720还用于：提取该数据报文的特征信息，根据该数据报文的特征信息建立该数据报文所属的数据流的加速转发规则。
转发单元710还用于根据判断单元确定该数据报文经过安全验证的判断结果，向接收端发送该数据报文。
具体地，虚拟交换机700中的各单元可以分别由对应的硬件芯片实现。另一种实现中，两个或三个单元可以集成在一个硬件芯片上。在另一种实现中，虚拟交换机700中的各单元也可以由处理器执行计算机指令实现。本发明实施例对此不作限定。
相应的，本发明实施例提供一种包含计算机指令的非易失性存储介质和计算机程 序产品，控制器执行计算机指令用于实现本发明实施例所描述的方案。
在本发明所提供的几个实施例中，应该理解到，所公开的装置、方法，可以通过其它的方式实现。例如，以上所描述的装置实施例所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的各个单元相互之间的耦合或直接耦合或通信连接可以是通过一些接口。
另外，在本发明各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以所述权利要求的保护范围为准。

Claims (34)

  1. 一种数据传送方法，其特征在于，包括：
    虚拟交换机接收第一数据报文；
    所述虚拟交换机提取所述第一数据报文的特征信息，根据提取的所述第一数据报文的特征信息，确定所述第一数据报文所属的数据流是否配置了加速转发规则，所述加速转发规则指示所述第一数据报文所属的数据流中的第二数据报文已经经过安全验证模块的验证且验证结果为安全；
    若所述第一数据报文所属的数据流配置了加速转发规则，所述虚拟交换机绕过所述安全验证模块向接收端发送所述第一数据报文。
  2. 根据权利要求1所述的方法，其特征在于，若所述第一数据报文所属的数据流未配置加速转发规则，还包括：
    所述虚拟交换机将所述第一数据报文转发到所述安全验证模块。
  3. 根据权利要求1所述的方法，其特征在于，所述虚拟交换机提取所述第一数据报文的特征信息之前，还包括：
    所述虚拟交换机确定所述第一数据报文是否经过安全验证，若所述第一数据报文未经过安全验证，所述虚拟交换机执行所述提取所述第一数据报文的特征信息的步骤。
  4. 根据权利要求3所述的方法，其特征在于，若所述虚拟交换机确定所述第一数据报文经过安全验证，还包括：
    所述虚拟交换机根据所述第一数据报文的特征信息建立所述第一数据报文所属的数据流的加速转发规则，并向接收端发送所述第一数据报文。
  5. 根据权利要求3所述的方法，其特征在于，在所述虚拟交换机确定所述第一数据报文未经过安全验证之后，以及提取所述第一数据报文的特征信息之前，还包括：
    所述虚拟交换机确定所述第一数据报文是否为基于网络互连协议(Internet Protocol，IP)协议的报文，如果是，所述虚拟交换机执行所述提取所述第一数据报文的特征信息的步骤。
  6. 根据权利要求5所述的方法，其特征在于，若所述虚拟交换机确定所述第一数据报文为非基于IP协议的报文，还包括：
    所述虚拟交换机将所述第一数据报文转发到所述安全验证模块。
  7. 根据权利要求1-6任意一项所述的方法，其特征在于，所述特征信息包括IP五元组信息，所述五元组信息包括：向所述虚拟交换机发送所述第一数据报文的发送端的IP地址、所述接收端的IP地址、所述发送端的端口号、所述接收端的端口号和所述第一数据报文的传输层协议；所述加速转发规则中包括所述IP五元组信息。
  8. 一种数据传送方法，其特征在于，包括：
    虚拟交换机接收第一数据报文；
    所述虚拟交换机提取所述第一数据报文的特征信息，根据提取的所述第一数据报文的特征信息，确定所述第一数据报文所属的数据流是否配置了加速转发规则，所述加速转发规则指示所述第一数据报文所属的数据流中的至少一个报文已经经过安全验证模块的验证且验证结果为安全；
    若所述第一数据报文所属的数据流配置了加速转发规则，所述虚拟交换机绕过所述安全验证模块向接收端发送所述第一数据报文。
  9. 根据权利要求8所述的方法，其特征在于，若所述第一数据报文所属的数据流未配置加速转发规则，还包括：
    所述虚拟交换机将所述第一数据报文转发到所述安全验证模块。
  10. 根据权利要求8所述的方法，其特征在于，在所述虚拟交换机提取所述第一数据报文的特征信息之前，还包括：
    所述虚拟交换机确定所述第一数据报文是否为基于网络互连协议(INTERNET PROTOCOL，IP)协议的报文，如果是，所述虚拟交换机执行所述提取所述第一数据报文的特征信息的步骤。
  11. 根据权利要求10所述的方法，其特征在于，若所述虚拟交换机确定所述第一数据报文为非基于IP协议的报文，还包括：
    所述虚拟交换机确定所述第一数据报文是否经过安全验证，若所述第一数据报文未经过安全验证，将所述第一数据报文转发到所述安全验证模块。
  12. 根据权利要求11所述的方法，其特征在于，若所述虚拟交换机确定所述第一数据报文为非基于IP协议的报文，且所述第一数据报文经过安全验证，还包括：
    所述虚拟交换机向接收端转发所述第一数据报文。
  13. 根据权利要求10所述的方法，其特征在于，在所述虚拟交换机确定所述第一数据报文为基于IP协议的报文之后，提取所述第一数据报文的特征信息之前，还包括：
    所述虚拟交换机确定所述第一数据报文是否经过安全验证，若所述第一数据报文未经过安全验证，所述虚拟交换机执行所述提取所述第一数据报文的特征信息的步骤。
  14. 根据权利要求13所述的方法，其特征在于，若所述虚拟交换机确定所述第一数据报文经过安全验证，还包括：
    所述虚拟交换机提取所述第一数据报文的特征信息，根据所述第一数据报文的特征信息建立所述第一数据报文所属的数据流的加速转发规则，向接收端转发所述第一数据报文。
  15. 根据权利要求10-14任意一项所述的方法，其特征在于，所述特征信息包括IP五元组信息，所述五元组信息包括：向所述虚拟交换机发送所述第一数据报文的发送端的IP地址、所述接收端的IP地址、所述发送端的端口号、所述接收端的端口号和所述第一数据报文的传输层协议；所述加速转发规则中包括所述IP五元组信息。
  16. 一种虚拟交换机，其特征在于，所述虚拟交换机包括接收单元、转发单元和判断单元；
    所述接收单元，用于接收第一数据报文；
    所述判断单元用于：提取所述第一数据报文的特征信息，根据提取的所述第一数据报文的特征信息，确定所述第一数据报文所属的数据流是否配置了加速转发规则，所述加速转发规则指示所述第一数据报文所属的数据流的第二数据报文已经经过安全验证模块的验证且验证结果为安全；
    所述转发单元用于，若所述判断单元确定所述第一数据报文所属的数据流配置了 加速转发规则，则绕过所述安全验证模块，向接收端发送所述第一数据报文。
  17. 根据权利要求16所述的虚拟交换机，其特征在于，若所述判断单元确定所述第一数据报文所属的数据流未配置加速转发规则，所述转发单元还用于将所述第一数据报文转发到所述安全验证模块。
  18. 根据权利要求16所述的虚拟交换机，其特征在于，
    提取所述第一数据报文的特征信息之前，所述判断单元还用于确定所述第一数据报文是否经过安全验证；
    若确定所述第一数据报文未经过安全验证，则执行所述提取所述第一数据报文的特征信息的步骤。
  19. 根据权利要求18所述的虚拟交换机，其特征在于，
    若确定所述第一数据报文经过安全验证，所述判断单元还用于提取所述第一数据报文的特征信息，根据所述第一数据报文的特征信息建立所述第一数据报文所属的数据流的加速转发规则，并向接收端发送所述第一数据报文。
  20. 根据权利要求18所述的虚拟交换机，其特征在于，
    在所述判断单元确定所述第一数据报文未经过安全验证之后，以及提取所述第一数据报文的特征信息之前，所述判断单元还用于确定所述第一数据报文是否为基于网络互连协议(Internet Protocol，IP)协议的报文，如果是，所述判断单元执行所述提取所述第一数据报文的特征信息的步骤。
  21. 根据权利要求20所述的虚拟交换机，其特征在于，
    若所述判断单元确定所述第一数据报文为非基于IP协议的报文，所述转发单元还用于将所述第一数据报文转发到所述安全验证模块。
  22. 根据权利要求16-21任意一项所述的方法，其特征在于，所述特征信息包括IP五元组信息，所述五元组信息包括：向所述虚拟交换机发送所述第一数据报文的发送端的IP地址、所述接收端的IP地址、所述发送端的端口号、所述接收端的端口号和所述第一数据报文的传输层协议；所述加速转发规则中包括所述IP五元组信息。
  23. 一种虚拟交换机，其特征在于，所述虚拟交换机包括接收单元、转发单元和判断单元；
    所述接收单元用于接收第一数据报文；
    所述判断单元用于：
    提取所述第一数据报文的特征信息，根据提取的所述第一数据报文的特征信息，确定所述第一数据报文所属的数据流是否配置了加速转发规则，所述加速转发规则指示所述第一数据报文所属的数据流中的第二数据报文已经经过安全验证模块的验证且验证结果为安全；
    所述转发单元用于，若所述判断单元确定所述第一数据报文所属的数据流配置了加速转发规则，则绕过所述安全验证模块，向接收端发送所述第一数据报文。
  24. 根据权利要求23所述的虚拟交换机，其特征在于，若所述判断单元确定所述第一数据报文所属的数据流未配置加速转发规则，所述转发单元还用于，将所述第一数据报文转发到所述安全验证模块。
  25. 根据权利要求23所述的虚拟交换机，其特征在于，
    在提取所述第一数据报文的特征信息之前，所述判断单元还用于：确定所述第一数据报文是否为基于网络互连协议(Internet Protocol，IP)协议的报文，如果是，则执行所述提取所述第一数据报文的特征信息的步骤。
  26. 根据权利要求25所述的虚拟交换机，其特征在于，所述判断单元还用于：若确定所述第一数据报文为非基于IP协议的报文，则确定所述第一数据报文是否经过安全验证；
    若所述判断单元确认所述第一数据报文未经过安全验证，所述转发单元还用于：将所述第一数据报文转发到所述安全验证模块。
  27. 根据权利要求26所述的虚拟交换机，其特征在于，所述转发单元还用于：向接收端转发所述第一数据报文。
  28. 根据权利要求25所述的虚拟交换机，其特征在于，所述判断单元还用于：
    在确定所述第一数据报文为基于IP协议的报文之后，提取所述第一数据报文的特征信息之前，确定所述第一数据报文是否经过安全验证；
    若确定所述第一数据报文未经过安全验证，则执行所述提取所述第一数据报文的特征信息的步骤。
  29. 根据权利要求28所述的虚拟交换机，其特征在于，所述判断单元还用于：
    若确定所述第一数据报文经过安全验证，提取所述第一数据报文的特征信息，根据所述第一数据报文的特征信息建立所述第一数据报文所属的数据流的加速转发规则；
    所述转发单元还用于根据所述判断单元确定所述第一数据报文经过安全验证的判断结果，向接收端发送所述第一数据报文。
  30. 根据权利要求23-29任意一项所述的方法，其特征在于，所述特征信息包括IP五元组信息，所述五元组信息包括：向所述虚拟交换机发送所述第一数据报文的发送端的IP地址、所述接收端的IP地址、所述发送端的端口号、所述接收端的端口号和所述第一数据报文的传输层协议；所述加速转发规则中包括所述IP五元组信息。
  31. 一种非易失性的计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有计算机指令，所述计算机指令用于实现如权利要求1-7中任一项所述的方法。
  32. 一种非易失性的计算机可读存储介质，其特征在于，所述计算机可读存储介质上存储有计算机指令，所述计算机指令用于实现如权利要求8-15中任一项所述的方法。
  33. 一种计算设备，其特征在于，所述计算设备包括处理器和存储器；
    所述存储器用于存储执行指令，当所述计算设备运行时，所述处理器执行所述存储器存储的所述执行指令，以使所述计算设备执行权利要求1-15任一项所述的方法。
  34. 一种计算设备，其特征在于，所述计算设备包括处理器和存储器；
    所述存储器用于存储执行指令，当所述计算设备运行时，所述处理器执行所述存储器存储的所述执行指令，以使所述计算设备执行权利要求16-22任一项所述的方法。
PCT/CN2017/119103 2017-12-27 2017-12-27 一种数据传送的方法和虚拟交换机 WO2019127134A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
CN201780040463.2A CN109496409B (zh) 2017-12-27 2017-12-27 一种数据传送的方法和虚拟交换机
EP17936903.8A EP3720075B1 (en) 2017-12-27 2017-12-27 Data transmission method and virtual switch
PCT/CN2017/119103 WO2019127134A1 (zh) 2017-12-27 2017-12-27 一种数据传送的方法和虚拟交换机
US16/910,954 US11689501B2 (en) 2017-12-27 2020-06-24 Data transfer method and virtual switch

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/119103 WO2019127134A1 (zh) 2017-12-27 2017-12-27 一种数据传送的方法和虚拟交换机

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/910,954 Continuation US11689501B2 (en) 2017-12-27 2020-06-24 Data transfer method and virtual switch

Publications (1)

Publication Number Publication Date
WO2019127134A1 true WO2019127134A1 (zh) 2019-07-04

Family

ID=65688976

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/119103 WO2019127134A1 (zh) 2017-12-27 2017-12-27 一种数据传送的方法和虚拟交换机

Country Status (4)

Country Link
US (1) US11689501B2 (zh)
EP (1) EP3720075B1 (zh)
CN (1) CN109496409B (zh)
WO (1) WO2019127134A1 (zh)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109496409B (zh) * 2017-12-27 2020-10-23 华为技术有限公司 一种数据传送的方法和虚拟交换机
CN112073317B (zh) * 2019-06-10 2022-01-07 华为技术有限公司 一种发送报文流量的方法和装置
CN112398728B (zh) * 2019-08-14 2024-03-08 中兴通讯股份有限公司 虚拟网关平滑演进方法、网关设备及存储介质
CN110768865B (zh) * 2019-10-23 2021-08-27 新华三信息安全技术有限公司 一种深度报文检测引擎激活方法、装置及电子设备
CN114979028B (zh) * 2021-02-26 2024-02-23 中移(苏州)软件技术有限公司 一种数据包处理方法、装置以及存储介质
CN113556323B (zh) * 2021-06-24 2023-04-07 深圳市邦盛实时智能技术有限公司 一种应用于企业内控的旁路无侵入流量采集系统
CN115208682B (zh) * 2022-07-26 2023-12-12 上海欣诺通信技术股份有限公司 一种基于snort的高性能网络攻击特征检测方法及装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104243447A (zh) * 2014-07-24 2014-12-24 深圳市共进电子股份有限公司 一种基于Netfilter防火墙的数据流处理方法及装置
CN104301321A (zh) * 2014-10-22 2015-01-21 北京启明星辰信息技术股份有限公司 一种实现分布式网络安全防护的方法及系统
CN105745886A (zh) * 2013-09-23 2016-07-06 迈克菲股份有限公司 在两个实体之间提供快速路径

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100522138B1 (ko) * 2003-12-31 2005-10-18 주식회사 잉카인터넷 신뢰할 수 있는 프로세스를 허용하는 유연화된 네트워크보안 시스템 및 그 방법
US8789135B1 (en) * 2012-06-15 2014-07-22 Google Inc. Scalable stateful firewall design in openflow based networks
CN103609070B (zh) * 2012-10-29 2016-10-05 华为技术有限公司 网络流量检测方法、系统、设备及控制器
EP3016322B1 (en) * 2013-07-23 2019-01-16 Huawei Technologies Co., Ltd. Packet forwarding method and device
US9438612B1 (en) * 2015-03-23 2016-09-06 Fortinet, Inc. Calculating consecutive matches using parallel computing
CN104994094B (zh) 2015-07-01 2016-11-30 北京奇虎科技有限公司 基于虚拟交换机的虚拟化平台安全防护方法、装置和系统
CN105262840A (zh) * 2015-11-05 2016-01-20 浪潮(北京)电子信息产业有限公司 一种数据传输中间件及广域网存储系统
US10079805B2 (en) * 2016-06-13 2018-09-18 Fujitsu Limited Bypassing a firewall for authorized flows using software defined networking
EP3286900B1 (en) * 2016-06-22 2019-03-27 Huawei Technologies Co., Ltd. System and method for detecting and preventing network intrusion of malicious data flows
CN107396450B (zh) * 2017-07-19 2020-02-14 上海华为技术有限公司 一种跨制式的调度方法及基站
US10708229B2 (en) * 2017-11-15 2020-07-07 Nicira, Inc. Packet induced revalidation of connection tracker
CN109496409B (zh) * 2017-12-27 2020-10-23 华为技术有限公司 一种数据传送的方法和虚拟交换机

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105745886A (zh) * 2013-09-23 2016-07-06 迈克菲股份有限公司 在两个实体之间提供快速路径
CN104243447A (zh) * 2014-07-24 2014-12-24 深圳市共进电子股份有限公司 一种基于Netfilter防火墙的数据流处理方法及装置
CN104301321A (zh) * 2014-10-22 2015-01-21 北京启明星辰信息技术股份有限公司 一种实现分布式网络安全防护的方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3720075A4 *

Also Published As

Publication number Publication date
CN109496409B (zh) 2020-10-23
EP3720075B1 (en) 2023-06-21
US20200322313A1 (en) 2020-10-08
CN109496409A (zh) 2019-03-19
EP3720075A4 (en) 2020-11-18
EP3720075A1 (en) 2020-10-07
US11689501B2 (en) 2023-06-27

Similar Documents

Publication Publication Date Title
WO2019127134A1 (zh) 一种数据传送的方法和虚拟交换机
US20200412578A1 (en) NSH Encapsulation for Traffic Steering
US10616379B2 (en) Seamless mobility and session continuity with TCP mobility option
US11979322B2 (en) Method and apparatus for providing service for traffic flow
CN107682284B (zh) 发送报文的方法和网络设备
EP3142310B1 (en) Method, device, and system for configuring flow entries
US20160301603A1 (en) Integrated routing method based on software-defined network and system thereof
US10050870B2 (en) Handling multipath flows in service function chaining
US9462088B2 (en) Offload operations for overlay networks
WO2015196849A1 (zh) 一种数据报文的处理方法、业务节点以及引流点
WO2015143802A1 (zh) 业务功能链处理方法及装置
WO2014205784A1 (zh) 一种在nvo3网络中处理组播报文的方法、装置和nvo3网络
WO2014139481A1 (zh) 报文处理方法及设备
WO2018001242A1 (zh) 一种数据报文处理方法及装置
CN111049910A (zh) 一种处理报文的方法、装置、设备及介质
WO2017000802A1 (zh) 一种业务故障定位方法及装置
WO2015027401A1 (zh) 报文处理方法、设备及系统
US20160099891A1 (en) Packet processing method, apparatus and system
WO2014190843A1 (zh) 生成输入参数的方法及设备
WO2022100511A1 (zh) 转发表项的处理方法和装置
WO2015010514A1 (zh) 一种信号转换方法、装置及系统
WO2023179656A1 (zh) 一种SRv6报文处理方法、装置、通信设备和存储介质
WO2014183579A1 (zh) 控制数据转发的方法及逻辑交换机
WO2022183927A1 (zh) 一种报文传输方法及装置
CN110505137B (zh) 功能扩展式有线网络装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17936903

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017936903

Country of ref document: EP

Effective date: 20200701