WO2024007546A1 - 云资源池的服务控制方法、控制器及服务系统 - Google Patents

云资源池的服务控制方法、控制器及服务系统 Download PDF

Info

Publication number
WO2024007546A1
WO2024007546A1 PCT/CN2022/141095 CN2022141095W WO2024007546A1 WO 2024007546 A1 WO2024007546 A1 WO 2024007546A1 CN 2022141095 W CN2022141095 W CN 2022141095W WO 2024007546 A1 WO2024007546 A1 WO 2024007546A1
Authority
WO
WIPO (PCT)
Prior art keywords
service
traffic
packet
service chain
chain
Prior art date
Application number
PCT/CN2022/141095
Other languages
English (en)
French (fr)
Inventor
谭宇剀
Original Assignee
中国电信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国电信股份有限公司 filed Critical 中国电信股份有限公司
Publication of WO2024007546A1 publication Critical patent/WO2024007546A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/51—Discovery or management thereof, e.g. service location protocol [SLP] or web services

Definitions

  • the present disclosure relates to the technical field of cloud network integration, and specifically, to a service control method, controller and service system for a cloud resource pool.
  • Cloud resource pool is based on virtualization technology. After virtualizing traditional service products, it is deployed and run in the form of virtual machines on dedicated cloud resource pool virtualization servers, and connects these servers through dedicated switches to form a cloud resource pool. . Network traffic packets need to pass through the serial service devices in the cloud resource pool in sequence.
  • a service control method for a cloud resource pool includes: determining first duration information of a first traffic packet passing through a first service chain; the first service chain is used to indicate The first traffic packet passes through a preset number of service devices in the cloud resource pool in a predetermined order; when the first duration information exceeds the preset second duration information, the service devices in the first service chain are disassembled. points to obtain multiple second service chains; and control the first traffic packets to be input into each of the second service chains in parallel for service processing.
  • the method further includes: configuring delay information of the service equipment in the first service chain. Determining the first duration information for the first traffic packet to pass through the first service chain includes: determining the first duration information for the first traffic packet to pass through the first service chain based on the delay information.
  • splitting service devices in the first service chain includes: determining dependencies between service devices in the first service chain; and splitting the service devices in the first service chain according to the dependencies.
  • the service equipment in one service chain is split so that the service equipment with the dependency relationship is located in the same second service chain.
  • the method further includes: performing traffic copy on the first traffic packet according to the number of multiple second service chains to obtain multiple first traffic packets of the same traffic.
  • Controlling the first traffic packets to be input into each of the second service chains in parallel includes: controlling multiple first traffic packets to be input into each of the second service chains in parallel for service processing.
  • the method further includes: determining a first data packet in response to a comparison result of a plurality of second traffic packets flowing out of the second service chain, and forwarding the first data packet.
  • the method further includes: marking the data packets in the second traffic packet, and storing the data packets and corresponding marking information.
  • determining the first data packet includes: determining the first data packet based on marking information of the data packet in the second traffic packet.
  • the method further includes: obtaining packet delay difference information between a plurality of second traffic packets flowing out of the second service chain; and determining the second packet delay difference information based on the packet delay difference information.
  • the second data packet in the traffic packet ; delete the second data packet and corresponding mark information in the memory.
  • a cloud resource pool controller includes: a first determination module, a splitting module and a control module; a first determination module for determining whether the first traffic packet passes through the first The first duration information of a service chain; the first service chain is used to instruct the first traffic packet to pass through a preset number of service devices in the cloud resource pool in a predetermined order; a splitting module is used to when the The first duration information exceeds the preset second duration information, and the service devices in the first service chain are split to obtain multiple second service chains; a control module for controlling the parallel flow of the first traffic packets Each of the second service chains is input for service processing.
  • a service system includes: a controller and a service device, wherein: the controller is used to determine the first duration information of the first traffic packet passing through the first service chain; The first service chain is used to instruct the first traffic packet to pass through a preset number of service devices in the cloud resource pool in a predetermined order; the controller is also used to when the first duration information exceeds a preset third Two duration information, split the service equipment in the first service chain to obtain multiple second service chains; and control the first traffic packet to be input into each second service chain in parallel; the service Device, configured to perform service processing on the input first traffic packet.
  • a computer-readable storage medium is provided, a computer program is stored thereon, and when the computer program is executed by a processor, any one of the above methods is implemented.
  • an electronic device including: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform any of the above by executing the executable instructions. method.
  • Figure 1 schematically shows an application scenario system architecture diagram of a service control method and device according to an embodiment of the present disclosure.
  • FIG. 2 schematically illustrates one of the flowcharts of a service control method for a cloud resource pool according to an embodiment of the present disclosure.
  • FIG. 3 schematically shows a comparison diagram before and after splitting the first service chain according to an embodiment of the present disclosure.
  • Figure 4 schematically shows a data packet marking diagram of the second service chain according to one embodiment of the present disclosure.
  • FIG. 5 schematically shows the second schematic flowchart of a service control method for a cloud resource pool according to an embodiment of the present disclosure.
  • Figure 6 schematically shows a structural block diagram of a cloud resource pool controller according to one embodiment of the present disclosure.
  • Figure 7 schematically shows a schematic diagram of a service system according to one embodiment of the present disclosure.
  • Figure 8 schematically illustrates an exemplary electronic device block diagram according to one embodiment of the present disclosure.
  • Example embodiments will now be described more fully with reference to the accompanying drawings.
  • Example embodiments may, however, be embodied in various forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concepts of the example embodiments.
  • the described features, structures or characteristics may be combined in any suitable manner in one or more embodiments.
  • numerous specific details are provided to provide a thorough understanding of embodiments of the disclosure.
  • those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details being omitted, or other methods, components, devices, steps, etc. may be adopted.
  • well-known technical solutions have not been shown or described in detail to avoid obscuring aspects of the disclosure.
  • the service control method and device for cloud resource pools provided in some embodiments of the present disclosure can be applied to the system architecture shown in Figure 1.
  • the system may include a cloud security management platform, a cloud resource pool control center, a first traffic classifier, a second traffic classifier, and at least one physical server of the cloud resource pool.
  • the physical server of the cloud resource pool is used to implement service processing of traffic;
  • the cloud security management platform, the cloud resource pool control center, the first traffic classifier, and the second traffic classifier can be set as a hardware device respectively.
  • a separate physical server, or any of the above four devices, can also be deployed in the form of a virtual machine on any physical server in the cloud resource pool. This example is not limited to this.
  • the service control method of the cloud resource pool provided by the embodiments of the present disclosure can be executed in the server.
  • the service device of the cloud resource pool is generally provided in the server.
  • This disclosed method can be targeted at various service types such as security services and computing services. Different service types have the same idea, but the service equipment in the service chain is different.
  • This disclosure takes security services as an example for detailed explanation.
  • the service control method of a cloud resource pool includes the following steps S210-S230.
  • Step S210 Determine first duration information for the first traffic packet to pass through the first service chain.
  • the first service chain is used to instruct the first traffic packet to pass through a preset number of service devices in the cloud resource pool in a predetermined order. Both the predetermined order and the predetermined number can be configured according to the requirements of the business logic.
  • the first traffic packet may be network traffic data for a specified service to be service processed.
  • the first service chain refers to a serial service chain composed of preconfigured service devices.
  • Service equipment may include a variety of service equipment for security processing. For example: Fire Wall (FW), Virus Detection Systems (VDS), Intrusion Prevention System (Instruction Prevention System, IPS), Intrusion Detection Systems (IDS), Database Audit, Web Application Protection System ( Web Application Firewall (WAF), Log Audit System (Log Audit System, LAS), host anti-virus, bastion host, baseline verification and other security functional components.
  • Fire Wall FW
  • VDS Virus Detection Systems
  • IPS Intrusion Prevention System
  • IDS Intrusion Detection Systems
  • Database Audit Web Application Protection System
  • WAF Web Application Firewall
  • Log Audit System Log Audit System
  • host anti-virus bastion host
  • bastion host baseline verification and other security functional components.
  • the first duration information refers to the duration required for the first traffic packet to pass through the first service chain.
  • the first duration information may include time information when the first traffic packet flows into the first service chain and time information when the first traffic packet flows out of the first service chain.
  • Step S220 When the first duration information exceeds the preset second duration information, the service devices in the first service chain are split to obtain multiple second service chains.
  • splitting refers to splitting the service devices in the first service chain into multiple short chains (second service chains).
  • the splitting process may not change the arrangement order of the service devices.
  • the service equipment in the multiple second service chains after the split is the same as the service equipment in the first service chain, that is, the number and type of service equipment do not change before and after the split.
  • the first service chain (FW ⁇ IPS ⁇ WAF ⁇ IDS) in the upper half of the figure is split into two parallel second service chains (FW ⁇ WAF and IPS ⁇ IDS), which can shorten the time for traffic packets to pass through the cloud resource pool by half.
  • FW ⁇ IPS ⁇ WAF ⁇ IDS parallel second service chains
  • This disclosure shortens the service delay by splitting a long serial chain into multiple parallel short chains (second service chain).
  • Step S230 Control the first traffic packet to be input into each second service chain in parallel for service processing.
  • the first traffic packet can be controlled to be input into each second service chain in parallel, so that the service equipment in each second service chain processes the first traffic packet at the same time, speeding up the service processing process.
  • the service equipment in the first service chain is split, so as to Obtain multiple second service chains, split one service chain into multiple second service chains, and then control the first traffic packet to enter each second service chain in parallel, thus greatly shortening the time for the first traffic packet to pass through the service chain. , speed up the service processing process of traffic packets to meet the user's non-aware needs.
  • the complexity of the service can be distinguished, so that only services with a certain complexity can be distinguished.
  • the service chain is split and processed for the degree of service, which simplifies the service control process, reduces the data processing volume of the controller, and further speeds up the service process.
  • the method further includes: configuring delay information of the service device in the first service chain.
  • the delay information may be related information of the first service chain configured according to business requirements.
  • the related information may include the type, quantity, and order of the service devices in the first service chain.
  • the maximum pass delay information can be set for each service device in Figure 3.
  • the maximum delay information can be configured according to business requirements: the FW configuration maximum delay is 100ms (milliseconds), and the IPS configuration maximum delay is 50ms, the maximum delay configured by WAF is 5000ms, and the maximum delay configured by IDS is 200ms.
  • the related information may also include other information, such as the name of the first service chain, identification information, etc., which is not limited in this example.
  • first duration information of the first traffic packet passing through the first service chain may be determined based on the delay information.
  • the maximum delay of each service device in the first service chain can be summed, and the summation result can be used as the first duration information; the maximum delay of each service device in the first service chain can also be summed.
  • certain processing is performed on the summation result (such as adding or subtracting a fixed value), and the processed result is used as the first duration information.
  • the delay information of each service device can also be multiplied by a safety factor (such as 0.95 or 1.1) and then summed. This example does not limit the method of determining the first duration information.
  • splitting the service devices in the first service chain includes: determining dependencies between the service devices in the first service chain.
  • the dependency relationship refers to the interdependence relationship between different service devices. This dependency relationship can be determined based on the attribute information of the service device itself, or can be configured by the user or administrator. This example does not limit this.
  • the service equipment in the first service chain is split, so that the service equipment with the dependency relationship is located in the same second service chain.
  • the service devices with dependencies can be treated as a whole without splitting. That is, the splitting of the service chain of the present disclosure needs to preserve the dependencies between the service devices. relation. For example, if there is a dependency relationship between the FW and IPS in Figure 3, the FW and IPS will still be in the same second service chain after splitting, preventing service devices with dependencies from being split and failing to meet the configured requirements. Service processing effect.
  • the method further includes: performing traffic copy on the first traffic packet according to the number of multiple second service chains to obtain multiple first traffic packets of the same traffic.
  • the first traffic packet needs to pass through each second service chain, so the second traffic packet entering the first service chain needs to be traffic copied.
  • Various traffic copying tools can be used for traffic copying.
  • an application layer-based traffic copying tool or a grid line-based traffic copying tool (which captures data packets directly from the link layer) can be used.
  • a traffic replication engine can be used to perform traffic mirroring/replication.
  • the number of first traffic packets obtained after traffic copying can be the same as the number of second service chains, so that one second service chain corresponds to one first traffic packet to meet the requirement of parallel inflow.
  • Control inputting multiple first traffic packets into each second service chain in parallel for service processing.
  • Service processing refers to performing corresponding service processing on the incoming first traffic packet according to the arrangement order of the service devices in the service chain.
  • the service processing of FW may include part or all of the security detection, filtering, reminder and other processing of the firewall.
  • the method further includes: in response to a comparison result of the second traffic packets flowing out of the plurality of second service chains, determining the first data packet, and forwarding the first data packet.
  • the data packets contained in the second traffic packets flowing out of each second service chain can be compared.
  • the data packet can be determined.
  • the packet can also pass through the first service chain, the data packet can be determined to be a secure data packet, and the data packet can be forwarded to the next processing link (such as a flow classifier or switch, etc.).
  • the data packets passing through each second service chain can be forwarded as new traffic packets to facilitate data management and release the storage space of the memory cloud resource pool.
  • the method further includes: marking the data packet in the second traffic packet, and storing the data packet and corresponding marking information.
  • the data packets in the second traffic packet may be marked based on actual data.
  • data packets can be sequentially coded, as shown in Figure 4. Different data packets can be marked with numbers such as 1, 2, 3...; the data packets can also be marked with system-generated coding; other methods can also be used. Distinguish the marking methods of different data packets. This example does not limit this.
  • the outgoing data packets and their marking information in the cloud resource pool can be stored, for example, in the corresponding memory, or the data can be forwarded to the corresponding storage server for storage.
  • the tag information is stored in a binding manner with the corresponding data packets, making it easy to distinguish between different data packets.
  • the first data packet is determined based on the marking information of the data packet in the second traffic packet.
  • the mark information of the outgoing data packets of each second service chain can be directly compared, and the first data packet can be quickly determined by searching for the same mark information.
  • the first traffic packet is introduced into two second service chains.
  • the outgoing data packets of one service chain are data packet 1, data packet 2, and data packet 3, and the outgoing data packets of the other service chain are data packet 1, data packet 2, and data packet 3.
  • the data packets are data packet 3 and data packet 4.
  • the method further includes: obtaining data packet delay difference information between second traffic packets flowing out of multiple second service chains.
  • the data packet delay difference information refers to the time difference when the same data packet flows out from different second service chains.
  • the outflow time of each data packet in the second traffic packet can be obtained in real time, and then the delay difference information of each data packet can be obtained.
  • the delay difference information is None or infinite.
  • the maximum delay difference information of the data packet can be configured in advance, for example, it can be configured as several to tens of milliseconds.
  • the delay difference information of a data packet exceeds the maximum delay difference, the data packet can be determined to be the second data packet.
  • the delay difference information of a data packet is None or infinite, it can be directly determined as the second data packet.
  • the second data packet and its corresponding tag information may be deleted to release memory space.
  • a service control method for a cloud resource pool may include the following steps.
  • Step S501 Obtain service chain related information of the first service chain corresponding to the target service.
  • the service chain related information may include the service chain name or identification, service devices and their corresponding delay information, dependencies between service devices, etc.
  • Service devices and their corresponding delay information can be stored and displayed in the form of a list.
  • Step S502 Determine first duration information for the first traffic packet to pass through the first service chain based on the service chain related information.
  • the sum of the delays of each service device can be used as the first duration information.
  • Step S503 Determine whether the first duration information exceeds the preset second duration information. If so, go to step S504; otherwise, go to step S511.
  • Step S504 Split the service devices in the first service chain according to the service chain related information, so that the service devices with dependency relationships are located in the same second service chain, so as to obtain multiple second service chains.
  • Step S505 Perform traffic copy on the first traffic packet according to the number of multiple second service chains to obtain multiple first traffic packets of the same traffic.
  • Step S506 Control input of multiple first traffic packets into each second service chain in parallel for service processing.
  • Step S507 Mark the data packets in the second traffic packets flowing out of each second service chain, and store the data packets and corresponding marking information.
  • Step S508 Determine the first data packet based on the marking information of the data packet in the second traffic packet, and forward the first data packet.
  • Step S509 Obtain the data packet delay difference information between the second traffic packets, and determine the second data packet based on the data packet delay difference information.
  • Step S510 Delete the second data packet and corresponding tag information in the memory.
  • Step S511 Control the first traffic packet to flow into the first service chain for service processing.
  • steps S510 and S511 After the execution of steps S510 and S511 is completed, the process returns to step S501 to continue the next round of service processing.
  • the order of each step in the above embodiment is only exemplary, and the order of the steps can be adjusted accordingly as needed. For example, steps one and five can be performed at the same time.
  • the present disclosure first determines whether the current service chain meets business requirements by calculating the first delay information of the original first service chain, and splits the first service chain when the current service chain cannot meet business requirements. , redesign the service chain link registration logic, and logically divide a long chain into multiple short chains, namely the second service chain, which effectively shortens the absolute length of the service chain, thereby greatly shortening the time for the first traffic packet to pass through the service chain. , speed up the service processing process of traffic packets to meet the user's non-aware needs.
  • the present disclosure also designs a traffic aggregation mechanism for the outgoing second traffic packet.
  • the first traffic packet can pass through the redesigned short link in parallel.
  • the traffic flowing out of each short chain is aggregated at the end of the chain to recombine the traffic of multiple short chains to ensure service effects. It effectively solves the problem that due to too many service devices and/or too long service chain, the delay of traffic passing through the service chain cannot meet the business needs.
  • This disclosure modifies the original service chain logic by redefining the design service chain, and solves the problem of excessive delay caused by the length of the service chain.
  • the traffic replication-multiple link traffic diversion-traffic aggregation mechanism By utilizing the traffic replication-multiple link traffic diversion-traffic aggregation mechanism, the traffic originally flowing through the first service chain can be restored without affecting the business results.
  • this disclosure is aimed at business scenarios of cloud-network integration. It does not require micro-services and manual intervention, nor does it require optimization of individual service equipment. It requires little modification to the original system and equipment, and is helpful for the deployment of security services in the existing network. .
  • the automation scenario based on the service chain reduces latency, ensures business reliability, and improves the security business performance of the cloud resource pool.
  • the controller 600 may include: a first determination module 610, a splitting module 620 and a control module 630; the first determination module 610 may be To determine the first duration information of the first traffic packet passing through the first service chain; the first service chain is used to instruct the first traffic packet to pass through a preset number of service devices in the cloud resource pool in a predetermined order; the splitting module 620 can be used When the first duration information exceeds the preset second duration information, the service devices in the first service chain are split to obtain multiple second service chains; the control module 630 can be used to control the parallelization of the first traffic packets Each second service chain is entered for service processing.
  • the controller 600 may further include a configuration module configured to configure the delay information of the service device in the first service chain.
  • the first determination module 610 may also be configured to determine first duration information for the first traffic packet to pass through the first service chain based on the delay information.
  • the splitting module 620 may include: a determining submodule and a splitting submodule; the determining submodule may be used to: determine dependencies between service devices in the first service chain; and the splitting submodule may Used for: splitting the service equipment in the first service chain according to the dependency relationship, so that the service equipment with the dependency relationship is located in the same second service chain.
  • the controller may further include: a replication module.
  • the replication module may be configured to: perform traffic replication on the first traffic packet according to the number of multiple second service chains to obtain multiple traffic packets of the same traffic.
  • the control module may also be used to control input of multiple first traffic packets into each second service chain in parallel for service processing.
  • the controller may further include a second determination module, and the second determination module may be configured to: determine the first data packet in response to a comparison result of the second traffic packets flowing out of the plurality of second service chains. , and forward the first packet.
  • the controller may further include a marking module, and the marking module may be configured to: mark the data packets in the second traffic packet, and store the data packets and corresponding marking information.
  • the second determination module may also be configured to determine the first data packet based on the marking information of the data packet in the second traffic packet.
  • the controller may further include: an acquisition module, a third determination module and a deletion module; the acquisition module may be used to acquire data packets between second traffic packets flowing out of multiple second service chains. Delay information; the third determination module can be used to determine the second data packet in the second traffic packet according to the data packet delay difference information; the deletion module can be used to delete the second data packet and corresponding mark information in the memory.
  • the system 700 may include: a controller 710 and a service device 720, wherein the controller 710 may be used to determine that the first traffic packet passes through the first service chain. The first duration information; the first service chain is used to instruct the first traffic packet to pass through a preset number of service devices in the cloud resource pool in a predetermined order.
  • the controller 710 can also be used to split the service devices in the first service chain to obtain multiple second service chains when the first duration information exceeds the preset second duration information; and control the first traffic packet Enter each second service chain in parallel.
  • the service device 720 may be used to perform service processing on the input first traffic packet.
  • the system further includes: a traffic copy module, which is configured to perform traffic copy on the first traffic packet according to the number of multiple second service chains to obtain the same traffic. Multiple first traffic packets; the controller 710 may also be used to control multiple first traffic packets to be input into each second service chain in parallel for service processing.
  • a traffic copy module which is configured to perform traffic copy on the first traffic packet according to the number of multiple second service chains to obtain the same traffic. Multiple first traffic packets; the controller 710 may also be used to control multiple first traffic packets to be input into each second service chain in parallel for service processing.
  • the system further includes: a traffic aggregation module.
  • the traffic aggregation module may be configured to determine the first data packet in response to a comparison result of a plurality of second traffic packets flowing out of the second service chain, and Forward the first data packet.
  • the traffic aggregation module can also be used to mark the data packets in the second traffic packet, and store the data packets and corresponding marking information; based on the data packets in the second traffic packet Mark information to identify the first data packet.
  • the present disclosure also provides a computer-readable medium.
  • the computer-readable medium may be included in the device described in the above embodiments; it may also exist separately without being assembled into the device.
  • the above computer-readable medium carries one or more programs. When the above one or more programs are executed by a device, the device implements the method in the following embodiments. For example, the device can implement the various steps shown in Figures 2 to 5, etc.
  • the computer-readable medium shown in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the above two.
  • the computer-readable storage medium may be, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any combination thereof. More specific examples of computer readable storage media may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard drive, random access memory (RAM), read only memory (ROM), removable Programmd read-only memory (EPROM or flash memory), fiber optics, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above.
  • a computer-readable storage medium may be any tangible medium that contains or stores a program for use by or in connection with an instruction execution system, apparatus, or device.
  • a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code therein. Such propagated data signals may take many forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above.
  • a computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device .
  • Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the foregoing.
  • a device capable of implementing the above method is also provided.
  • a device capable of implementing the above method.
  • aspects of the present disclosure may be implemented as systems, methods, or program products. Therefore, various aspects of the present disclosure may be embodied in the following forms, namely: a complete hardware embodiment, a complete software embodiment (including firmware, microcode, etc.), or an embodiment combining hardware and software aspects, which may be collectively referred to herein as "Circuit", "Module” or "System”.
  • FIG. 8 is a schematic structural diagram of an electronic device provided by an embodiment of the present disclosure.
  • the electronic device 800 includes a processor 810 , a memory 820 , an input-output interface 830 and a communication bus 840 .
  • the processor 810 is connected to the memory 820 and the input-output interface 830.
  • the processor 810 can be connected to the memory 820 and the input-output interface 830 through the communication bus 840.
  • the processor 810 is configured to support the electronic device to perform corresponding functions in the service control method of the cloud resource pool in Figures 2-5.
  • the processor 810 can be a central processing unit (CPU), a network processor (Network Processor, NP), a hardware chip or any combination thereof.
  • the above-mentioned hardware chip can be an application-specific integrated circuit (Application-Specific Integrated Circuit, ASIC), a programmable logic device (Programmable Logic Device, PLD) or a combination thereof.
  • the above-mentioned PLD can be a complex programmable logic device (Complex Programmable Logic Device, CPLD), a field-programmable gate array (Field-Programmable Gate Array, FPGA), a general array logic (Generic Array Logic, GAL) or any combination thereof.
  • the memory 820 is used to store program codes and the like.
  • the memory 820 may include volatile memory (VolatileMemory, VM), such as random access memory (Random Access Memory, RAM); the memory 820 may also include non-volatile memory (Non-Volatile Memory, NVM), such as read-only memory. (Read-Only Memory, ROM), flash memory (flash memory), hard disk (Hard Disk Drive, HDD) or solid state drive (Solid-State Drive, SSD); the memory 820 may also include a combination of the above types of memory.
  • volatile memory volatile memory
  • RAM Random Access Memory
  • NVM non-volatile Memory
  • ROM Read-Only Memory
  • flash memory flash memory
  • HDD Hard Disk Drive
  • SSD solid state drive
  • the input/output interface 830 is used to input or output data.
  • the processor 810 can call the above program code to perform the following operations: determine the first duration information of the first traffic packet passing through the first service chain; the first service chain is used to instruct the first traffic packet to pass through a preset in the cloud resource pool in a predetermined order. number of service devices; when the first duration information exceeds the preset second duration information, split the service devices in the first service chain to obtain multiple second service chains; control the first traffic packet to be input in parallel to each The second service chain performs service processing.
  • the above-mentioned processor 810 can also perform the following operations: configure the delay information of the service device in the first service chain. Based on the delay information, first duration information of the first traffic packet passing through the first service chain is determined.
  • the above-mentioned processor 810 can also split the service devices in the first service chain and perform the following operations: determine the dependency relationship between the service devices in the first service chain; The service devices in the chain are split so that the service devices with dependencies are in the same second service chain.
  • the above-mentioned processor 810 can also perform the following operations: perform traffic copy on the first traffic packet according to the number of multiple second service chains to obtain multiple first traffic packets of the same traffic. Control inputting multiple first traffic packets into each second service chain in parallel for service processing.
  • the above-mentioned processor 810 can also perform the following operations: in response to the comparison results of the second traffic packets flowing out of the plurality of second service chains, determine the first data packet, and forward the first data packet.
  • the above-mentioned processor 810 can also perform the following operations: mark the data packet in the second traffic packet, and store the data packet and corresponding marking information; based on the marking information of the data packet in the second traffic packet, determine the first data pack.
  • the above-mentioned processor 810 can also perform the following operations: obtain the packet delay difference information between the second traffic packets flowing out of the plurality of second service chains; and determine the second traffic packet according to the packet delay difference information.
  • the second data packet in the memory delete the second data packet and corresponding mark information in the memory.
  • each operation may also correspond to the corresponding description with reference to the method embodiments shown in FIGS. 2-5; the above-mentioned processor 810 may also cooperate with the input and output interface 830 to perform other operations in the above-mentioned method embodiments.
  • the example embodiments described here can be implemented by software, or can be implemented by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.) or on the network , including a number of instructions to cause a device to perform a method according to an embodiment of the present disclosure.
  • a non-volatile storage medium which can be a CD-ROM, U disk, mobile hard disk, etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种云资源池的服务控制方法，包括：确定第一流量包通过第一服务链的第一时长信息(S210)；当第一时长信息超过预设的第二时长信息，对第一服务链中的服务设备进行拆分，以获得多个第二服务链(S220)；控制第一流量包并行输入每个第二服务链，进行服务处理(S230)。解决了网络流量包经过云资源池的服务的时延大，无法满足用户无感知的服务需求的问题。 (图2)

Description

云资源池的服务控制方法、控制器及服务系统
相关申请的交叉引用
本申请要求于2022年07月08日提交的申请号为202210806159.7、名称为“云资源池的服务控制方法、控制器及服务系统”的中国专利申请的优先权，该中国专利申请的全部内容通过引用全部并入全文。
技术领域
本公开涉及云网融合技术领域，具体而言，涉及一种云资源池的服务控制方法、控制器及服务系统。
背景技术
云资源池是基于虚拟化技术，通过把传统服务产品虚拟化后，以虚拟机的形态部署和运行在专门的云资源池虚拟化服务器上，并通过专用的交换机连接这些服务器组成一个云资源池。网络流量包需要依次通过云资源池中的串行服务设备。
但是，随着云网融合中的复杂业务的增加，业务越来越复杂化，服务链中服务设备的个数和复杂度逐渐增加，使得时延敏感型的业务难以满足用户无感知的需求，因此，如何使网络流量包快速经过云资源池，是该领域亟待解决的技术问题。
需要说明的是，在上述背景技术部分公开的信息仅用于加强对本公开的背景的理解，因此可以包括不构成对本领域普通技术人员已知的现有技术的信息。
发明内容
根据本公开的第一方面，提供了一种云资源池的服务控制方法，所述方法包括：确定第一流量包通过第一服务链的第一时长信息；所述第一服务链用于指示第一流量包按照预定顺序经过所述云资源池中预设数量的服务设备；当所述第一时长信息超过预设的第二时长信息，对所述第一服务链中的服务设备进行拆分，以获得多个第二服务链；控制所述第一流量包并行输入每个所述第二服务链，进行服务处理。
可选地，所述方法还包括：配置所述第一服务链中的服务设备的时延信息。所述确定第一流量包通过第一服务链的第一时长信息，包括：基于所述时延信息，确定第一流量包通过第一服务链的第一时长信息。
可选地，所述对所述第一服务链中的服务设备进行拆分，包括：确定所述第一服务链中的服务设备之间的依赖关系；根据所述依赖关系，对所述第一服务链中的服务设备进行拆分，以使具有所述依赖关系的服务设备位于同一所述第二服务链中。
可选地，所述方法还包括：根据多个所述第二服务链的数量，对所述第一流量包进行流量复制，以获得相同流量的多个第一流量包。
所述控制所述第一流量包并行输入每个所述第二服务链，包括：控制将多个第一流量包并行输入每个所述第二服务链进行服务处理。
可选地，所述方法还包括：响应于多个所述第二服务链流出的第二流量包的比较结果，确定第一数据包，并转发所述第一数据包。
可选地，所述方法还包括：对所述第二流量包中的数据包进行标记，并存储数据包及对应标记信息。
响应于多个所述第二服务链流出的第二流量包的比较结果，确定第一数据包，包括：基于所述第二流量包中数据包的标记信息，确定所述第一数据包。
可选地，所述方法还包括：获取多个所述第二服务链流出的第二流量包之间的数据包时延差信息；根据所述数据包时延差信息，确定所述第二流量包中的第二数据包；删除内存中的所述第二数据包及对应标记信息。
根据本公开的第二方面，提供了一种云资源池控制器，所述控制器包括：第一确定模块、拆分模块和控制模块；第一确定模块，用于确定第一流量包通过第一服务链的第一时长信息；所述第一服务链用于指示所述第一流量包按照预定顺序经过所述云资源池中预设数量的服务设备；拆分模块，用于当所述第一时长信息超过预设的第二时长信息，对所述第一服务链中的服务设备进行拆分，以获得多个第二服务链；控制模块，用于控制所述第一流量包并行输入每个所述第二服务链，进行服务处理。
根据本公开的第三方面，提供一种服务系统，所述系统包括：控制器和服务设备，其中：所述控制器，用于确定第一流量包通过第一服务链的第一 时长信息；所述第一服务链用于指示第一流量包按照预定顺序经过所述云资源池中预设数量的服务设备；所述控制器，还用于当所述第一时长信息超过预设的第二时长信息，对所述第一服务链中的服务设备进行拆分，以获得多个第二服务链；并控制所述第一流量包并行输入每个所述第二服务链；所述服务设备，用于对输入的所述第一流量包进行服务处理。
根据本公开的第四方面，提供一种计算机可读存储介质，其上存储有计算机程序，计算机程序被处理器执行时实现上述任意一项的方法。
根据本公开的第五方面，提供一种电子设备，包括：处理器；以及存储器，用于存储处理器的可执行指令；其中，处理器配置为经由执行可执行指令来执行上述任意一项的方法。
附图说明
此处的附图被并入说明书中并构成本说明书的一部分，示出了符合本公开的实施例，并与说明书一起用于解释本公开的原理。显而易见地，下面描述中的附图仅仅是本公开的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1示意性示出了根据本公开的一个实施例的服务控制方法和装置的应用场景系统架构示意图。
图2示意性示出了根据本公开的一个实施例的云资源池的服务控制方法的流程示意图之一。
图3示意性示出了根据本公开的一个实施例的第一服务链的拆分前后对比示意图。
图4示意性示出了根据本公开的一个实施例的第二服务链的数据包标记示意图。
图5示意性示出了根据本公开的一个实施例的云资源池的服务控制方法的流程示意图之二。
图6示意性示出了根据本公开的一个实施例的云资源池控制器的结构框图。
图7示意性示出了根据本公开的一个实施例的服务系统的示意图。
图8示意性示出了根据本公开的一个实施例的示例性电子设备框图。
具体实施方式
现在将参考附图更全面地描述示例实施方式。然而，示例实施方式能够以多种形式实施，且不应被理解为限于在此阐述的范例；相反，提供这些实施方式使得本公开将更加全面和完整，并将示例实施方式的构思全面地传达给本领域的技术人员。所描述的特征、结构或特性可以以任何合适的方式结合在一个或更多实施方式中。在下面的描述中，提供许多具体细节从而给出对本公开的实施方式的充分理解。然而，本领域技术人员将意识到，可以实践本公开的技术方案而省略特定细节中的一个或更多，或者可以采用其它的方法、组元、装置、步骤等。在其它情况下，不详细示出或描述公知技术方案以避免喧宾夺主而使得本公开的各方面变得模糊。
此外，附图仅为本公开的示意性图解，并非一定是按比例绘制。图中相同的附图标记表示相同或类似的部分，因而将省略对它们的重复描述。附图中所示的一些方框图是功能实体，不一定必须与物理或逻辑上独立的实体相对应。可以采用软件形式来实现这些功能实体，或在一个或多个硬件模块或集成电路中实现这些功能实体，或在不同网络和/或处理器装置和/或微控制器装置中实现这些功能实体。
参考图1，本公开一些实施例中提供的云资源池的服务控制方法及装置可以应用于如图1所示的系统架构中。如图1所示，该系统可以包括云安全管理平台、云资源池控制中心、第一流量分类器、第二流量分类器及云资源池的至少一个物理服务器。其中，云资源池的物理服务器用于实现对流量的服务处理；云安全管理平台、云资源池控制中心、第一流量分类器、第二流量分类器可以分别以硬件设备的形式被设置为一个单独的物理服务器，或者上述四个中的任意设备也可以虚拟机的形式被部署在云资源池中的任意的物理服务器中，本示例对此不做限定。
本公开实施例所提供的云资源池的服务控制方法可以在服务器中执行，相应地，云资源池的服务装置一般设置于服务器中。
本公开方法可以针对各种安全服务、计算服务等服务类型，不同的服务类型其思路相同，只是服务链中的服务设备不同，本公开以安全服务为例进行详细说明。
参考图2，本公开提供的一个实施例的云资源池的服务控制方法，包括 以下步骤S210-S230。
步骤S210，确定第一流量包通过第一服务链的第一时长信息。
在本示例实施方式中，第一服务链用于指示第一流量包按照预定顺序经过云资源池中预设数量的服务设备，预定顺序和预定数量都可以根据业务逻辑的要求进行配置。第一流量包可以是针对指定业务的待进行服务处理的网络流量数据。
在本示例实施方式中，第一服务链是指预先配置的服务设备组成的串行服务链。服务设备可以包括用于进行安全处理的各种服务设备。例如：防火墙(Fire Wall，FW)、病毒检测(Virus Detection Systems，VDS)、入侵防御系统(Instruction Prevention System，IPS)、入侵检测系统(Intrusion Detection Systems，IDS)、数据库审计、Web应用防护系统(Web Application Firewall，WAF)、日志审计系统(Log Audit System，LAS)、主机杀毒、堡垒主机、基线核查等等安全功能组件。
在本示例实施方式中，第一时长信息是指第一流量包通过第一服务链需要的时长。第一时长信息可以包括第一流量包流入第一服务链的时间信息和第一流量包流出第一服务链的时间信息。
步骤S220，当第一时长信息超过预设的第二时长信息，对第一服务链中的服务设备进行拆分，以获得多个第二服务链。
在本示例实施方式中，拆分是指将第一服务链中服务设备拆分为多个短链(第二服务链)，拆分过程可以不改变服务设备的排列顺序。拆分后的多个第二服务链中的服务设备与第一服务链中的服务设备均相同，即拆分前后不改变服务设备的数量和种类。
示例性地，参考图3，将图中上半部分的第一服务链(FW→IPS→WAF→IDS)拆分成图中下半部分的两条并行的第二服务链(FW→WAF和IPS→IDS)，这样就可以使流量包经过云资源池的时间缩短一半。而随着服务链复杂度和长度的增加，该减小时延的效果会更加显著。本公开通过将串行的一条长链拆分成多个并行短链(第二服务链)，以缩短服务时延。
步骤S230，控制第一流量包并行输入每个第二服务链，进行服务处理。
在本示例实施方式中，可以控制第一流量包分别并行输入每个第二服务 链，使每个第二服务链中的服务设备同时对第一流量包进行处理，加快服务处理过程。
本公开实施例提供的云资源池的服务控制方法中，一方面，通过在第一时长信息超过预设的第二时长信息的情况下，对第一服务链中的服务设备进行拆分，以获得多个第二服务链，将一条服务链拆分成多条第二服务链，再控制第一流量包并行输入每个第二服务链，从而大大缩短了第一流量包通过服务链的时长，加快流量包的服务处理过程，以满足用户的无感知需求。另一方面，通过确定第一流量包通过第一服务链的第一时长信息，并判断第一时长信息是否超过预设的第二时长信息，可以区分服务的复杂程度，从而只对具有一定复杂度的服务进行服务链拆分处理，简化服务控制过程，降低控制器的数据处理量，进一步加快服务过程。
在一些实施例中，方法还包括：配置第一服务链中的服务设备的时延信息。
在本示例实施方式中，时延信息可以是根据业务需求配置的第一服务链的相关信息，该相关信息可以包括第一服务链中的服务设备的种类、数量、顺序。在形成第一服务链之后还可以配置流量包经过每个服务设备的最大时延信息。示例性地，可以对图3中的每个服务设备设置最大通过时延信息，例如可以根据业务需求配置最大时延信息为：FW配置最大时延为100ms(毫秒)，IPS配置最大时延为50ms，WAF配置最大时延为5000ms，IDS配置最大时延为200ms。该相关信息还可以包括其他信息，如该第一服务链的名称、标识信息等，本示例对此不做限定。
在配置第一服务链的时延信息之后，可以基于时延信息，确定第一流量包通过第一服务链的第一时长信息。
在本示例实施方式中，可以将第一服务链中每个服务设备的最大时延求和之后，将求和结果作为第一时长信息；也可以将第一服务链中每个服务设备的最大时延求和之后，对求和结果进行一定处理(如加上或减去一固定值)之后，将处理后的结果作为第一时长信息。还可以对每个服务设备的时延信息乘以一个安全系数(如0.95或1.1)之后再求和，本示例对该第一时长信息确定方式不作限定。
在一些实施例中，对第一服务链中的服务设备进行拆分，包括：确定第 一服务链中的服务设备之间的依赖关系。
在本示例实施方式中，依赖关系是指不同服务设备之间的相互依存关系。该依赖关系可以根据服务设备本身的属性信息确定，也可以由用户或管理员进行配置，本示例对此不做限定。
根据依赖关系，对第一服务链中的服务设备进行拆分，以使具有依赖关系的服务设备位于同一第二服务链中。
在本示例实施方式中，在第一服务链的拆分过程中可以将具有依赖关系的服务设备作为一个整体，不进行拆分，即本公开的服务链拆分需保存服务设备之间的依赖关系。示例性地，若图3中的FW和IPS之间存在依赖关系，则拆分后FW和IPS仍然位于同一第二服务链中，避免具有依赖关系的服务设备被拆分而达不到配置的服务处理效果。
在一些实施例中，方法还包括：根据多个第二服务链的数量，对第一流量包进行流量复制，以获得相同流量的多个第一流量包。
在本示例实施方式中，为了保证服务处理效果，第一流量包需要通过每个第二服务链，因此需要对进入第一服务链的第二流量包进行流量复制。可以采用各种流量复制工具进行流量复制，示例性地，可以采用基于应用层的流量复制工具或基于网格线的流量复制工具(直接从链路层抓取数据包)。具体地，可以采用流量复制引擎进行流量镜像/复制。
在本示例实施方式中，流量复制后得到的第一流量包的数量可以与第二服务链的数量相同，以使一个第二服务链对应一个第一流量包，满足并行流入的需求。
控制将多个第一流量包并行输入每个第二服务链进行服务处理。
在本示例实施方式中，可以控制将一个第一流量包引入一个第二服务链中进行服务处理。服务处理是指按照服务链中的服务设备的排列顺序对流入的第一流量包进行相应的服务处理。例如FW的服务处理可以包括防火墙的部分或全部安全检测、过滤、提醒等处理。
在一些实施例中，方法还包括：响应于多个第二服务链流出的第二流量包的比较结果，确定第一数据包，并转发第一数据包。
在本示例实施方式中，可以将每个第二服务链流出的第二流量包中所包含的数据包进行比较，当一个数据包通过了每个第二服务链的安全处理，可 以确定该数据包也可以通过第一服务链，可以确定该数据包为安全数据包，可以将该数据包转发至下一处理环节(如流分类器或交换机等)。
在本示例实施方式中，可以将通过每个第二服务链的数据包作为新的流量包进行转发，以便于数据管理，释放内存云资源池的存储空间。
在一些实施例中，方法还包括：对第二流量包中的数据包进行标记，并存储数据包及对应标记信息。
在本示例实施方式中，可以基于实际数据对第二流量包中的数据包进行标记。例如，可以对数据包进行顺序编码，如图4所示，可以采用1、2、3…等数字对不同数据包进行标记；也可以采用系统生成的编码对数据包标记；也可以采用其他能够区别不同数据包的标记方式，本示例对此不做限定。
在本示例实施方式中，可以对云资源池中的流出数据包及其标记信息进行存储，如可以存储于与相应的内存中，也可以将数据转发至对应的存储服务器进行存储，本示例对此不做限定。标记信息与对应数据包绑定存储，便于区分不同数据包。
基于第二流量包中数据包的标记信息，确定第一数据包。
在本示例实施方式中，可以直接比对每个第二服务链的流出数据包的标记信息，通过查找相同的标记信息从而快速确定第一数据包。
示例性地，如图4所示，将第一流量包引入两条第二服务链中，一条服务链的流出数据包为数据包1、数据包2、数据包3，另一条服务链的流出数据包为数据包3、数据包4，通过比对两条服务链流出数据包的标记信息可以快速确定出数据包3为第一数据包，对数据包3进行转发即可。可以将转发的数据包从内存中删除，以释放内存空间。经过一次数据转发后可以对云资源池中的数据包标记信息清零，以重新对下一批数据进行标记，节省内存空间。
在一些实施例中，方法还包括：获取多个第二服务链流出的第二流量包之间的数据包时延差信息。
在本示例实施方式中，数据包时延差信息是指相同数据包从不同第二服务链流出时的时间差。在流量包的服务处理过程中，可以实时获取第二流量包中每个数据包的流出时间，进而得到每个数据包的时延差信息。当一个数据包只从一个服务链流出的情况，可以是指时延差信息为None或无穷大。
根据数据包时延差信息，确定第二流量包中的第二数据包。
在本示例实施方式中，可以预先配置数据包的最大时延差信息，如可以配置为几到几十毫秒。当一个数据包的时延差信息超过该最大时延差时，可以判断该数据包为第二数据包。当一个数据包的时延差信息为None或无穷大，可以直接将其确定为第二数据包。
删除内存中的第二数据包及对应标记信息。
在本示例实施方式中，可以在确定第二数据包时，删除第二数据包及其对应的标记信息，以释放内存空间。
在一些实施例中，参考图5，本公开一个具体实施例的云资源池的服务控制方法可以包括以下步骤。
步骤S501，获取目标业务对应的第一服务链的服务链相关信息。
在本示例中，服务链相关信息可以包括服务链名称或标识、服务设备及其对应的时延信息、服务设备之间的依赖关系等。可以将服务设备及其对应时延信息以列表的形式存储和展示。
步骤S502，基于服务链相关信息，确定第一流量包通过第一服务链的第一时长信息。
在本示例中，可以将每个服务设备的时延之和作为第一时长信息。
步骤S503，判断第一时长信息是否超过预设的第二时长信息，若是，则转至步骤S504，否则转至步骤S511。
步骤S504，根据服务链相关信息，对第一服务链中的服务设备进行拆分，以使具有依赖关系的服务设备位于同一第二服务链中，以获得多个第二服务链。
步骤S505，根据多个第二服务链的数量，对第一流量包进行流量复制，以获得相同流量的多个第一流量包。
步骤S506，控制将多个第一流量包并行输入每个第二服务链进行服务处理。
步骤S507，对每个第二服务链流出的第二流量包中的数据包进行标记，并存储数据包及对应标记信息。
步骤S508，基于第二流量包中数据包的标记信息，确定第一数据包，并转发第一数据包。
步骤S509，获取第二流量包之间的数据包时延差信息，并根据数据包时延差信息，确定第二数据包。
步骤S510，删除内存中的第二数据包及对应标记信息。
步骤S511，控制第一流量包流入第一服务链进行服务处理。
上述实施例中步骤S510和S511执行完成后返回步骤S501继续进行下一轮服务处理。上述实施例的各个步骤的顺序只是示例性的，可以根据需要对步骤的顺序进行相应调整。例如，可以同时执行第一步和第五步。
随着用户对安全业务的需求越来越复杂化，服务链中服务设备的个数和复杂度逐渐增加，每种设备都代表着用户需要的安全能力，服务链的长度也随之增加。然而服务链往往要求用户无感知，即以极快的速度使流量快速通过服务链，这将给服务业务带来巨大挑战。
针对上述问题，本公开先通过计算原始第一服务链的第一时延信息，确定当前服务链是否满足业务需求，在当前服务链无法满足业务需求的情况下，对第一服务链进行拆分，重新设计服务链链路注册逻辑，将一条长链从逻辑上分成多条短链即第二服务链，有效缩短了服务链的绝对长度，从而大大缩短了第一流量包通过服务链的时长，加快流量包的服务处理过程，以满足用户的无感知需求。
为了保证云资源池的服务效果，本公开还对流出的第二流量包设计了流量聚合机制。使用分而治之的思想，借助流量复制机制，使第一流量包可以并行通过重新设计的短链。并在链的末端对每个短链流出的流量进行聚合，实现多个短链的流量重新合并，保证服务效果。有效解决了因服务设备太多和/或服务链过长，导致流量通过服务链时延无法满足业务需求的问题。
本公开通过设计服务链重定义，修改了原有的服务链逻辑，解决了因服务链长度而引发的时延过长问题。利用流量复制-多条链路引流-流量聚合的机制，能够对原本流经第一服务链的流量进行还原，不影响业务效果。
此外，本公开针对云网融合的业务场景，不需要进行微服务化和人工介入，也不需要对单个服务设备进行优化，对原系统和设备改造少，有助于安全业务在现网部署落地。在安全业务环境下，基于服务链的自动化场景，实现了降低时延，保证业务可靠性，提升云资源池的安全业务性能。
参见图6，本示例实施方式中还提供了一种云资源池控制器600，控制器 600可以包括：第一确定模块610、拆分模块620和控制模块630；第一确定模块610，可以用于确定第一流量包通过第一服务链的第一时长信息；第一服务链用于指示第一流量包按照预定顺序经过云资源池中预设数量的服务设备；拆分模块620，可以用于当第一时长信息超过预设的第二时长信息，对第一服务链中的服务设备进行拆分，以获得多个第二服务链；控制模块630，可以用于控制第一流量包并行输入每个第二服务链，进行服务处理。
在本公开的一个实施例中，控制器600还可以包括配置模块，配置模块用于配置第一服务链中的服务设备的时延信息。第一确定模块610还可以用于：基于时延信息，确定第一流量包通过第一服务链的第一时长信息。
在本公开的一个实施例中，拆分模块620可以包括：确定子模块和拆分子模块；确定子模块可以用于：确定第一服务链中的服务设备之间的依赖关系；拆分子模块可以用于：根据依赖关系，对第一服务链中的服务设备进行拆分，以使具有依赖关系的服务设备位于同一第二服务链中。
在本公开的一个实施例中，控制器还可以包括：复制模块，复制模块可以用于：根据多个第二服务链的数量，对第一流量包进行流量复制，以获得相同流量的多个第一流量包。控制模块还可以用于：控制将多个第一流量包并行输入每个第二服务链进行服务处理。
在本公开的一个实施例中，控制器还可以包括第二确定模块，第二确定模块可以用于：响应于多个第二服务链流出的第二流量包的比较结果，确定第一数据包，并转发第一数据包。
在本公开的一个实施例中，控制器还可以包括标记模块，标记模块可以用于：对第二流量包中的数据包进行标记，并存储数据包及对应标记信息。第二确定模块还可以用于：基于第二流量包中数据包的标记信息，确定第一数据包。
在本公开的一个实施例中，控制器还可以包括：获取模块、第三确定模块和删除模块；获取模块可以用于获取多个第二服务链流出的第二流量包之间的数据包时延差信息；第三确定模块可以用于根据数据包时延差信息，确定第二流量包中的第二数据包；删除模块可以用于删除内存中的第二数据包及对应标记信息。
上述实施例中的云资源池控制器中涉及的各个模块/单元的具体细节已 经在对应的云资源池的服务控制方法中进行了详细的描述，因此此处不再赘述。
参见图7，本示例实施方式中还提供了一种服务系统700，系统700可以包括：控制器710和服务设备720，其中：控制器710，可以用于确定第一流量包通过第一服务链的第一时长信息；第一服务链用于指示第一流量包按照预定顺序经过云资源池中预设数量的服务设备。控制器710，还可以用于当第一时长信息超过预设的第二时长信息，对第一服务链中的服务设备进行拆分，以获得多个第二服务链；并控制第一流量包并行输入每个第二服务链。服务设备720，可以用于对输入的第一流量包进行服务处理。
在本公开的一个实施例中，系统还包括：流量复制模块，流量复制模块用于根据多个所述第二服务链的数量，对所述第一流量包进行流量复制，以获得相同流量的多个第一流量包；控制器710还可以用于控制将多个第一流量包并行输入每个所述第二服务链进行服务处理。
在本公开的一个实施例中，系统还包括：流量聚合模块，流量聚合模块可以用于响应于多个所述第二服务链流出的第二流量包的比较结果，确定第一数据包，并转发所述第一数据包。
在本公开的一个实施例中，流量聚合模块还可以用于对所述第二流量包中的数据包进行标记，并存储数据包及对应标记信息；基于所述第二流量包中数据包的标记信息，确定所述第一数据包。
上述实施例中的服务系统中涉及的各个模块/单元的具体细节已经在对应的云资源池的服务控制方法中进行了详细的描述，因此此处不再赘述。
作为另一方面，本公开还提供了一种计算机可读介质，该计算机可读介质可以是上述实施例中描述的设备中所包含的；也可以是单独存在，而未装配入该设备中。上述计算机可读介质承载有一个或者多个程序，当上述一个或者多个程序被一个该设备执行时，使得该设备实现如下述实施例中的方法。例如，设备可以实现如图2-图5所示的各个步骤等。
需要说明的是，本公开所示的计算机可读介质可以是计算机可读信号介质或者计算机可读存储介质或者是上述两者的任意组合。计算机可读存储介质例如可以是——但不限于——电、磁、光、电磁、红外线、或半导体的系统、装置或器件，或者任意以上的组合。计算机可读存储介质的更 具体的例子可以包括但不限于：具有一个或多个导线的电连接、便携式计算机磁盘、硬盘、随机访问存储器(RAM)、只读存储器(ROM)、可擦式可编程只读存储器(EPROM或闪存)、光纤、便携式紧凑磁盘只读存储器(CD-ROM)、光存储器件、磁存储器件、或者上述的任意合适的组合。在本公开中，计算机可读存储介质可以是任何包含或存储程序的有形介质，该程序可以被指令执行系统、装置或者器件使用或者与其结合使用。而在本公开中，计算机可读的信号介质可以包括在基带中或者作为载波一部分传播的数据信号，其中承载了计算机可读的程序代码。这种传播的数据信号可以采用多种形式，包括但不限于电磁信号、光信号或上述的任意合适的组合。计算机可读的信号介质还可以是计算机可读存储介质以外的任何计算机可读介质，该计算机可读介质可以发送、传播或者传输用于由指令执行系统、装置或者器件使用或者与其结合使用的程序。计算机可读介质上包含的程序代码可以用任何适当的介质传输，包括但不限于：无线、电线、光缆、RF等等，或者上述的任意合适的组合。
此外，在本公开的示例性实施例中，还提供了一种能够实现上述方法的设备。所属技术领域的技术人员能够理解，本公开的各个方面可以实现为系统、方法或程序产品。因此，本公开的各个方面可以具体实现为以下形式，即：完全的硬件实施例、完全的软件实施例(包括固件、微代码等)，或硬件和软件方面结合的实施例，这里可以统称为“电路”、“模块”或“系统”。
参见图8，图8是本公开实施例提供的一种电子设备的结构示意图。如图8所示，该电子设备800包括处理器810、存储器820、输入输出接口830以及通信总线840。处理器810连接到存储器820和输入输出接口830，例如处理器810可以通过通信总线840连接到存储器820和输入输出接口830。处理器810被配置为支持该电子设备执行图2-图5中云资源池的服务控制方法中相应的功能。该处理器810可以是中央处理器(Central Processing Unit，CPU)，网络处理器(Network Processor，NP)，硬件芯片或者其任意组合。上述硬件芯片可以是专用集成电路(Application-Specific Integrated Circuit，ASIC)，可编程逻辑器件(Programmable Logic Device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(Complex Programmable Logic Device，CPLD)，现场可编程逻辑门阵列 (Field-Programmable Gate Array，FPGA)，通用阵列逻辑(Generic Array Logic，GAL)或其任意组合。存储器820用于存储程序代码等。存储器820可以包括易失性存储器(VolatileMemory，VM)，例如随机存取存储器(Random Access Memory，RAM)；存储器820也可以包括非易失性存储器(Non-Volatile Memory，NVM)，例如只读存储器(Read-Only Memory，ROM)，快闪存储器(flash memory)，硬盘(Hard Disk Drive，HDD)或固态硬盘(Solid-State Drive，SSD)；存储器820还可以包括上述种类的存储器的组合。
该输入输出接口830用于输入或输出数据。
处理器810可以调用上述程序代码以执行以下操作：确定第一流量包通过第一服务链的第一时长信息；第一服务链用于指示第一流量包按照预定顺序经过云资源池中预设数量的服务设备；当第一时长信息超过预设的第二时长信息，对第一服务链中的服务设备进行拆分，以获得多个第二服务链；控制第一流量包并行输入每个第二服务链，进行服务处理。
可选的，上述处理器810还可以执行以下操作：配置第一服务链中的服务设备的时延信息。基于时延信息，确定第一流量包通过第一服务链的第一时长信息。
可选的，上述处理器810还可以对第一服务链中的服务设备进行拆分，执行以下操作：确定第一服务链中的服务设备之间的依赖关系；根据依赖关系，对第一服务链中的服务设备进行拆分，以使具有依赖关系的服务设备位于同一第二服务链中。
可选的，上述处理器810还可以执行以下操作：根据多个第二服务链的数量，对第一流量包进行流量复制，以获得相同流量的多个第一流量包。控制将多个第一流量包并行输入每个第二服务链进行服务处理。
可选地，上述处理器810还可以执行以下操作：响应于多个第二服务链流出的第二流量包的比较结果，确定第一数据包，并转发第一数据包。
可选的，上述处理器810还可以执行以下操作：对第二流量包中的数据包进行标记，并存储数据包及对应标记信息；基于第二流量包中数据包的标记信息，确定第一数据包。
可选的，上述处理器810还可以执行以下操作：获取多个第二服务链流出的第二流量包之间的数据包时延差信息；根据数据包时延差信息，确定 第二流量包中的第二数据包；删除内存中的第二数据包及对应标记信息。
需要说明的是，各个操作的实现还可以对应参照图2-图5所示的方法实施例的相应描述；上述处理器810还可以与输入输出接口830配合执行上述方法实施例中的其他操作。
通过以上的实施例的描述，本领域的技术人员易于理解，这里描述的示例实施例可以通过软件实现，也可以通过软件结合必要的硬件的方式来实现。因此，根据本公开实施例的技术方案可以以软件产品的形式体现出来，该软件产品可以存储在一个非易失性存储介质(可以是CD-ROM，U盘，移动硬盘等)中或网络上，包括若干指令以使得一台设备执行根据本公开实施例的方法。
此外，上述附图仅是根据本公开示例性实施例的方法所包括的处理的示意性说明，而不是限制目的。易于理解，上述附图所示的处理并不表明或限制这些处理的时间顺序。另外，也易于理解，这些处理可以是例如在多个模块中同步或异步执行的。
需要说明的是，尽管在附图中以特定顺序描述了本公开中方法的各个步骤，但是，这并非要求或者暗示必须按照该特定顺序来执行这些步骤，或是必须执行全部所示的步骤才能实现期望的结果。附加的或备选的，可以省略某些步骤，将多个步骤合并为一个步骤执行，以及/或者将一个步骤分解为多个步骤执行等，均应视为本公开的一部分。
应可理解的是，本说明书公开和限定的本公开延伸到文中和/或附图中提到或明显的两个或两个以上单独特征的所有可替代组合。所有这些不同的组合构成本公开的多个可替代方面。本说明书的实施方式说明了已知用于实现本公开的最佳方式，并且将使本领域技术人员能够利用本公开。

Claims (10)

  1. 一种云资源池的服务控制方法，所述方法包括：
    确定第一流量包通过第一服务链的第一时长信息；所述第一服务链用于指示第一流量包按照预定顺序经过所述云资源池中预设数量的服务设备；
    当所述第一时长信息超过预设的第二时长信息，对所述第一服务链中的服务设备进行拆分，以获得多个第二服务链；
    控制所述第一流量包并行输入每个所述第二服务链，进行服务处理。
  2. 根据权利要求1所述的服务控制方法，其中，所述方法还包括：
    配置所述第一服务链中的服务设备的时延信息；
    所述确定第一流量包通过第一服务链的第一时长信息，包括：
    基于所述时延信息，确定第一流量包通过第一服务链的第一时长信息。
  3. 根据权利要求1或2所述的服务控制方法，其中，所述对所述第一服务链中的服务设备进行拆分，包括：
    确定所述第一服务链中的服务设备之间的依赖关系；
    根据所述依赖关系，对所述第一服务链中的服务设备进行拆分，以使具有所述依赖关系的服务设备位于同一所述第二服务链中。
  4. 根据权利要求1所述的服务控制方法，其中，所述方法还包括：
    根据多个所述第二服务链的数量，对所述第一流量包进行流量复制，以获得相同流量的多个第一流量包；
    所述控制所述第一流量包并行输入每个所述第二服务链，包括：
    控制将多个第一流量包并行输入每个所述第二服务链进行服务处理。
  5. 根据权利要求1或4所述的服务控制方法，其中，所述方法还包括：
    响应于多个所述第二服务链流出的第二流量包的比较结果，确定第一数据包，并转发所述第一数据包。
  6. 根据权利要求5所述的服务控制方法，其中，所述方法还包括：
    对所述第二流量包中的数据包进行标记，并存储数据包及对应标记信息；
    响应于多个所述第二服务链流出的第二流量包的比较结果，确定第一数据包，包括：
    基于所述第二流量包中数据包的标记信息，确定所述第一数据包。
  7. 根据权利要求6所述的服务控制方法，其中，所述方法还包括：
    获取多个所述第二服务链流出的第二流量包之间的数据包时延差信息；
    根据所述数据包时延差信息，确定所述第二流量包中的第二数据包；
    删除内存中的所述第二数据包及对应标记信息。
  8. 一种云资源池控制器，所述控制器包括：
    第一确定模块，用于确定第一流量包通过第一服务链的第一时长信息；所述第一服务链用于指示所述第一流量包按照预定顺序经过所述云资源池中预设数量的服务设备；
    拆分模块，用于当所述第一时长信息超过预设的第二时长信息，对所述第一服务链中的服务设备进行拆分，以获得多个第二服务链；
    控制模块，用于控制所述第一流量包并行输入每个所述第二服务链，进行服务处理。
  9. 一种服务系统，所述系统包括：控制器和服务设备，其中：
    所述控制器，用于确定第一流量包通过第一服务链的第一时长信息；所述第一服务链用于指示第一流量包按照预定顺序经过所述云资源池中预设数量的服务设备；
    所述控制器，还用于当所述第一时长信息超过预设的第二时长信息，对所述第一服务链中的服务设备进行拆分，以获得多个第二服务链；并控制所述第一流量包并行输入每个所述第二服务链；
    所述服务设备，用于对输入的所述第一流量包进行服务处理。
  10. 一种电子设备，包括：处理器；以及
    存储器，用于存储所述处理器的可执行指令；其中，所述处理器配置为经由执行所述可执行指令来执行权利要求1-7任一项所述的方法。
PCT/CN2022/141095 2022-07-08 2022-12-22 云资源池的服务控制方法、控制器及服务系统 WO2024007546A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210806159.7 2022-07-08
CN202210806159.7A CN117411876A (zh) 2022-07-08 2022-07-08 云资源池的服务控制方法、控制器及服务系统

Publications (1)

Publication Number Publication Date
WO2024007546A1 true WO2024007546A1 (zh) 2024-01-11

Family

ID=89454264

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/141095 WO2024007546A1 (zh) 2022-07-08 2022-12-22 云资源池的服务控制方法、控制器及服务系统

Country Status (2)

Country Link
CN (1) CN117411876A (zh)
WO (1) WO2024007546A1 (zh)

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107947965A (zh) * 2017-11-07 2018-04-20 清华大学 服务链编译器
CN109901926A (zh) * 2019-01-25 2019-06-18 平安科技（深圳）有限公司 基于大数据行为调度应用任务的方法、服务器及存储介质
CN110086675A (zh) * 2019-05-05 2019-08-02 广东技术师范大学 服务链的构建方法、设备及计算机可读存储介质
CN111404747A (zh) * 2020-03-16 2020-07-10 广东技术师范大学 自适应的服务功能链并行处理的方法、设备及存储介质
US20210400537A1 (en) * 2021-06-25 2021-12-23 Intel Corporation Cross-layer and cross-access technology traffic splitting and retransmission mechanisms
CN114124713A (zh) * 2022-01-26 2022-03-01 北京航空航天大学 操作级功能并行和自适应资源分配的服务功能链编排方法
CN114691324A (zh) * 2022-03-15 2022-07-01 阿里巴巴（中国）有限公司 任务处理并行度的弹性调整方法及装置

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107947965A (zh) * 2017-11-07 2018-04-20 清华大学 服务链编译器
CN109901926A (zh) * 2019-01-25 2019-06-18 平安科技（深圳）有限公司 基于大数据行为调度应用任务的方法、服务器及存储介质
CN110086675A (zh) * 2019-05-05 2019-08-02 广东技术师范大学 服务链的构建方法、设备及计算机可读存储介质
CN111404747A (zh) * 2020-03-16 2020-07-10 广东技术师范大学 自适应的服务功能链并行处理的方法、设备及存储介质
US20210400537A1 (en) * 2021-06-25 2021-12-23 Intel Corporation Cross-layer and cross-access technology traffic splitting and retransmission mechanisms
CN114124713A (zh) * 2022-01-26 2022-03-01 北京航空航天大学 操作级功能并行和自适应资源分配的服务功能链编排方法
CN114691324A (zh) * 2022-03-15 2022-07-01 阿里巴巴（中国）有限公司 任务处理并行度的弹性调整方法及装置

Also Published As

Publication number Publication date
CN117411876A (zh) 2024-01-16

Similar Documents

Publication Publication Date Title
US10389813B2 (en) Reconfigurable cloud computing
CN110943961B (zh) 数据处理方法、设备以及存储介质
US10003649B2 (en) Systems and methods to improve read/write performance in object storage applications
US10951646B2 (en) Biology based techniques for handling information security and privacy
US9531648B2 (en) Managing data paths in an operator graph
US10079750B2 (en) Limiting data output from windowing operations
US11831682B2 (en) Highly scalable distributed connection interface for data capture from multiple network service and cloud-based sources
US20150286437A1 (en) Anti-virus scan via a secondary storage controller that maintains an asynchronous copy of data of a primary storage controller
WO2020232887A1 (zh) 容器应用的配置修改方法、装置、计算机设备及存储介质
US11005890B2 (en) Secure software defined storage
Narantuya et al. Service-aware cloud-to-cloud migration of multiple virtual machines
US10042736B2 (en) Breakpoint for predicted tuple processing time in a streaming environment
WO2014179637A1 (en) End-to-end classification of storage traffic streams
Jin et al. Parallel simulation and virtual-machine-based emulation of software-defined networks
WO2024007546A1 (zh) 云资源池的服务控制方法、控制器及服务系统
US9189212B2 (en) Predicted outputs in a streaming environment
US9870304B2 (en) System for verifying historical artifacts in disparate source control systems
Al-Ayyoub et al. A novel framework for software defined based secure storage systems
US20180198704A1 (en) Pre-processing of data packets with network switch application -specific integrated circuit
US8887291B1 (en) Systems and methods for data loss prevention for text fields
US10275274B2 (en) Combinations of removable workload optimized modules for implementing different application workloads
US20220156226A1 (en) Replication continued enhancement method
WO2020000409A1 (en) Managing quality of storage service in virtual network
KR102038193B1 (ko) 소프트웨어 정의 네트워크에서 퍼미션 모델링 방법, 시스템 및 컴퓨터 프로그램

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22950103

Country of ref document: EP

Kind code of ref document: A1