WO2024066639A1

WO2024066639A1 - Service data processing method and device, and computer-readable storage medium

Info

Publication number: WO2024066639A1
Application number: PCT/CN2023/105406
Authority: WO
Inventors: 陈彬宇; 刘雪峰; 刘兴
Original assignee: 中兴通讯股份有限公司
Priority date: 2022-09-28
Filing date: 2023-06-30
Publication date: 2024-04-04
Also published as: CN117834461A

Abstract

The present application relates to the technical field of communications, and discloses a service data processing method and device, and a computer-readable storage medium. The method comprises: on the basis of an OVS flow table query instruction, collecting original flow table data of each server in a current environment; performing structured processing on the original flow table data, and determining structured flow table data corresponding to the original flow table data; according to first transmission port information of the structured flow table data, screening the structured flow table data, and determining service-related flow table data in the structured flow table data; and according to second transmission port information and quintuple information of the service-related flow table data, splicing the service-related flow table data, and determining internal service flow table data in the current environment.

Description

Business data processing method, device and computer readable storage medium

Related Applications

This application claims priority to Chinese patent application No. 202211193829.9 filed on September 28, 2022, the entire contents of which are incorporated by reference into this application.

Technical Field

The present application relates to the field of communication technology, and in particular to a business data processing method, device and computer-readable storage medium.

Background technique

Traditional data center security approaches rely primarily on perimeter defenses to protect north-south traffic (i.e., traffic between inside and outside the data center), but east-west traffic within the data center (i.e., traffic between different business loads in the data center) cannot be detected.

In the network micro-segmentation application scenario, in order to facilitate users to clearly identify the business flows that need to be controlled, it is necessary to present all business flow data in the environment to users. To obtain data, it is necessary to first collect all flow data in the environment. The traditional method of collecting business flow data is to collect it by capturing packets.

However, in large-scale environments, the amount of business data is very large. If full-environment packet capture is performed to collect business data, many packet capture mapping ports need to be created, resulting in low efficiency in business flow data collection and reducing the technical problem of message forwarding performance in the current environment.

Summary of the invention

The main purpose of this application is to provide a business data processing method, device and computer-readable storage medium, aiming to solve the technical problem that the efficiency of business flow data collection is low and the message forwarding performance in the current environment is reduced.

To achieve the above objectives, in a first aspect, the present application provides a business data processing method, the business data processing method comprising:

Based on the OVS flow table query instruction, collect the original flow table data of each server in the current environment;

The original flow table data is structured to determine the structure corresponding to the original flow table data. Structure the flow table data;

According to the first transmission port information of the structured flow table data, the structured flow table data is screened to determine each service-related flow table data in the structured flow table data;

According to the second transmission port information and the five-tuple information of each of the business-related flow table data, each of the business-related flow table data is spliced to determine the internal business flow table data in the current environment.

Based on the above technical solution, the original flow table data of each server in the current environment is collected based on the OVS flow table query instruction; the original flow table data is structured to determine the structured flow table data corresponding to the original flow table data; according to the first transmission port information of the structured flow table data, the structured flow table data is screened to determine each business-related flow table data in the structured flow table data; according to the second transmission port information and five-tuple information of each business-related flow table data, each business-related flow table data is spliced to determine the internal business flow table data in the current environment. This embodiment collects flow table data through the OVS flow table query instruction, which avoids the problem of residual mapping ports, that is, improves the collection efficiency of business flow data, and avoids the problem of residual mapping ports, avoiding affecting the message forwarding performance of the current environment, and the normal use of the current environment, and determines the internal business flow table data in the current environment through splicing through the transmission port information and five-tuple information of the flow table data, ensuring the integrity of the internal business flow table data.

Exemplarily, the execution subject of the business data processing method is a business data processing device.

In a second aspect, the present application provides a business data processing device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the business data processing method as described above.

In a third aspect, the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the processor executes a business data processing method as described in any one of the first aspect or possible implementations of the first aspect.

In a fourth aspect, an embodiment of the present application provides a computer program, which includes a method for executing the business data processing method in the first aspect and any possible implementation of the first aspect. Instructions.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of the structure of a business data processing device in a hardware operating environment involved in an embodiment of the present application;

FIG2 is a flow chart of an embodiment of a method for processing business data of the present application;

FIG3 is an application scenario diagram of an embodiment of a business data processing method of the present application;

FIG4 is a flow chart of another embodiment of the business data processing method of the present application;

FIG5 is a visualized business flow topology diagram in an embodiment of a business data processing method of the present application;

FIG6 is a timing diagram of an embodiment of a business data processing method of the present application.

The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings.

Detailed ways

The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

The term "and/or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and/or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

The terms "first" and "second" in the description and claims of the embodiments of the present application are used to distinguish different objects rather than to describe a specific order of objects. For example, a first target object and a second target object are used to distinguish different target objects rather than to describe a specific order of target objects.

In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

In the description of the embodiments of the present application, unless otherwise specified, the meaning of "multiple" refers to two or more than two. For example, multiple processing units refer to two or more processing units; multiple systems refer to two or more systems.

In order to make the description of the following embodiments clear and concise, a brief introduction to an implementation scheme of a business data processing method is first given:

However, for large-scale environments, the amount of business data is very large. If packet capture is performed in the entire environment to collect business data, many packet capture mapping ports need to be created. Therefore, on the one hand, the existing business data processing method needs to collect and analyze all data flows in the environment, resulting in low efficiency in business flow data collection; on the other hand, too many packet capture mapping ports will reduce the message forwarding performance of the current environment, and port residues are likely to occur, thereby affecting the normal use of the current environment.

The present application designs a method for collecting flow table data through OVS flow table query instructions, and splicing the transmission port information and five-tuple information of the flow table data to determine the internal business flow table data in the current environment, which improves the collection efficiency of business flow data and avoids the problem of residual mapping ports, avoids affecting the message forwarding performance of the current environment, and the normal use of the current environment.

In some embodiments, based on the OVS flow table query instruction, the original flow table data of each server in the current environment is collected; the original flow table data is structured to determine the structured flow table data corresponding to the original flow table data; according to the first transmission port information of the structured flow table data, the structured flow table data is screened to determine each business-related flow table data in the structured flow table data; according to the second transmission port information and five-tuple information of each business-related flow table data, each business-related flow table data is spliced to determine the internal business flow table data in the current environment. This embodiment collects flow table data through OVS flow table query instructions, avoiding the mapping port. The residual problem is solved, which improves the collection efficiency of business flow data and avoids the problem of mapping port residue, avoids affecting the message forwarding performance of the current environment and the normal use of the current environment, and determines the internal business flow table data in the current environment through splicing the transmission port information and the five-tuple information of the flow table data, thereby ensuring the integrity of the internal business flow table data.

In some embodiments, after obtaining the internal business flow table data of the current environment, the business load nodes in the current environment and the association relationship between the business load nodes are determined based on the internal business flow table data; based on the association relationship, the business load nodes are connected through business lines to construct and output a visual business flow topology diagram of the current environment.

In this embodiment, the business load nodes in the current environment and the association relationship between the business load nodes are determined based on the internal business flow table data, and then the business load nodes are connected through business lines based on the association relationship, and a visual business flow topology diagram of the current environment is constructed and output, so that the user can intuitively understand the business relationship between each business load node in the current environment.

Refer to Figure 1, which is a schematic diagram of the structure of a business data processing device in the hardware operating environment involved in the embodiment of the present application.

As shown in FIG1 , the business data processing device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the user interface 1003 may also include a standard wired interface and a wireless interface. The network interface 1004 may include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may also be a storage device independent of the aforementioned processor 1001.

Those skilled in the art will appreciate that the structure shown in FIG. 1 does not constitute a limitation on the business data processing device, and may include more or fewer components than shown in the figure, or a combination of certain components, or a different arrangement of components.

As shown in FIG1 , the memory 1005 as a storage medium may include an operating system, a data Data storage module, network communication module, user interface module and computer program.

In the business data processing device shown in Figure 1, the network interface 1004 is mainly used for data communication with other devices; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the business data processing device of the present application can be set in the business data processing device, and the business data processing device calls the computer program stored in the memory 1005 through the processor 1001, and executes the business data processing method provided in the embodiment of the present application.

It should be understood that the above description is merely an example listed for a better understanding of the technical solution of this embodiment, and is not intended to be the sole limitation to this embodiment.

The following describes the business data processing method in detail with reference to the flowchart of an embodiment of the business data processing method shown in FIG. 2 .

Referring to FIG. 2 , an embodiment of a business data processing method of the present application specifically includes:

Step S10, based on the OVS flow table query instruction, collect the original flow table data of each server in the current environment;

In some embodiments, the execution subject of the business data processing method of the present application may be a business data processing device.

Specifically, the OVS flow table query instruction is an instruction for instructing OVS (Open vSwitch, virtual switch) to perform a flow table query. The current environment is the current application environment built for each server according to application requirements, such as Linux+Apache (Nginx)+Mysql+Php (that is, LAMP/LNMP environment), WINDOWS+IIS+ASP/.NET+MSSQL environment. In order to support the implementation of the OVS query instruction, the current environment needs to have OVS functions, that is, each server in the current environment is internally deployed with OVS for realizing exchange between virtual machines. In this embodiment, the OVS flow table query instruction is sent down to the OVS in each server in the current environment, and the flow table inside the server is queried by OVS, so that the original flow table data of each server in the current environment can be collected.

In some embodiments, each of the servers is deployed with an information collection unit, and step S10 is a step of collecting original flow table data of each server in the current environment based on the OVS flow table query instruction, including:

Step S11, in response to the service flow collection request, the service flow collection request is sent to the information collection unit of each server in the current environment, so that

Each of the information collection units sends a corresponding OVS flow table query instruction to the virtual switch on each of the servers according to the service collection request, and obtains the original information of each of the servers in the current environment. Initial flow table data.

In some embodiments, the service flow collection request may include a collection period and a collection interval.

In this embodiment, when a service flow collection request from a user is received, the service flow collection request is sent to the information collection unit of each server in the current environment in response to the service flow collection request. After receiving the service collection request, each information collection unit sends a corresponding OVS flow table query instruction to the virtual switch on each server according to the collection cycle and collection interval in the service collection request, so that the virtual switch on each server queries the flow table of each server, determines the original flow table data of each server, and returns the original flow table data.

Refer to Figure 3, which is an application scenario diagram of an embodiment of the business data processing method of the present application. In Figure 3, the agent is an information collection unit deployed on each server in the current environment, responsible for collecting the original flow table data and sending it to the analyzer. The analyzer is an analysis unit deployed on the control node server of the current environment, responsible for receiving the business flow collection request sent by the user through the portal (client) and sending it to each agent, and receiving and summarizing the information reported by the agent and sending it to the user.

In this embodiment, by responding to the service flow collection request, the service flow collection request is sent to the information collection unit of each server in the current environment, so that each information collection unit sends the corresponding OVS flow table query instruction to the virtual switch on each server according to the service collection request, and obtains the original flow table data of each server in the current environment. On the one hand, querying the flow table data to the virtual switch on each server through the OVS flow table query instruction can avoid the problem of residual mapping ports in the traditional packet capture method. On the other hand, the method of deploying information collection units on each server can also effectively improve the collection efficiency of the original flow table data.

Step S20, performing structured processing on the original flow table data to determine structured flow table data corresponding to the original flow table data;

In some embodiments, the structured flow table data includes a service load node, an input port (input) and an output port (output) of the flow table, a source IP address, a destination IP address, a communication port number, a protocol type, and the like.

The original flow table data returned by the server's virtual switch is a flow table in a string format. Therefore, in order to facilitate data processing, the original flow table data needs to be structured. Among them. The process of the structured processing is to compile according to the original flow table data and the preset flow table structure framework, so as to obtain the flow table structure corresponding to the original flow table data (that is, the structured flow table data), so as to determine the structured flow table data corresponding to the original flow table data.

Step S30, screening the structured flow table data according to the first transmission port information of the structured flow table data, and determining each service-related flow table data in the structured flow table data;

The flow table is a collection of policy items for a specific flow, which is responsible for searching and forwarding data packets. Therefore, the structured flow table data obtained are not all related to the business. In order to determine the business-related flow table data in the structured flow table data. Since the structured flow table data contains the first transmission port information, the output port and input port of the business flow corresponding to the structured flow table can be determined. Therefore, the first transmission port information of the structured flow table data can be used to determine whether the business flow corresponding to the structured flow table data occurs on the business load node of each server, so as to screen the structured flow table data and determine the business-related flow table data in the structured flow table data.

In some embodiments, the first transmission port information includes a first input port and a first output port, and step S30 screens the structured flow table data according to the first transmission port information of the structured flow table data to determine each service-related flow table data in the structured flow table data, including:

Step S31, determining whether the first input port or the first output port of the structured flow table data is a port of a service load node in the current environment;

Step S32: If the first input port and/or the first output port is a port of a service load node in the current environment, it is determined that the structured flow table data is service-related flow table data.

In some embodiments, the service load node is a virtual machine used to implement various services in the current environment. The first transmission port information includes a first input port and a first output port.

Since the first input port or the first output port of the structured flow table data is not necessarily a port of a virtual machine, it may also be a physical port and a tunnel. Therefore, in order to avoid missing business flow table data, it is determined whether the first input port or the first output port of the structured flow table data is a port of a business load node under the current environment. If the first input port and/or the first output port are ports of a business load node under the current environment, the structured flow table data is determined to be business-related flow table data (i.e., structured flow table data related to business). If the first input port and the first output port are not ports of a business load node under the current environment, the structured flow table data is determined to be not business-related flow table data, and can be discarded.

In this embodiment, by judging whether the first input port or the first output port of the structured flow table data is a port of the service load node in the current environment, the structured flow table data whose first input port and/or the first output port is a port of the service load node in the current environment is judged to be service-related flow table data, thereby filtering out service-related service from the structured flow table data. Service-related flow table data.

Step S40: splicing each of the service-related flow table data according to the second transmission port information and the five-tuple information of each of the service-related flow table data to determine the internal service flow table data in the current environment.

In some embodiments, the five-tuple information includes: source IP address, source port, destination IP address, destination port and transport layer protocol.

The business-related flow table data contains flow table data in which only the input port or the output port is determined to be the port of the business load node in the current environment. Therefore, there may be flow table data of business flows that are not in the current environment. That is, the business-related flow table data may contain flow table data of business flows in which the business load node in the current environment interacts with other devices outside the current environment.

Thus, according to the second transmission port information in each of the business-related flow table data, it is possible to determine the flow table data (i.e., the first spliced flow table data) whose input and output ports are both ports of the business load node in the current environment, and the flow table data (i.e., the source end flow table data) whose only input port in each of the business-related flow table data is the port of the business load node in the current environment, and the flow table data (i.e., the destination end flow table data) whose only output port is the port of the business load node in the current environment. Wherein the input port and output port of the first spliced flow table data are both ports of the business load node in the current environment, it is obviously the internal business flow table data in the current environment.

Since only the input port or the output port of the source end flow table data and the destination end flow table data is determined to be the port of the business load node in the current environment, it is possible that it is the flow table data of the business flow that is not in the current environment. In addition, since the input port or the output port is not necessarily the port of the virtual machine, but may also be a physical port and a tunnel, the source end flow table data and the destination end flow table data may also be the input part and the output part of the same business flow in the current environment. Therefore, the five-tuple information of the source end flow table data and the destination end flow table data can be matched. If the match is successful, it means that the source end flow table data and the destination end flow table data are the input part and the output part of the same business flow in the current environment, then the source end flow table data and the destination end flow table data can be spliced to obtain the second spliced flow table data. The first spliced flow table data and the second spliced flow table data are used as the internal business flow table data in the current environment.

In some embodiments, step S40 splices each of the business-related flow table data according to the second transmission port information and the five-tuple information of each of the business-related flow table data to determine the internal business flow table data in the current environment, including:

Step S41, dividing each of the service-related flow table data into source end flow table data, destination end flow table data and first spliced flow table data according to the second transmission port information in each of the service-related flow table data;

Step S42, generating a first flow code according to the five-tuple information of the source end flow table data;

Step S43, generating a second flow code according to the five-tuple information of the destination end flow table data;

Step S44, when the first flow code matches the second flow code, splicing the source end flow table data and the destination end flow table data to obtain second spliced flow table data;

Step S45: Use the first spliced flow table data and the second spliced flow table data as internal service flow table data in the current environment.

In this embodiment, each of the service-related flow table data is divided into flow table data (i.e., source end flow table data) whose only input port is a port of a service load node under the current environment, flow table data (i.e., destination end flow table data) whose only output port is a port of a service load node under the current environment, and flow table data (i.e., first spliced flow table data) whose input port and output port are both ports of a service load node under the current environment. Among them, the input port and output port of the first spliced flow table data are both ports of a service load node under the current environment. Obviously, the service flow corresponding to the first spliced flow table data is the service flow under the current environment, and the first spliced flow table data is also the internal service flow table data under the current environment. If only the input port or the output port of the source end flow table data and the destination end flow table data are determined to be ports of a service load node under the current environment, then it is possible that they are flow table data of a service flow not under the current environment. In addition, since the input port or the output port is not necessarily a port of a virtual machine, and may also be a physical port and a tunnel, the source end flow table data and the destination end flow table data may also be the input part and the output part of the same service flow under the current environment.

Therefore, a first flow code can be generated according to the five-tuple information of the source end flow table data, and a second flow code can be generated according to the five-tuple information of the destination end flow table data. The first flow code and the second flow code can be generated by respectively calculating the five-tuple information of the source end flow table data and the destination end flow table data using a hash algorithm. When the first flow code matches the second flow code, it means that the source end flow table data and the destination end flow table data are respectively the input part and the output part of the same business flow in the current environment, then the source end flow table data and the destination end flow table data can be spliced to obtain the second spliced flow table data. Specifically, the way to splice the source end flow table data and the destination end flow table data can be, Extract source information from the source flow table data, wherein the source information includes the packet header field, counter and other contents in the action table of the source flow table data except the output port. Extract destination information from the destination flow table data, wherein the destination information includes the counter and action table of the destination flow table data. Fill the source information and the destination information into the preset flow table structure framework to obtain the second spliced flow table data. Thus, the first spliced flow table data and the second spliced flow table data include the business flow data between all business load nodes in the current environment. Then, the first spliced flow table data and the second spliced flow table data can be used as internal business flow table data in the current environment.

In this embodiment, by dividing each of the business-related flow table data into source-end flow table data, destination-end flow table data and first spliced flow table data according to the second transmission port information in each of the business-related flow table data; and according to the five-tuple information of the source-end flow table data and the destination-end flow table data, the matching source-end flow table data and the destination-end flow table data are spliced to obtain the second spliced flow table data; the first spliced flow table data and the second spliced flow table data are used as the internal business flow table data in the current environment, thereby avoiding omissions in the business flow table data and ensuring the integrity of the internal business flow table data.

In some embodiments, the second transmission port information includes a second input port and a second output port, and step S41 divides each of the service-related flow table data into source end flow table data, destination end flow table data, and first spliced flow table data according to the second transmission port information in each of the service-related flow table data, including:

Step A1, when the second input port is a port of a service load node in the current environment, and the second output port is not a port of a service load node in the current environment, determining that the service-related flow table data is source end flow table data;

Step A2, when the second input port is not a port of a service load node in the current environment, and the second output port is a port of a service load node in the current environment, determining that the service-related flow table data is a destination end flow table data;

Step A3: when the second input port and the second output port are both ports of the service load node in the current environment, it is determined that the service-related flow table data is the first spliced flow table data.

In some embodiments, the second transmission port information includes a second input port and a second output port.

In this embodiment, the service-related flow table data is classified by the second input port and the second output port of the service-related flow table data into flow table data (i.e., source end flow table data) whose input port is a port of the service load node in the current environment and flow table data whose output port is a port of the service load node in the current environment. The flow table data of the port of the business load node under the current environment (i.e., the destination end flow table data) and the flow table data of the port of the business load node whose input port and output port are both under the current environment (i.e., the first spliced flow table data) are identified. Thus, the source end flow table data and the destination end flow table data that need to be spliced, and the first spliced flow table data that does not need to be spliced are identified.

In this embodiment, based on the OVS flow table query instruction, the original flow table data of each server in the current environment is collected; the original flow table data is structured to determine the structured flow table data corresponding to the original flow table data; according to the first transmission port information of the structured flow table data, the structured flow table data is screened to determine each business-related flow table data in the structured flow table data; according to the second transmission port information and five-tuple information of each business-related flow table data, each business-related flow table data is spliced to determine the internal business flow table data in the current environment. This embodiment collects flow table data through the OVS flow table query instruction, which avoids the problem of residual mapping ports, that is, improves the collection efficiency of business flow data, and avoids the problem of residual mapping ports, avoiding affecting the message forwarding performance of the current environment, as well as the normal use of the current environment, and determines the internal business flow table data in the current environment through splicing through the transmission port information and five-tuple information of the flow table data, thereby ensuring the integrity of the internal business flow table data.

The business data processing method is described in detail below with reference to the flowchart diagram of another embodiment of the business data processing method shown in FIG. 4 .

Referring to FIG. 4 , in another embodiment of the service data processing method of the present application, in step S40, after splicing each of the service-related flow table data according to the second transmission port information and the five-tuple information of each of the service-related flow table data and determining the internal service flow table data in the current environment, the service data processing method further includes:

Step S50, determining the service load nodes in the current environment and the association relationship between the service load nodes according to the internal service flow table data;

Step S51, connecting the service load nodes through service lines according to the association relationship, constructing and outputting a visualized service flow topology diagram of the current environment.

After obtaining the internal business flow table data, the internal business flow table data is analyzed, and the business load nodes in the current environment and the association relationship between the business load nodes can be determined through the input port and output port of the internal business flow table data. Relationship, the business load nodes are connected through business lines, and a visualized business flow topology diagram of the current environment is constructed and output. The business lines are used to indicate the input and output directions between the business load nodes. Referring to Figure 5, Figure 5 is a visualized business flow topology diagram in an embodiment of the business data processing method of the present application. In the current environment described in Figure 5, there are two virtual machines (i.e., business load nodes), virtual machine 1 (vm1) belongs to business 1 and provides a view function, and virtual machine 2 (vm2) belongs to business 2 and provides a collect function. There is a message flow of mutual ping (ping is a service command, which mainly sends a request message to a specific destination host to test whether the destination station is reachable and understand its relevant status) between the two virtual machines. Virtual machine 1 (vm1) and virtual machine 2 (vm2) initiate a TCP (Transmission Control Protocol) request, and virtual machine 2 (vm2) has a corresponding packet return message flow. Therefore, virtual machine 1 (vm1) and virtual machine 2 (vm2) have two ICMP (Internet Control Message Protocol) flows, one TCP request flow and one TCP response flow, a total of four business flow data. The two dark gray solid business lines in Figure 5 are used to represent the two ICMP flows, the light gray solid business line is used to represent the TCP request flow, and the light gray dotted business line is used to represent the TCP response flow.

In some embodiments, step S51 connects the service load nodes through service lines according to the association relationship, constructs and outputs a visualized service flow topology diagram of the current environment, and the service data processing method further includes:

Step B1, obtaining current control strategy information of network micro-segmentation, and performing differentiated display on the service connection according to the current control strategy information.

In some embodiments, the current control policy information of the network micro-segmentation includes prohibition, permission, and non-control.

In order to facilitate users to more intuitively understand the current control policy information of the network micro-segmentation between all business load nodes in the current environment. After obtaining the current control policy information of the network micro-segmentation, the business connection can be displayed differently according to the current control policy information. Exemplarily, the business connection between each business load node can be displayed in different colors, shades, and shapes. For example, when the current control policy information of two business load nodes is prohibited, the business connection between the two business load nodes is displayed in red; when the current control policy information of two business load nodes is allowed, the business connection between the two business load nodes is displayed in green; when the current control policy information of two business load nodes is not controlled, the business connection between the two business load nodes is displayed in gray.

In some embodiments, after the business load nodes are connected through business lines according to the association relationship in step S51, and a visualized business flow topology diagram of the current environment is constructed and output, the process includes:

Step C1, in response to a selection instruction for a service line on the visualized service flow topology diagram, displaying internal service flow table data corresponding to the service line.

In order to facilitate the user to understand the detailed information of the business flow between each of the business load nodes, the internal business flow table data corresponding to the business connection can be displayed by responding to the selection instruction for the business connection on the visual business flow topology diagram. Thus, this embodiment displays the internal business flow table data corresponding to the business connection by responding to the selection instruction for the business connection on the visual business flow topology diagram. Thereby improving the convenience for users to understand the detailed information of the business flow between each of the business load nodes. Of course, the current control strategy information and expected control strategy information of the network micro-segment corresponding to the business connection can also be displayed. Exemplarily, when the user clicks on a certain business connection line, the corresponding internal business flow table data of the business connection line can be presented, also referring to Figure 5, as shown in Figure 5, from the source address of IP 111.111.111.246 to the destination address of IP 111.111.111.214, sent to the TCP message flow data of port 5201, the current policy control is allowed.

Referring to Figure 6, Figure 6 is a timing diagram of an embodiment of the business data processing method of the present application. The user sends a business flow collection request to the analysis unit analyzer through the client portal. After receiving the business flow collection request and analyzing the business flow collection request, the analysis unit analyzer sends the business flow collection request to the information collection unit agent of each server in the current environment. Thus, the information collection unit agent sends the corresponding OVS flow table query instruction to the virtual switch OVS on each server according to the business collection request. The virtual switch OVS obtains the original flow table data of each server in the current environment through query, and returns the original flow table data to the information collection unit agent. The information collection unit agent then outputs the original flow table data in the string format in a structured manner to obtain structured flow table data. Then, by judging whether the first input port or the first output port of the structured flow table data is a port of a business load node in the current environment, the structured flow table data whose first input port and/or the first output port is a port of a business load node in the current environment is screened out as business-related flow table data. The information collection unit agent also divides each of the service-related flow table data into source end flow table data, destination end flow table data and first spliced flow table data according to the second transmission port information in each of the service-related flow table data. Of course, the process of dividing each of the service-related flow table data can also be performed by the analysis unit analyzer. Then the analysis unit analyzer divides each of the service-related flow table data into source end flow table data, destination end flow table data and first spliced flow table data according to the second transmission port information in each of the service-related flow table data. The five-tuple information of the source end flow table data and the destination end flow table data is spliced to obtain the second spliced flow table data, the first spliced flow table data and the second spliced flow table data are used as the internal business flow table data in the current environment, and the internal business flow table data is sent to the client portal. The client portal constructs and outputs a visualized business flow topology diagram of the current environment by performing a visualized topology operation on the internal business flow table data.

It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or system including the element.

The serial numbers of the embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk) as described above, including a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

The above are only optional embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

A method for processing business data, wherein the method for processing business data comprises:

Based on the OVS flow table query instruction, collect the original flow table data of each server in the current environment;

Performing structured processing on the original flow table data to determine structured flow table data corresponding to the original flow table data;

According to the first transmission port information of the structured flow table data, the structured flow table data is screened to determine each service-related flow table data in the structured flow table data;

According to the second transmission port information and the five-tuple information of each of the business-related flow table data, each of the business-related flow table data is spliced to determine the internal business flow table data in the current environment.
The service data processing method according to claim 1, wherein each of the servers is deployed with an information collection unit, and the step of collecting the original flow table data of each server in the current environment based on the OVS flow table query instruction comprises:

In response to the service flow collection request, the service flow collection request is sent to the information collection unit of each server in the current environment, so that

Each of the information collection units sends a corresponding OVS flow table query instruction to the virtual switch on each of the servers according to the service collection request, and obtains the original flow table data of each of the servers in the current environment through query.
The service data processing method according to claim 1, wherein the first transmission port information includes a first input port and a first output port, and the step of screening the structured flow table data according to the first transmission port information of the structured flow table data to determine each service-related flow table data in the structured flow table data comprises:

Determine whether the first input port or the first output port of the structured flow table data is a port of a service load node in the current environment;

If the first input port and/or the first output port is a port of a service load node in the current environment, it is determined that the structured flow table data is service-related flow table data.
The business data processing method according to claim 3, wherein the The steps of combining the second transmission port information and the five-tuple information of the relevant flow table data, and determining the internal business flow table data under the current environment include:

According to the second transmission port information in each of the service-related flow table data, each of the service-related flow table data is divided into source end flow table data, destination end flow table data and first spliced flow table data;

Generate a first flow code according to the five-tuple information of the source end flow table data;

Generate a second flow code according to the five-tuple information of the destination end flow table data;

When the first flow code matches the second flow code, splicing the source end flow table data and the destination end flow table data to obtain second spliced flow table data;

The first spliced flow table data and the second spliced flow table data are used as internal business flow table data in the current environment.
The service data processing method according to claim 4, wherein the second transmission port information includes a second input port and a second output port, and the step of dividing each of the service-related flow table data into source end flow table data, destination end flow table data, and first spliced flow table data according to the second transmission port information in each of the service-related flow table data comprises:

When the second input port is a port of a service load node in the current environment, and the second output port is not a port of a service load node in the current environment, determining that the service-related flow table data is source end flow table data;

When the second input port is not a port of a service load node in the current environment, and the second output port is a port of a service load node in the current environment, determining that the service-related flow table data is destination end flow table data;

When the second input port and the second output port are both ports of a service load node in the current environment, it is determined that the service-related flow table data is the first spliced flow table data.
The service data processing method according to any one of claims 1 to 5, wherein, after the step of splicing each of the service-related flow table data according to the second transmission port information and the five-tuple information of each of the service-related flow table data to determine the internal service flow table data in the current environment, the service data processing method further comprises:

Determine the service load nodes in the current environment and the association relationship between the service load nodes according to the internal service flow table data;

According to the association relationship, the business load nodes are connected through business lines to construct and output a visualized business flow topology diagram of the current environment.
The business data processing method according to claim 6, wherein the step of connecting the business load nodes through business lines according to the association relationship, and constructing and outputting a visualized business flow topology diagram of the current environment, the business data processing method further comprises:

The current control strategy information of the network micro-segment is obtained, and the service connection is displayed in a differentiated manner according to the current control strategy information.
The business data processing method according to claim 6, wherein after the step of connecting the business load nodes through business lines according to the association relationship, and constructing and outputting a visualized business flow topology diagram of the current environment, the method comprises:

In response to a selection instruction for a service line on the visualized service flow topology diagram, internal service flow table data corresponding to the service line is displayed.
A business data processing device, wherein the business data processing device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the business data processing method as described in any one of claims 1 to 8.
A computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the business data processing method according to any one of claims 1 to 8 are implemented.