WO2023245721A1

WO2023245721A1 - Method and apparatus for traffic orchestration

Info

Publication number: WO2023245721A1
Application number: PCT/CN2022/103302
Authority: WO
Inventors: 王洪波; 张慧翔; 李金恒; 王婷婷
Original assignee: 天津天睿科技有限公司
Priority date: 2022-06-23
Filing date: 2022-07-01
Publication date: 2023-12-28
Also published as: CN114827045A; CN114827045B

Abstract

Embodiments of the present invention relate to the technical field of networks, and provide a method and apparatus for traffic orchestration. The method comprises: determining whether received current traffic is preset traffic to be orchestrated; when the current traffic is the preset traffic to be orchestrated, determining a preset destination device sequence list corresponding to orchestration of the current traffic; and controlling the current traffic to sequentially enter destination devices in the preset destination device sequence list, so as to orchestrate the current traffic. Thus, received traffic is screened, and not all the traffic is orchestrated, so as to implement fine-grained flow orchestration.

Description

Methods and apparatus for traffic orchestration

Cross-references to related applications

This application claims the rights and interests of Chinese patent application 202210715957.9 submitted on June 23, 2022. The content of this application is incorporated into this article by reference.

Technical field

The present invention relates to the field of network technology, and specifically to a method and device for traffic orchestration.

Background technique

Network security is receiving more and more attention and plays an important role in national security. Currently, many security devices require the switch traffic mirroring function to divert traffic when analyzing traffic. However, there are some problems with this approach.

There are many shortcomings in the existing technology: (1) The currently commonly used traffic orchestration method is to use the traffic mirroring function of the switch to direct all traffic in and out of a certain switch port into network security devices (such as IDS intrusion detection system, IPS intrusion prevention). system, etc.) or other traffic analysis systems, all traffic will be imported, and the traffic that the user is interested in cannot be identified and imported. For example, the user only wants TCP traffic or all traffic with destination port 80 to be imported, the switch The traffic mirroring function does not support this kind of fine-grained traffic orchestration function; (2) The traffic mirroring function of the switch can only realize the traffic import of a single device, but cannot realize the traffic import of multiple devices in a certain sequence. For example, using The traffic first passes through the IDS system, then the IPS system, and finally the WAF system, making it impossible to implement the traffic orchestration function of multiple devices.

Contents of the invention

The purpose of the embodiments of the present invention is to provide a method and device for traffic orchestration, which can solve or at least partially solve the above problems.

In order to achieve the above object, one aspect of an embodiment of the present invention provides a method for traffic orchestration. The method includes: determining whether the current received traffic is preset traffic to be arranged; when the current traffic is the preset traffic In the case of traffic to be arranged, determine a preset destination device sequence table corresponding to the arrangement of the current traffic; and control the current traffic to enter the destination devices in the preset destination device sequence table in sequence, so as to all Describe the current traffic for orchestration.

Optionally, determining whether the current flow is the preset flow to be arranged includes: judging whether the current flow is the preset flow to be arranged according to any of the following: identification information corresponding to the current flow Whether it is the preset identification information and the traffic orchestration mark in the session record corresponding to the current traffic, wherein the traffic orchestration mark indicates whether the corresponding traffic is the preset traffic to be orchestrated.

Optionally, the identification information is five-tuple information, a data string, or a feature code, and the preset identification information is preset five-tuple information, a preset data string, or a preset feature code.

Optionally, when determining whether the current traffic is the preset traffic to be arranged according to the traffic orchestration mark in the session record corresponding to the current traffic, the current traffic is determined according to the traffic orchestration mark. Whether it is the preset traffic to be orchestrated, the method further includes: obtaining the traffic orchestration mark corresponding to the current traffic.

Optionally, obtaining the traffic orchestration mark corresponding to the current traffic includes: determining whether the current traffic is the first time traffic; and if the current traffic is the first time traffic, for the current traffic Create a session record and establish the traffic orchestration mark in the created session record, and obtain the established traffic orchestration mark from the created session record to obtain the traffic orchestration mark corresponding to the current flow; and/or If the current traffic is not the first traffic, obtain the traffic orchestration mark in the historical session record corresponding to the current traffic to obtain the traffic orchestration mark corresponding to the current traffic.

Optionally, controlling the current traffic to sequentially enter the destination devices in the preset destination device sequence table includes: determining the next destination device that the current traffic will enter; directing the current traffic to the determined Next destination device, so that the current traffic enters the determined next destination device; receives the current traffic again, wherein receiving the current traffic again is receiving from the determined next destination device; judging the determined Whether the next destination device is the last destination device in the preset destination device sequence list; in the case where the determined next destination device is the last destination device, control the current traffic to enter the preset sequence in sequence. Assume the destination device in the destination device sequence list; and if the determined next destination device is not the last destination device, repeat the steps of determining the next destination device and directing the current traffic to the determined next destination. The device receives the current traffic again and determines whether it is the last destination device until the determined next destination device is the last destination device.

Optionally, directing the current traffic to the determined next destination device includes: modifying the destination MAC address of the packet of the current flow to the determined MAC address of the next destination device and changing the The source MAC address of the current traffic packet is modified to the MAC address of the device running the method used for traffic orchestration.

Accordingly, another aspect of the embodiment of the present invention provides a device for traffic orchestration. The device includes: a traffic judgment module for judging whether the current received traffic is the preset traffic to be arranged; the preset destination device a sequence table determination module, configured to determine a preset destination device sequence table corresponding to the current flow when the current flow is the preset flow to be arranged; and a control module, used to control all The current traffic sequentially enters the destination devices in the preset destination device sequence table to arrange the current traffic.

Optionally, the flow judgment module determines whether the current traffic is the preset flow to be arranged, including: judging whether the current flow is the preset flow to be arranged according to any of the following: the current flow is the preset flow to be arranged. Whether the identification information corresponding to the traffic is preset identification information and the traffic orchestration mark in the session record corresponding to the current traffic, wherein the traffic orchestration mark indicates whether the corresponding traffic is the preset traffic to be orchestrated.

Optionally, the device further includes: a traffic orchestration mark acquisition module, configured to determine whether the current traffic is the preset traffic to be orchestrated according to the traffic orchestration mark in the session record corresponding to the current traffic. , before determining whether the current traffic is the preset traffic to be arranged according to the traffic orchestration mark, obtain the traffic orchestration mark corresponding to the current flow.

Optionally, the traffic orchestration mark acquisition module obtains the traffic orchestration mark corresponding to the current flow including: determining whether the current flow is the first time traffic; and if the current flow is the first time traffic, Create a session record for the current traffic and establish the traffic orchestration mark in the created session record, and obtain the established traffic orchestration mark from the created session record to obtain the traffic orchestration corresponding to the current flow. mark; and/or if the current traffic is not the first traffic, obtain the traffic orchestration mark in the historical session record corresponding to the current flow to obtain the traffic orchestration mark corresponding to the current flow.

Optionally, the control module controlling the current traffic to sequentially enter the destination devices in the preset destination device sequence table includes: determining the next destination device that the current traffic will enter; directing the current traffic to the destination device. The determined next destination device, so that the current traffic enters the determined next destination device; receiving the current traffic again, wherein receiving the current traffic again is receiving from the determined next destination device; judging Whether the determined next destination device is the last destination device in the preset destination device sequence list; if the determined next destination device is the last destination device, complete the control of the current traffic entering all the destination devices in sequence. The destination device in the preset destination device sequence list; and if the determined next destination device is not the last destination device, repeat the steps of determining the next destination device and directing the current traffic to the determined next destination device. A destination device receives the current traffic again and determines whether it is the last destination device until the determined next destination device is the last destination device.

In addition, another aspect of the embodiments of the present invention also provides a machine-readable storage medium. The machine-readable storage medium stores instructions. The instructions are used to cause the machine to execute the above method.

In addition, another aspect of the embodiment of the present invention also provides a processor for running a program, wherein the program is used to perform the above method when run.

Through the above technical solution, it is judged whether the current traffic received is the traffic to be arranged by default, and the current traffic is arranged only when it is the traffic to be arranged by default. In this way, the received traffic is filtered, not all Traffic is orchestrated to achieve fine-grained flow orchestration; in addition, the preset traffic to be orchestrated can be set according to user interests, so that the traffic that the user is interested in can be identified and imported; in addition, Control the current traffic to enter the destination device sequentially according to the preset destination device sequence table. In this way, multiple devices can import traffic in a certain order and realize the traffic orchestration function of multiple devices.

Other features and advantages of embodiments of the present invention will be described in detail in the detailed description that follows.

Description of the drawings

The drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the description. Together with the following specific implementation modes, they are used to explain the embodiments of the present invention, but do not constitute a limitation to the embodiments of the present invention. In the attached picture:

Figure 1 is a flow chart of a method for traffic orchestration provided by an embodiment of the present invention;

Figure 2 is a logical schematic diagram of a method for traffic orchestration provided by another embodiment of the present invention;

Figure 3 is a schematic diagram of traffic flow provided by another embodiment of the present invention; and

Figure 4 is a structural block diagram of a device for traffic orchestration provided by another embodiment of the present invention.

Explanation of reference signs

1. Traffic judgment module; 2. Preset destination device sequence table determination module; 3. Control module.

Detailed ways

Specific implementation modes of the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific implementations described here are only used to illustrate and explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention.

One aspect of embodiments of the present invention provides a method for traffic orchestration.

Figure 1 is a flow chart of a method for traffic orchestration provided by an embodiment of the present invention. As shown in Figure 1, the method includes the following contents.

In step S10, it is determined whether the received current traffic is the preset flow to be arranged. If the current flow is the preset flow to be arranged, step S11 is executed. If the current flow is not the preset flow to be arranged, step S13 is executed. Among them, the preset traffic to be orchestrated is the traffic that is preset to be orchestrated. In addition, the preset traffic to be arranged can be determined according to specific circumstances. For example, the traffic to be arranged is set according to the user's interests, and the traffic that the user is interested in is set to be the preset traffic to be arranged. For example, it can be determined whether the current traffic is the preset traffic by comparing the received current traffic with the preset traffic to be arranged. Optionally, the identification information of the traffic can be used to compare the current traffic with the preset traffic to be arranged. Specifically, by judging whether the identification information corresponding to the current flow is the preset identification corresponding to the preset traffic to be arranged. information to determine whether the current traffic is the preset traffic to be arranged. For example, the identification information may be five-tuple information, a data string, a feature code, or the like. Among them, the five-tuple information includes the source address, destination address, source port, destination port and protocol of the traffic. Optionally, set the preset five-tuple information or data string or feature code of the traffic to be arranged as the preset five-tuple information or the preset data string or the preset feature code, and use the received five-tuple information of the current traffic as the preset five-tuple information or the preset data string or the preset feature code. Compare the tuple information or data string or feature code with the preset five-tuple information or preset data string or preset feature code to determine whether the five-tuple information, data string or feature code of the current traffic is Preset five-tuple information or preset data strings or preset feature codes to determine whether the current traffic is the preset traffic to be arranged. That is, in the embodiment of the present invention, the identification information may be five-tuple information, and the preset identification information may be preset five-tuple information; or the identification information may be a data string, and the preset identification information may be preset Data string; alternatively, the identification information may be a feature code, and the preset identification information may be a preset feature code. In addition, whether the current traffic is preset traffic can be determined based on the traffic orchestration mark in the session record corresponding to the current traffic. Among them, the traffic orchestration mark indicates whether the corresponding traffic is preset traffic to be orchestrated. Specifically, when the traffic orchestration mark corresponding to the current flow indicates that the current flow is not the traffic to be arranged by default, it is determined that the current flow is not the traffic to be arranged by default, and when the traffic orchestration mark corresponding to the current flow indicates that the current flow is the traffic to be arranged by default When there is traffic, it is judged that the current traffic is the traffic to be arranged by default. Specifically, the traffic orchestration tag is a variable in the session record. Assigning different values to it indicates different content. For example, assigning a value of 0 to the tag variable indicates that the corresponding traffic is not the preset traffic, and assigning a value of 1 to the tag variable indicates that The corresponding traffic is the traffic to be arranged by default.

In step S11, a preset destination device sequence table corresponding to the arrangement of the current traffic is determined. The preset destination device sequence list includes at least one destination device. In addition, the destination device can be an IDS (Intrusion Detection System), IPS (Intrusion Prevention System), WAF (Web Firewall), DPI (Deep Packet Inspection) and other devices used to analyze traffic. In addition, the preset destination device sequence table is preset, and the preset destination device sequence table indicates the destination devices included in the traffic arrangement and the order in which the traffic passes through the destination devices. It should be noted that when the preset destination device sequence table includes only one destination device, the traffic only passes through the one destination device, and the sequence also only passes through the one destination device. For example, when setting which traffic is preset to be orchestrated, a preset destination device sequence table is set for the preset traffic to be orchestrated. When it is determined that the current traffic is the preset traffic to be orchestrated, the sequence table will be set with The preset destination device sequence table corresponding to the current traffic to be arranged is determined as the preset destination device sequence table corresponding to the current traffic arrangement. In the case where the current traffic is compared with the preset traffic to be arranged by means of the identification information of the traffic, a preset destination device sequence table may be set for the preset identification information; specifically, when the identification information of the current flow is the preset If identification information is provided, the preset destination device sequence table corresponding to the preset identification information corresponding to the identification information of the current flow is determined as the preset destination device sequence table corresponding to the arrangement of the current flow. In addition, the preset destination device sequence table can be recorded in the session record. When the current flow is determined to be preset to be arranged according to the traffic orchestration mark in the session record corresponding to the current flow, the current flow is arranged to the corresponding preset purpose. If the device sequence table is recorded in the session record corresponding to the current flow, the preset destination device sequence table corresponding to the current flow can be obtained from the session record corresponding to the current flow to determine the preset destination device sequence table corresponding to the current flow. .

In step S12, the current traffic is controlled to enter the destination devices in the preset destination device sequence list in order to arrange the current traffic. Wherein, when the preset destination device sequence table includes only one destination device, the current traffic is controlled to enter the one destination device; when the preset destination device sequence table includes at least two destination devices, the current traffic is controlled according to the preset purpose. The order of destination devices indicated in the device sequence table controls current traffic entering these at least two destination devices.

In step S13, the route is searched for normal forwarding. Forward the current traffic to the destination normally, for example, to the destination server.

Optionally, in the embodiment of the present invention, when determining whether the current flow is preset traffic to be arranged based on the traffic orchestration mark in the session record corresponding to the current flow, it is determined based on the traffic orchestration mark whether the current flow is preset traffic. Before setting the traffic to be orchestrated, the method also includes: obtaining the traffic orchestration mark corresponding to the current traffic.

Optionally, in this embodiment of the present invention, obtaining the traffic orchestration mark corresponding to the current traffic may include the following content. Determine whether the current traffic is the first traffic. Among them, first-time traffic refers to the traffic in which the corresponding data packet is received for the first time. To determine whether the current traffic is the first-time traffic is to determine whether the data packet corresponding to the current traffic is received for the first time. For example, whether the current traffic is the first traffic can be judged based on the five-tuple information. Specifically, obtain the five-tuple information of the current traffic, determine whether there is a historical session record matching the obtained five-tuple information, and determine whether the current traffic is the first traffic. Among them, the session record is created based on the traffic using five-tuple information, for example, using the hash map algorithm, and the created session record will be saved. If a data packet of a certain flow has been received before, a session record corresponding to the flow has been established before; if a data packet of a certain flow has not been received before, a session record corresponding to the flow has not been established. Therefore, it can be determined whether the current traffic is the first traffic by determining whether there is a historical session record matching the received five-tuple information of the current traffic. When the current traffic is the first traffic, create a session record for the current traffic and establish a traffic orchestration mark in the created session record. Obtain the established traffic orchestration mark from the created session record to obtain the traffic corresponding to the current traffic. Traffic orchestration tags. Among them, establishing a traffic orchestration mark is based on whether the current traffic is a preset traffic to be orchestrated. When the current traffic is a preset traffic to be orchestrated, the established traffic orchestration mark indicates that the current traffic is a preset traffic to be orchestrated. Traffic; when the current traffic is not the default traffic to be orchestrated, the established traffic orchestration mark indicates that the current traffic is not the default traffic to be orchestrated. Specifically, whether the current flow is preset flow to be arranged can be determined based on whether the identification information of the current flow is preset identification information. Specifically, reference can be made to the method described in the above embodiment. And/or if the current traffic is not the first traffic, obtain the traffic orchestration mark in the historical session record corresponding to the current traffic to obtain the traffic orchestration mark corresponding to the current traffic.

Optionally, in this embodiment of the present invention, controlling the current traffic to sequentially enter the destination devices in the preset destination device sequence list may include the following content. Determine the next destination device that current traffic will enter. For example, parse the protocol header of the current traffic packet, determine the current destination device from which the current traffic comes or has just entered based on the parsed source MAC address, and compare the determined current destination device with the preset destination device sequence table. The included destination devices are compared to determine whether there is a destination device in the preset destination device sequence table that is the same as the determined current destination device. If there is no destination device that is the same as the determined current destination device in the preset destination device sequence table, the first destination device ranked first in the preset destination device sequence table will be the next destination device; if the preset destination device If there is a destination device that is the same as the determined current destination device in the sequence table, the destination device ranked after the destination device that is the same as the determined current destination device in the preset destination device sequence table is the next destination device. The preset destination device sequence table indicates the sequence relationship between destination devices. By comparing the current destination device with the preset destination device sequence table, the next destination device can be determined. Specifically, when comparing the current destination device with the destination devices in the preset destination device sequence table, the identification information of the device (for example, name, number, source MAC address, etc. that can distinguish the device) Make a comparison. For example, the identification information may be a source MAC address. The preset destination device sequence table includes the source MAC address of the destination device. The source MAC address of the current destination device is compared with the source MAC address of the destination device in the preset destination device sequence table. right. Direct the current traffic to the determined next destination device, so that the current traffic enters the determined next destination device. For example, the destination MAC address of the packets of the current flow can be modified to the MAC address of the determined next destination device and the source MAC address of the packets of the current flow can be modified to that of the device running the method for traffic orchestration. MAC address to direct the current traffic to the determined next destination device. Receive the current traffic again, wherein receiving the current traffic again is receiving from the determined next destination device. Determine whether the determined next destination device is the last destination device in the preset destination device sequence list. Among them, the last destination device refers to the destination device ranked last in the preset destination device sequence list. Specifically, the next destination device may be compared with the last destination device in the preset destination device sequence list. For example, the identification information of the device may be compared to determine whether the next destination device is the last destination device. In the case where the determined next destination device is the last destination device, control of the current traffic is completed to sequentially enter the destination devices in the preset destination device sequence table. Among them, after completing the control of the current traffic entering the destination devices in the preset destination device sequence table, the operation of finding the route and forwarding it normally can be performed. Among them, the route can be recorded in the session record, and forwarding can be performed based on the route in the session record. If the determined next destination device is not the last destination device, repeat the operations of determining the next destination device, directing the current traffic to the determined next destination device, receiving the current traffic again, and determining whether it is the last destination device. , until the determined next destination device is the final destination device.

Figure 2 is a logical schematic diagram of a method for traffic orchestration provided by another embodiment of the present invention. Among them, the technical solution provided by the embodiment of the present invention mainly includes two aspects. One is to use traffic orchestration tags to match traffic, and the other is to forward traffic to designated devices in a customized order. The following is an exemplary introduction to the method for traffic orchestration provided by the embodiment of the present invention with reference to Figure 2. In this embodiment, the traffic to be arranged is preset to be the traffic of interest.

As shown in Figure 2, the method includes the following contents. The client initiates a request for input traffic, and the requested traffic is the current traffic. Current traffic input. Get the 5-tuple information of the current traffic. Determine whether there is a session record matching the five-tuple information of the current traffic. If it exists, the current traffic is not the first traffic, and the subsequent content is executed according to the information of the session record that matches the five-tuple information of the current traffic. If it does not exist, the current traffic is the first traffic, and the five-tuple information is used to create a session record for the current traffic using the hash map algorithm. Get the data string or feature code of the current traffic. Determine whether the current traffic matches the five-tuple information, data string or feature code, pre-set the five-tuple information, data string or feature code corresponding to the traffic of interest, and determine the pre-set five-tuple information or data string Or whether there is five-tuple information or data string or feature code in the characteristic code that matches the current traffic, that is, it is judged whether the five-tuple information of the current traffic is the preset five-tuple information, or whether it is the data string of the current traffic. Whether it is a preset data string, or whether the feature code of the current traffic is a preset feature code. If so, it means that the current traffic is the traffic of interest; mark the interest, that is, the traffic orchestration mark indicates that the current traffic is the traffic of interest; obtain the preset destination device sequence table corresponding to the current traffic and record it into the created session record Medium; find the route and record it into the created session record. After the current traffic enters the destination device in the preset destination device sequence table in turn, it can be forwarded normally according to the routing information in the session record; perform the follow-up according to the information in the created session record. content. If not, it means that the current traffic is not the traffic of interest; mark it as not interesting, that is, the traffic orchestration mark indicates that the current traffic is not the traffic of interest; find the route and record it in the created session record; press the created session record Information execution subsequent content. Determine whether the current traffic is interesting traffic based on the tags (traffic orchestration tags) in the session record. If not, it will be forwarded based on the route in the session record corresponding to the current traffic. If so, the next destination device is determined according to the session record corresponding to the current flow, that is, the next destination device is determined according to the preset destination device sequence table recorded in the session record corresponding to the current flow. Specifically, the method described in the above embodiment can be used to determine the next destination device. Modify the destination MAC address of the packets of the current flow to the MAC address of the determined next destination device and modify the source MAC address of the packets of the current flow to the MAC address of the device running the method for traffic orchestration, and change the current Traffic is sent to the determined next destination device. The next destination device receives the current traffic analysis and then returns the current traffic, that is, it receives the current traffic again. Among them, the routing address for returning current traffic from the next destination device can be set in advance. Determine whether the next destination device is the last destination device according to the session record, that is, determine whether the next destination device is the last destination device according to the preset destination device sequence table recorded in the session record. Specifically, see what is described in the above embodiment. method. If so, it will be forwarded based on the route in the session record corresponding to the current traffic. If not, return to the step of "Determine the next destination device based on the session record corresponding to the current traffic" and continue to repeat the subsequent content. At this time, the next destination device becomes the current destination device that the current traffic has just entered. After forwarding according to the route in the session record corresponding to the current traffic, the destination server receives the current traffic.

The technical solution provided by the embodiment of the present invention can be used to identify the corresponding traffic (that is, to filter the traffic), without rushing to forward it to the real destination, but first through the devices to be arranged in sequence. As shown in Figure 3, the traffic Pass through IDS, WAF in turn, and finally reach the destination server. Among them, in Figure 3, the traffic orchestration system is the product corresponding to the method for traffic orchestration provided by the embodiment of the present invention.

The technical solution provided by the embodiment of the present invention can solve the deficiencies of the switch's traffic mirroring function, realize fine-grained identification of traffic, and import the identified traffic into designated devices in a customized order for analysis.

Accordingly, another aspect of the embodiment of the present invention provides an apparatus for traffic orchestration.

Figure 4 is a structural block diagram of a device for traffic orchestration provided by another embodiment of the present invention. As shown in Figure 4, the device includes a flow judgment module 1, a preset destination equipment sequence table determination module 2 and a control module 3. Among them, the traffic judgment module 1 is used to judge whether the current received traffic is a preset flow to be arranged; the preset destination device sequence table determination module 2 is used to determine whether the current flow is a preset flow to be arranged. The current traffic is arranged in a corresponding preset destination device sequence table; the control module 3 is used to control the current traffic to enter the destination devices in the preset destination device sequence table in order to arrange the current traffic.

Optionally, in the embodiment of the present invention, the flow judgment module determines whether the current flow is the preset flow to be arranged, including: judging whether the current flow is the preset flow to be arranged according to any of the following: identification information corresponding to the current flow Whether it is preset identification information and the traffic orchestration mark in the session record corresponding to the current traffic, where the traffic orchestration mark indicates whether the corresponding traffic is preset traffic to be orchestrated.

Optionally, in the embodiment of the present invention, the identification information is five-tuple information, a data string, or a feature code, and the preset identification information is preset five-tuple information, a preset data string, or a preset feature code.

Optionally, in the embodiment of the present invention, the device further includes: a traffic orchestration mark acquisition module, used to determine whether the current flow is preset traffic to be orchestrated based on the traffic orchestration mark in the session record corresponding to the current flow. Next, before judging whether the current traffic is the preset traffic to be orchestrated based on the traffic orchestration tag, obtain the traffic orchestration tag corresponding to the current flow.

Optionally, in the embodiment of the present invention, the traffic orchestration mark acquisition module obtains the traffic orchestration mark corresponding to the current flow, including: determining whether the current flow is the first time traffic; and if the current flow is the first time traffic, creating a session for the current flow. Record and create a traffic orchestration mark in the created session record, obtain the created traffic orchestration mark from the created session record, to obtain the traffic orchestration mark corresponding to the current flow; and/or when the current flow is not the first traffic flow Next, obtain the traffic orchestration tags in the historical session records corresponding to the current traffic to obtain the traffic orchestration tags corresponding to the current traffic.

Optionally, in the embodiment of the present invention, the control module controlling the current traffic to sequentially enter the destination devices in the preset destination device sequence table includes: determining the next destination device that the current traffic will enter; and directing the current traffic to the determined next destination device. A destination device, so that the current traffic enters the determined next destination device; receiving the current traffic again, wherein receiving the current traffic again is receiving from the determined next destination device; judging whether the determined next destination device is The last destination device in the preset destination device sequence list; when the determined next destination device is the last destination device, complete the control of the current traffic entering the destination device in the preset destination device sequence list; and in the determined next destination device If the next destination device is not the last destination device, repeat the operations of determining the next destination device, directing the current traffic to the determined next destination device, receiving the current traffic again, and determining whether it is the last destination device until the determined next destination device is determined. The next destination device is the last destination device.

Optionally, in this embodiment of the present invention, directing the current traffic to the determined next destination device includes: modifying the destination MAC address of the packets of the current flow to the MAC address of the determined next destination device and changing the current The source MAC address of the traffic packets is modified to the MAC address of the device running the method used for traffic orchestration.

The specific working principles and benefits of the device for traffic orchestration provided by the embodiment of the present invention are similar to the specific working principles and benefits of the method for traffic orchestration provided by the embodiment of the present invention, and will not be described again here.

The device for traffic orchestration includes a processor and a memory. The traffic judgment module, the preset destination device sequence table determination module and the control module are all stored in the memory as program units. The processor executes the above programs stored in the memory. units to implement corresponding functions.

The processor contains a core, which retrieves the corresponding program unit from the memory. The kernel can set one or more kernel parameters to filter the received traffic. Not all traffic will be orchestrated to achieve fine-grained flow orchestration.

Memory may include non-permanent memory in computer-readable media, random access memory (RAM) and/or non-volatile memory, such as read-only memory (ROM) or flash memory (flash RAM). The memory includes at least one memory chip.

In addition, another aspect of the embodiments of the present invention also provides a machine-readable storage medium. The machine-readable storage medium stores instructions. The instructions are used to cause the machine to execute the method described in the above embodiments.

In addition, another aspect of the embodiment of the present invention also provides a processor for running a program, wherein the program is used to perform the method described in the above embodiment when run.

In addition, another aspect of the embodiment of the present invention also provides a device. The device includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps described in the above embodiment. method. The devices in this article can be servers, PCs, PADs, mobile phones, etc.

In addition, another aspect of the embodiments of the present invention also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program initialized with the method steps described in the above embodiments:

Those skilled in the art will understand that embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing device produce a use A device for realizing the functions specified in one process or multiple processes of the flowchart and/or one block or multiple blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions The device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device. Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

Memory may include non-volatile memory in computer-readable media, random access memory (RAM) and/or non-volatile memory in the form of read-only memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.

Computer-readable media includes both persistent and non-volatile, removable and non-removable media that can be implemented by any method or technology for storage of information. Information may be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), and read-only memory. (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, Magnetic tape cassettes, tape magnetic disk storage or other magnetic storage devices or any other non-transmission medium can be used to store information that can be accessed by a computing device. As defined in this article, computer-readable media does not include transitory media, such as modulated data signals and carrier waves.

It should also be noted that the terms "comprises," "comprises," or any other variation thereof are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements not only includes those elements, but also includes Other elements are not expressly listed or are inherent to the process, method, article or equipment. Without further limitation, an element qualified by the statement "comprises a..." does not exclude the presence of additional identical elements in the process, method, good, or device that includes the element.

The above are only examples of the present application and are not used to limit the present application. To those skilled in the art, various modifications and variations may be made to this application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of this application shall be included in the scope of the claims of this application.

Claims

A method for traffic orchestration, characterized in that the method includes:

Determine whether the current traffic received is the preset traffic to be arranged;

When the current traffic is the preset traffic to be arranged, determine a preset destination device sequence table corresponding to the arrangement of the current traffic; and

Control the current traffic to sequentially enter the destination devices in the preset destination device sequence list to arrange the current traffic.
The method according to claim 1, characterized in that determining whether the current traffic is the preset traffic to be arranged includes:

Determine whether the current traffic is the preset traffic to be arranged according to any of the following: whether the identification information corresponding to the current flow is the preset identification information and the traffic orchestration mark in the session record corresponding to the current flow, Wherein, the traffic orchestration mark indicates whether the corresponding traffic is the preset traffic to be orchestrated.
The method according to claim 2, characterized in that the identification information is quintuple information or data string or feature code, and the preset identification information is preset quintuple information or preset data string or Default feature code.
The method according to claim 2, characterized in that, in the case of determining whether the current traffic is the preset traffic to be arranged according to the traffic orchestration mark in the session record corresponding to the current traffic, Before using the traffic orchestration mark to determine whether the current traffic is the preset traffic to be orchestrated, the method further includes:

Obtain the traffic orchestration mark corresponding to the current traffic.
The method according to claim 4, wherein said obtaining the traffic orchestration mark corresponding to the current traffic includes:

Determine whether the current traffic is the first traffic; and

When the current traffic is the first time traffic, create a session record for the current traffic, establish the traffic orchestration mark in the created session record, and obtain the established traffic orchestration from the created session record. mark to obtain the traffic orchestration mark corresponding to the current traffic; and/or

If the current traffic is not the first traffic, obtain the traffic orchestration mark in the historical session record corresponding to the current traffic to obtain the traffic orchestration mark corresponding to the current traffic.
The method according to claim 1, wherein the controlling the current traffic to sequentially enter the destination devices in the preset destination device sequence table includes:

Determine the next destination device that the current traffic will enter;

Direct the current traffic to the determined next destination device, so that the current traffic enters the determined next destination device;

Receive the current traffic again, wherein receiving the current traffic again is from the determined next destination device;

Determine whether the determined next destination device is the last destination device in the preset destination device sequence list;

In the case where the determined next destination device is the last destination device, complete controlling the current traffic to enter the destination devices in the preset destination device sequence list in sequence; and

If the determined next destination device is not the last destination device, repeat the steps of determining the next destination device, directing the current traffic to the determined next destination device, receiving the current traffic again, and determining whether is the operation of the last destination device until the determined next destination device is the last destination device.
The method according to claim 6, characterized in that said directing the current traffic to the determined next destination device includes:

Modify the destination MAC address of the packet of the current flow to the MAC address of the determined next destination device and modify the source MAC address of the packet of the current flow to the MAC of the device running the method for traffic orchestration address.
A device for traffic orchestration, characterized in that the device includes:

The traffic judgment module is used to judge whether the current traffic received is the preset traffic to be arranged;

A preset destination device sequence table determination module, configured to determine a preset destination device sequence table corresponding to the arrangement of the current traffic when the current traffic is the preset traffic to be arranged; and

A control module configured to control the current traffic to sequentially enter the destination devices in the preset destination device sequence table to arrange the current traffic.
The device according to claim 8, wherein the flow determination module determines whether the current flow is the preset flow to be arranged including:

Determine whether the current traffic is the preset traffic to be arranged according to any of the following: whether the identification information corresponding to the current flow is the preset identification information and the traffic orchestration mark in the session record corresponding to the current flow, Wherein, the traffic orchestration mark indicates whether the corresponding traffic is the preset traffic to be orchestrated.
The device according to claim 9, characterized in that the identification information is five-tuple information or a data string or a feature code, and the preset identification information is preset five-tuple information or a preset data string or Default feature code.
The device of claim 9, further comprising:

A traffic orchestration mark acquisition module, configured to determine whether the current traffic is the preset traffic to be orchestrated according to the traffic orchestration mark in the session record corresponding to the current traffic, and determine according to the traffic orchestration mark. Before determining whether the current traffic is the preset traffic to be arranged, the traffic orchestration mark corresponding to the current traffic is obtained.
The device according to claim 11, wherein the traffic orchestration mark acquisition module obtains the traffic orchestration mark corresponding to the current traffic including:

Determine whether the current traffic is the first traffic; and

When the current traffic is the first time traffic, create a session record for the current traffic, establish the traffic orchestration mark in the created session record, and obtain the established traffic orchestration from the created session record. mark to obtain the traffic orchestration mark corresponding to the current traffic; and/or

If the current traffic is not the first traffic, obtain the traffic orchestration mark in the historical session record corresponding to the current traffic to obtain the traffic orchestration mark corresponding to the current traffic.
The device according to claim 8, wherein the control module controlling the current traffic to sequentially enter the destination devices in the preset destination device sequence table includes:

Determine the next destination device that the current traffic will enter;

Direct the current traffic to the determined next destination device, so that the current traffic enters the determined next destination device;

Receive the current traffic again, wherein receiving the current traffic again is from the determined next destination device;

Determine whether the determined next destination device is the last destination device in the preset destination device sequence list;

In the case where the determined next destination device is the last destination device, complete controlling the current traffic to enter the destination devices in the preset destination device sequence list in sequence; and

If the determined next destination device is not the last destination device, repeat the steps of determining the next destination device, directing the current traffic to the determined next destination device, receiving the current traffic again, and determining whether is the operation of the last destination device until the determined next destination device is the last destination device.
The device according to claim 13, characterized in that said directing the current traffic to the determined next destination device includes:

Modify the destination MAC address of the packet of the current flow to the MAC address of the determined next destination device and modify the source MAC address of the packet of the current flow to the MAC of the device running the method for traffic orchestration address.
A machine-readable storage medium, characterized in that instructions are stored on the machine-readable storage medium, and the instructions are used to cause the machine to execute the method described in any one of claims 1-7.
A processor, characterized in that it is used to run a program, wherein when the program is run, it is used to perform the method according to any one of claims 1-7.