Firewall configuration method, NFVO, server and storage medium

Abstract

The embodiment of the invention provides a firewall configuration method, an NFVO, a server and a storage medium, and belongs to the field of communication. The method comprises the following steps: acquiring a cluster creation request, wherein the cluster creation request comprises network information of a control node of a to-be-created target cluster; creating and configuring a first virtual firewall between the control node and a network function virtualization orchestrator according to the network information of the control node; creating a control node, and creating one or more working nodes under the condition that the control node is created and enters a working state; and creating and configuring a second virtual firewall between the control node and the working nodes according to the created network information of each working node and the network information of the control node. According to the method, the network isolation between the control node and the working node can be automatically, quickly and accurately realized.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a firewall configuration method, NFVO, a server and a storage medium. Background Art

[0002] In order to ensure the security and reliability of telecommunications services, when deploying a cluster for carrying telecommunications services, it is necessary to isolate the control node (Master node) and the working node (Node node) of the cluster. However, to achieve network isolation between the control node and the working node of the cluster, it is necessary to configure the firewall first, and then create the cluster. However, the network information of the working node can only be obtained after the creation is completed. When configuring the firewall, since the network information of the working node is unknown, this will cause the control node and the working node to be unable to communicate.

[0003] To solve the above problems, currently, in the early stage of creating a cluster, when configuring the firewall, the firewall is configured to be fully open so that the control node and the working node can communicate. After the working node is created, the firewall configuration is modified to be partially open, thereby achieving network isolation between the control node and the working node. However, opening the firewall completely has certain security risks, and it is necessary to modify the firewall configuration multiple times, which is cumbersome and prone to errors. Therefore, how to accurately and quickly achieve network isolation between the control node and the working node is a problem that needs to be solved urgently. Summary of the invention

[0004] The embodiments of the present invention provide a firewall configuration method, NFVO, server and storage medium, aiming to accurately and quickly achieve network isolation between control nodes and working nodes.

[0005] In a first aspect, an embodiment of the present invention provides a firewall configuration method, including:

[0006] Obtaining a cluster creation request, wherein the cluster creation request includes network information of a control node of a target cluster to be created;

[0007] Creating and configuring a first virtual firewall between the control node and a network function virtualization orchestrator NFVO according to the network information of the control node;

[0008] Creating the control node, and when the control node is created and enters a working state, creating one or more working nodes;

[0009] According to the created network information of each of the working nodes and the network information of the control node, a second virtual firewall between the control node and the working nodes is created and configured.

[0010] In a second aspect, an embodiment of the present invention further provides a network function virtualization orchestrator NFVO, including:

[0011] An acquisition module is configured to acquire a cluster creation request, wherein the cluster creation request includes network information of a control node of a target cluster to be created;

[0012] a firewall configuration module, configured to create and configure a first virtual firewall between the control node and the NFVO according to the network information of the control node;

[0013] A node creation module is configured to create the control node, and when the control node is created and enters a working state, create one or more working nodes;

[0014] The firewall configuration module is further configured to create and configure a second virtual firewall between the control node and the working nodes according to the created network information of each working node and the network information of the control node.

[0015] In a third aspect, an embodiment of the present invention further provides a server, comprising a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein when the computer program is executed by the processor, the firewall configuration method as described in the first aspect is implemented.

[0016] In a fourth aspect, an embodiment of the present invention further provides a storage medium for computer-readable storage, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the firewall configuration method as described in the first aspect.

[0017] An embodiment of the present invention provides a firewall configuration method, NFVO, server and storage medium. The method creates and configures a first virtual firewall between a control node and the NFVO according to network information of the control node carried in the cluster creation request when a cluster creation request is obtained, then creates the control node of the cluster, and when the control node is created and enters a working state, creates one or more working nodes of the cluster, and finally creates and configures a second virtual firewall between the control node and the working node according to the network information of each created working node and the network information of the control node. In this way, there is no need to open all firewalls or modify the firewall configuration multiple times, and the network isolation between the control node and the working node can be automatically, quickly and accurately achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0019] Figure 1 is a schematic block diagram of the structure of a server provided by an embodiment of the present invention;

[0020] Figure 2 It is a flowchart of a firewall configuration method provided by an embodiment of the present invention;

[0021] Figure 3 is a schematic diagram of a deployment scenario of a control node and a working node in an embodiment of the present invention;

[0022] Figure 4 is a connection diagram of a control node, a working node and a virtual firewall in an embodiment of the present invention;

[0023] Figure 5 yes Figure 2 A flowchart of sub-steps of the firewall configuration method in FIG.

[0024] Figure 6 is another connection diagram of the control node, the working node and the virtual firewall in an embodiment of the present invention;

[0025] Figure 7 It is a flowchart of another firewall configuration method provided by an embodiment of the present invention;

[0026] Figure 8 is another connection diagram of the control node, the working node and the virtual firewall in an embodiment of the present invention;

[0027] Fig. 9 It is a schematic block diagram of the structure of a network function virtualization orchestrator provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0030] It should be understood that the terms used in this specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0031] At present, in the early stage of creating a cluster, when configuring the firewall, the firewall is configured to be fully open so that the control node and the working node can communicate. After the working node is created, the firewall configuration is modified to be partially open, so as to achieve network isolation between the control node and the working node. However, opening the firewall completely has certain security risks, and it is necessary to modify the firewall configuration multiple times, which is cumbersome and error-prone.

[0032] To solve the above problems, the embodiments of the present invention provide a firewall configuration method, a server, a network function virtualization orchestrator (NFVO) and a storage medium. The method creates and configures a first virtual firewall between the control node and the NFVO according to the network information of the control node carried in the cluster creation request when a cluster creation request is obtained, then creates the control node of the cluster, and when the control node is created and enters the working state, creates one or more working nodes of the cluster, and finally creates and configures the second virtual firewall between the control node and the working node according to the network information of each created working node and the network information of the control node, so that the firewall does not need to be fully opened, and the firewall configuration does not need to be modified multiple times, and the network isolation between the control node and the working node can be automatically, quickly and accurately achieved. In the embodiment of the present invention, the server can be a single server or a server cluster composed of multiple servers, and the embodiment of the present invention does not specifically limit this.

[0033] Some embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0034] See also Figure 1 , Figure 1 The present invention is a schematic structural block diagram of a server provided by an embodiment of the present invention.

[0035] like Figure 1As shown, the server 100 includes a processor 101 and a memory 102 , and the processor 101 and the memory 102 are connected via a bus 103 , such as an I2C (Inter-integrated Circuit) bus.

[0036] Specifically, the processor 101 is used to provide computing and control capabilities to support the operation of the entire server. The processor 101 can be a central processing unit (CPU), and the processor 101 can also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0037] Specifically, the memory 102 may be a Flash chip, a read-only memory (ROM) disk, an optical disk, a USB flash drive, or a mobile hard disk.

[0038] Those skilled in the art will understand that Figure 1 The structure shown in the figure is only a block diagram of a partial structure related to the embodiment of the present invention, and does not constitute a limitation on the server to which the embodiment of the present invention is applied. The specific server may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0039] Among them, the processor 101 is used to run the computer program stored in the memory 102, and implement any one of the network slicing resource configuration methods provided by the embodiments of the present invention when executing the computer program.

[0040] In some embodiments, the processor 101 is used to run a computer program stored in the memory, and implements the following steps when executing the computer program:

[0041] Obtaining a cluster creation request, wherein the cluster creation request includes network information of a control node of a target cluster to be created;

[0042] Creating and configuring a first virtual firewall between the control node and a network function virtualization orchestrator NFVO according to the network information of the control node;

[0043] Creating the control node, and when the control node is created and enters a working state, creating one or more working nodes;

[0044] According to the created network information of each of the working nodes and the network information of the control node, a second virtual firewall between the control node and the working nodes is created and configured.

[0045] In some embodiments, when the processor 101 creates and configures the second virtual firewall between the control node and the working node according to the network information of each of the working nodes and the network information of the control node that have been created, it is used to implement:

[0046] According to the network information of each of the created working nodes and the node grouping rule carried in the cluster creation request, each of the created working nodes is divided into a plurality of working node groups;

[0047] A second virtual firewall between the control node and each of the working node groups is created and configured according to the network information of each working node in each of the working node groups and the network information of the control node.

[0048] In some embodiments, the second virtual firewall between the control node and different working node groups is different, and the second virtual firewall between the control node and each working node in the working node group is the same.

[0049] In some embodiments, after the processor 101 creates and configures the second virtual firewall between the control node and the working node according to the network information of each of the working nodes and the network information of the control node that have been created, it is further configured to implement:

[0050] Obtaining status information of each of the working nodes;

[0051] When it is determined according to the status information that the current status of each of the working nodes is in a working status, a network topology diagram of the target cluster is displayed in a cluster management page of the NFVO.

[0052] In some embodiments, the processor 101 is further configured to implement:

[0053] When a cluster expansion request of the target cluster is obtained, one or more new working nodes are created according to the cluster expansion information carried in the cluster expansion request;

[0054] The access rules of the second virtual firewall are updated according to the network information of each of the newly created working nodes.

[0055] In some embodiments, after the processor 101 creates and configures the second virtual firewall between the control node and the working node according to the network information of each of the working nodes and the network information of the control node that have been created, it is further configured to implement:

[0056] When a cluster shrinking request is obtained, cluster shrinking information carried in the cluster shrinking request is sent to the control node, so that the control node removes the corresponding working node from the target cluster according to the cluster shrinking information;

[0057] According to the cluster shrinkage information, the access rule corresponding to the removed working node is deleted from the second virtual firewall.

[0058] In some embodiments, after the processor 101 creates and configures the second virtual firewall between the control node and the working node according to the network information of each of the working nodes and the network information of the control node that have been created, it is further configured to implement:

[0059] When a cluster termination request of the target cluster is obtained, sending the cluster termination request to the control node, so that the control node deletes all working nodes in the target cluster according to the cluster termination request;

[0060] When it is determined that all working nodes in the target cluster have been deleted, deleting the control node of the target cluster;

[0061] In a case where the control node has been deleted, the access rule corresponding to the control node is deleted from the first virtual firewall.

[0062] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the server described above can refer to the corresponding process in the aforementioned firewall configuration method embodiment, and will not be repeated here.

[0063] The following will be combined Figure 1 The scenario in the embodiment of the present invention provides a detailed introduction to the firewall configuration method provided by the embodiment of the present invention. It should be noted that Figure 1 The scenarios are only used to explain the firewall configuration method provided in the embodiment of the present invention, but do not constitute a limitation on the application scenarios of the firewall configuration method provided in the embodiment of the present invention.

[0064] See also Figure 2 , Figure 2 The present invention provides a flowchart of a firewall configuration method provided by an embodiment of the present invention. The firewall configuration method can be applied to a server or NFVO to accurately and quickly implement network isolation between a control node and a working node.

[0065] like Figure 2 As shown, the firewall configuration method includes steps S101 to S104.

[0066] Step S101: Obtain a cluster creation request, where the cluster creation request includes network information of a control node of a target cluster to be created.

[0067] In this embodiment, the target cluster is a cluster to be created, and the target cluster may include a control node and one or more working nodes. The cluster creation request includes network information of the control node of the target cluster to be created, and the network information of the control node includes but is not limited to the IP address and port of the control node. In other embodiments, the cluster creation request also includes resource specification information of the control node, and the resource specification information is used to describe the computing resources required by the control node.

[0068] In some embodiments, the user terminal displays a cluster management page, which includes a cluster creation option; the user terminal displays a cluster creation page in response to a user triggering operation on the cluster creation option, and the cluster creation page includes a confirmation button; the cluster creation information entered or uploaded by the user on the cluster creation page is obtained, and in response to the user triggering operation on the confirmation button, a cluster creation request is generated according to the cluster creation information, and the cluster creation information is sent to the server; the server receives the cluster creation request sent by the user terminal. The cluster creation information includes network information of the control node of the target cluster to be created, and the triggering operation includes a click operation, a double-click operation, or a long press operation. In other embodiments, the cluster creation information also includes a resource specification of the control node, and the resource specification is used to describe the resource size of the control node.

[0069] In some embodiments, the server controls the display device to display a cluster management page, which includes a cluster creation option; the server responds to the user's trigger operation on the cluster creation option, displays a cluster creation page, which includes a confirmation button; obtains cluster creation information input or uploaded by the user on the cluster creation page, and generates a cluster creation request according to the cluster creation information in response to the user's trigger operation on the confirmation button. The display device can be a display screen integrated with the server, or an external display connected to the server in communication, which is not specifically limited in the embodiments of the present invention.

[0070] Step S102: Create and configure a first virtual firewall between the control node and the network function virtualization orchestrator according to the network information of the control node.

[0071] In this embodiment, a physical device can be logically divided into multiple virtual firewalls, where the virtual firewall is software or service running in a virtualized environment. The physical device can be a server or an electronic device.

[0072] In some embodiments, the server generates a first firewall creation request based on the network information of the NFVO and the network information of the control node, and sends the first firewall creation request to the hardware firewall; when the hardware firewall receives the first firewall creation request, it obtains the network information of the control node and the network information of the NFVO from the first firewall creation request; the hardware firewall creates a first virtual firewall based on the network information of the control node and the network information of the NFVO, and configures access rules between the control node and the NFVO on the first virtual firewall to enable communication between the control node and the NFVO.

[0073] In some embodiments, before executing step S102, it is determined whether the cluster creation request carries firewall sharing information and firewall sharing information; if the cluster creation request does not carry firewall sharing information, a first virtual firewall between the control node and the NFVO is created and configured according to the network information of the control node and the network information of the NFVO; if the cluster creation request carries firewall sharing information, a target virtual firewall is determined according to the firewall identifier in the firewall sharing information, and access rules between the control node and the NFVO are configured on the target virtual firewall according to the network information of the control node and the network information of the NFVO, so that the control node and the NFVO can communicate. In this embodiment, when a shared firewall is used, there is no need to create a new virtual firewall, and only the access rules between the control node and the NFVO are configured on the corresponding firewall, so that the control node and the NFVO can communicate, thereby saving computing resources.

[0074] In some embodiments, when the cluster creation request carries firewall sharing information, a first firewall creation request is generated according to the network information of the NFVO, the network information of the control node and the firewall sharing information, and the first firewall creation request is sent to the hardware firewall; when the hardware firewall receives the first firewall creation request, it obtains the firewall sharing information, the network information of the control node and the network information of the NFVO from the first firewall creation request; the hardware firewall determines the target virtual firewall according to the firewall identifier in the firewall sharing information, and configures the access rules between the control node and the NFVO on the target virtual firewall according to the network information of the control node and the network information of the NFVO, so as to enable communication between the control node and the NFVO.

[0075] Step S103: Create a control node, and when the control node is created and enters a working state, create one or more working nodes.

[0076] In this embodiment, during the process of creating a control node, the state of the control node is queried at a preset time interval until the control node is created and enters a working state. When the control node is created and enters a working state, one or more working nodes are created. The control node and the working node are deployed on different devices.

[0077] In some embodiments, the cluster creation request also includes resource specification information of the control node, and the method of creating the control node may be: creating the control node according to the resource specification information and network information of the control node. Exemplarily, creating a first virtual machine according to the resource specification information of the control node; after the first virtual machine is created, updating the network information of the first virtual machine to the network information of the control node, and initializing the control node for the first virtual machine, so that the first virtual machine is initialized as the control node. The resource specification information of the control node is used to describe the computing resources required to create the control node.

[0078] In some embodiments, the control node may be created according to the resource specification information and network information of the control node: the server may create the control node in the local machine according to the resource specification information and network information of the control node. Alternatively, the server may generate a control node creation instruction according to the resource specification information and network information of the control node, and send the control node creation instruction to a computer device that is connected to the server in communication; upon receiving the control node creation instruction, the computer device may create the control node according to the resource specification information and network information carried in the control node creation instruction.

[0079] In some embodiments, the cluster creation request also includes a first number of work nodes to be created and resource specification information of each work node, and the method of creating one or more work nodes may be: creating a first number of work nodes according to the resource specification information of each work node. The resource specification information of the work node is used to describe the computing resources required to create the work node, and the computing resources required to create each work node may be the same or different, and the embodiment of the present invention does not specifically limit this.

[0080] For example, if the first quantity is 3, and the computing resources required to create each working node are x, then 3 working nodes can be created, namely working node A1, working node A2, and working node A3, and the computing resources of working node A1, working node A2, and working node A3 are all x. For another example, if the first quantity is 3, and the computing resources required to create each working node are x1, x2, and x3, then 3 working nodes can be created, namely working node A1, working node A2, and working node A3, and the computing resources of working node A1, working node A2, and working node A3 are x1, x2, and x3, respectively.

[0081] Exemplarily, for each working node, a second virtual machine is created according to the resource specification information of the working node; after the second virtual machine is created, network information is allocated to the second virtual machine, and the second virtual machine is initialized as a working node, so that the second virtual machine is initialized as a working node.

[0082] For example, the first quantity is 3, and the computing resources required to create each working node are x1, x2 and x3 respectively, then the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3 can be created, and the computing resources of the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3 are x1, x2 and x3 respectively, and network information is allocated to the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3. For example, the network information of the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3 is w1, w2 and w3 respectively, and the working nodes of the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3 are initialized, so that the working nodes A1, the working nodes A2 and the working nodes A3 can be obtained.

[0083] In some embodiments, the cluster creation request also includes a first number of working nodes to be created and resource specification information and network information of each working node. The method of creating one or more working nodes can be: creating a first number of working nodes based on the resource specification information and network information of each working node.

[0084] Exemplarily, for each working node, a second virtual machine is created based on the resource specification information of the working node; after the second virtual machine is created, the network information of the second virtual machine is updated to the network information of the working node, and the second virtual machine is initialized as the working node, so that the second virtual machine is initialized as the working node.

[0085] For example, the first quantity is 3, and the computing resources required to create these 3 working nodes are x1, x2 and x3 respectively, and the network information of these 3 working nodes is w1, w2 and w3 respectively, then the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3 can be created, and the computing resources of the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3 are x1, x2 and x3 respectively, and the network information of the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3 is updated to w1, w2 and w3 respectively, and then the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3 are initialized as working nodes, so that working nodes A1, working node A2 and working node A3 can be obtained.

[0086] In some embodiments, the method of creating the first number of working nodes according to the resource specification information of each working node can be: the server creates the first number of control nodes in the local machine according to the resource specification information of each working node. Alternatively, the server generates a working node creation instruction according to the first number and the resource specification information of each working node, and sends the working node creation instruction to a computer device that is communicatively connected to the server; when the computer device receives the working node creation instruction, it creates one or more working nodes according to the first number in the working node creation instruction and the resource specification information of each working node.

[0087] In some embodiments, the control node and the working node are located on different servers. Figure 3 As shown, the server 100 is deployed with NFVO, a control node of the target cluster is created in the server 100, and all working nodes of the target cluster are created in the first computer device 21. Alternatively, a control node of the target cluster is created in the server 100, some working nodes of the target cluster are created in the first computer device 21, and another part of working nodes of the target cluster are created in the second computer device 22. Alternatively, all working nodes of the target cluster are created in the server 100, and a control node of the target cluster is created in the first computer device 21 or the second computer device 22. Alternatively, some working nodes of the target cluster are created in the server 100, another part of working nodes of the target cluster are created in the first computer device 21, and a control node of the target cluster is created in the first computer device 21. Alternatively, all working nodes of the target cluster are created in the first computer device 21, and a control node of the target cluster is created in the second computer device 22.

[0088] Step S104: Create and configure a second virtual firewall between the control node and the working nodes according to the created network information of each working node and the network information of the control node.

[0089] In this embodiment, after the work node is created, the control node in the target cluster can obtain the network information of each work node that has been created, and the control node sends the network information of each work node that has been created to the server running NFVO. The server creates and configures the second virtual firewall between the control node and the work node based on the network information of each work node that has been created and the network information of the control node. After the second virtual firewall is created and configured, the control node and each work node can communicate, so that the control node and each work node form a target cluster.

[0090] For example, Figure 4 As shown, a first virtual firewall 12 is deployed between the network function virtualization orchestrator 200 and the control node 13, and network isolation between the network function virtualization orchestrator 200 and the control node 13 can be achieved through the first virtual firewall 12. A second virtual firewall 14 is deployed between the control node 13 and the first working node 15 and the second working node 16, and network isolation between the control node 13 and the first working node 15 and the second working node 16 can be achieved through the second virtual firewall 14.

[0091] In some embodiments, based on the network information of each working node that has been created and the network information of the control node, the method for creating and configuring the second virtual firewall between the control node and the working node can be: based on the network information of each working node that has been created and the network information of the control node, a second firewall creation request is generated, and the second firewall creation request is sent to the hardware firewall; the hardware firewall creates a second virtual firewall based on the network information of each working node that has been created and the network information of the control node, and configures access rules between the control node and each working node on the second virtual firewall to enable the control node and each working node to communicate.

[0092] In some embodiments, Figure 5 As shown, step S104 includes sub-steps S1041 and S1042.

[0093] Sub-step S1041: Divide each created working node into a plurality of working node groups according to the network information of each created working node and the node grouping rule carried in the cluster creation request.

[0094] In this embodiment, each working node group may include one or more working nodes, and the node grouping rule carried by the cluster creation request may be set by the user based on actual conditions, and the embodiment of the present invention does not specifically limit this. For example, the node grouping rule may be a rule for grouping according to the IP address segment of the working node, or a rule for grouping according to the region to which the IP address of the working node belongs, or a rule for grouping according to the server to which the IP address of the working node belongs.

[0095] For example, the created working nodes include working nodes C1, working nodes C2, working nodes C3, working nodes C4 and working nodes C5, and the IP addresses of working nodes C1, working nodes C2 and working nodes C3 are all located in the preset first IP address segment, while working nodes C4 and working nodes C5 are all located in the preset second IP address segment, so working nodes C1, working nodes C2 and working nodes C3 can be divided into one working node group, and working nodes C4 and working nodes C5 can be divided into another working node group. For another example, the servers to which the IP addresses of working nodes C1 and working nodes C2 belong are all server A, and the servers to which the IP addresses of working nodes C3, working nodes C4 and working nodes C5 belong are all server B, so working nodes C1 and working nodes C2 can be divided into one working node group, and working nodes C3, working nodes C4 and working nodes C5 can be divided into another working node group.

[0096] Sub-step S1042: Create and configure a second virtual firewall between the control node and each working node group according to the network information of each working node in each working node group and the network information of the control node.

[0097] In this embodiment, the second virtual firewalls between the control node and different working node groups are different, the second virtual firewalls between the control node and each working node in the working node group are the same, the second virtual firewalls between the control node and different working node groups are different, and one working node group corresponds to one second virtual firewall. Figure 6 As shown, a second virtual firewall A is deployed between the control node 13 and the first working node group 31, and a second virtual firewall B is deployed between the control node 13 and the second working node group 32. The first working node group 31 includes the first working node 15 and the second working node 16. The second virtual firewall A is used to achieve network isolation between the control node 13 and the first working node 15 and the second working node 16. The second working node group 32 includes the third working node 17 and the fourth working node 18. The second virtual firewall B is used to achieve network isolation between the control node 13 and the third working node 17 and the fourth working node 18.

[0098] In some embodiments, the method for creating and configuring a second virtual firewall between the control node and each working node group based on the network information of each working node in each working node group and the network information of the control node can be: for each working node group, a third firewall creation request is generated based on the network information of each working node in the working node group and the network information of the control node, and the third firewall creation request is sent to the hardware firewall; when the hardware firewall receives the third firewall creation request, the second virtual firewall is created between the control node and each working node in the working node group based on the network information of each working node in the third firewall creation request and the network information of the control node, and access rules between the control node and each working node in the working node group are configured on the second virtual firewall.

[0099] In some embodiments, after step S104, it further includes: obtaining the status information of each working node; when it is determined according to the status information that the current status of each working node is in a working state, displaying the network topology of the target cluster in the cluster management page of NFVO. Among them, the control node can obtain the status information of each working node, and then the control node sends the status information of each working node to the server deployed with NFVO. When the server obtains the status information of each working node, it can determine the current status of each working node according to the status information, so that when the current status of each working node is in a working state, the network topology of the target cluster is displayed in the cluster management page of NFVO. This embodiment displays the network topology of the target cluster in the cluster management page after completing the creation of the control node, the working node, and the virtual firewall between the control node and the working node, so that the user can know that the target cluster has been created, thereby improving the user experience.

[0100] In some embodiments, Figure 7 As shown, after step S104, steps S105 to S106 are also included.

[0101] Step S105: when a cluster expansion request of the target cluster is obtained, one or more new working nodes are created according to the cluster expansion information carried in the cluster expansion request.

[0102] In this embodiment, the cluster expansion information carried by the cluster expansion request includes the number of nodes to be expanded and the resource specification information of each working node. The number of nodes to be expanded and the resource specification information of each working node can be configured by the user according to actual conditions, and the embodiment of the present invention does not specifically limit this.

[0103] In some embodiments, the user terminal displays a cluster management page, which includes a cluster creation option and a cluster expansion option; in response to a user triggering operation on the cluster expansion option, a cluster expansion page is displayed, which includes a first input box for a cluster identifier and a second input box for cluster expansion information; the cluster identifier and cluster expansion information selected or input by the user are obtained, and the cluster identifier selected or input by the user is displayed in the first input box, and the cluster expansion information selected or input by the user is displayed in the second input box; in response to the user triggering operation on a confirmation button in the cluster expansion page, a cluster expansion request is generated according to the cluster identifier displayed in the first input box and the cluster expansion information displayed in the second input box, and the cluster expansion request is sent to the server; when the server receives the cluster expansion request, if the cluster identifier carried by the cluster expansion request is the cluster identifier of the target cluster, it is determined that the server has obtained the cluster expansion request of the target cluster.

[0104] In some embodiments, the server controls a display device to display a cluster management page, which includes a cluster creation option and a cluster expansion option; in response to a user triggering operation on the cluster expansion option, a cluster expansion page is displayed, which includes a first input box for a cluster identifier and a second input box for cluster expansion information; the cluster identifier and cluster expansion information selected or input by the user are obtained, and the cluster identifier selected or input by the user is displayed in the first input box, and the cluster expansion information selected or input by the user is displayed in the second input box; in response to a user triggering operation on a confirmation button in the cluster expansion page, a cluster expansion request is generated according to the cluster identifier displayed in the first input box and the cluster expansion information displayed in the second input box; if the cluster identifier carried by the cluster expansion request is the cluster identifier of the target cluster, it is determined that the server has obtained the cluster expansion request of the target cluster.

[0105] In some embodiments, the cluster expansion information includes the number of nodes that need to be expanded and the resource specification information of the newly created nodes. According to the cluster expansion information carried by the cluster expansion request, the method of creating one or more new working nodes can be: according to the resource specification information of each newly created node, create a new working node of the same number of nodes. Among them, the resource specification information of the newly created nodes is used to describe the computing resources required for the newly created working nodes. The computing resources required for each newly created working node can be the same or different, and the embodiment of the present invention does not specifically limit this.

[0106] For example, if there are two working nodes that need to be expanded, and the computing resources required for the two new working nodes are x4, then two new working nodes can be created, and the two new working nodes are working nodes A4 and A5, and the computing resources of working nodes A4 and A5 are x5. For another example, if the computing resources required for the two new working nodes are x5 and x6, then two new working nodes can be created, and the two new working nodes are working nodes A4 and A5, and the computing resources of working nodes A4 and A5 are x5 and x6.

[0107] Step S106: Update the access rules of the second virtual firewall according to the network information of each newly created working node.

[0108] In this embodiment, after each new working node is created, the access rules of the second virtual firewall corresponding to the firewall identifier in the cluster expansion request can be updated according to the network information of each new working node that has been created. Optionally, the network information of each new working node that has been created can be added to the access list of the second virtual firewall corresponding to the firewall identifier in the cluster expansion request, so that each new working node that has been created and the control node can access each other through the second virtual firewall.

[0109] For example, Figure 4 As shown, the target cluster includes the first working node 15 and the second working node 16 before expansion. After the target cluster is expanded with two new working nodes, the access rules of the second virtual firewall 14 can be updated according to the network information of the two new working nodes. Figure 8 As shown, the expanded target cluster includes a first working node 15, a second working node 16, a fifth working node 33 and a sixth working node 34, and the fifth working node 33 and the sixth working node 34 are network isolated from the control node 13 through the second virtual firewall 14.

[0110] In some embodiments, the server generates an anti-access rule addition request based on the network information of each new working node created and the firewall identifier in the cluster expansion request, and sends the anti-access rule addition request to the hardware firewall; when the hardware firewall receives the anti-access rule addition request, it determines the second virtual firewall that needs to add access rules based on the firewall identifier in the anti-access rule addition request, and adds corresponding access rules to the second virtual firewall that needs to add access rules based on the network information of each new working node in the anti-access rule addition request.

[0111] In some embodiments, when the cluster expansion request does not carry a firewall identifier, a second virtual firewall is created and configured between the control node corresponding to the cluster identifier and each new working node according to the network information of each newly created working node and the network information of the control node corresponding to the cluster identifier. For example, before the cluster is expanded, it includes a control node M, a working node D1, and a working node D2, and a second virtual firewall C is deployed between the control node M and the working nodes D1 and D2. When the target cluster is expanded, the user does not select or input a firewall identifier, which means that the new working node does not share the virtual firewall with the created working node. After the target cluster is expanded, a second virtual firewall D is deployed between the control node M and the new working node D3 and the working node D4. In this way, the network isolation between the control node M and the working nodes D1 and D2 is achieved through the second virtual firewall C, and the network isolation between the control node M and the working nodes D3 and D4 is achieved through the second virtual firewall D.

[0112] In some embodiments, when a cluster shrinking request is obtained, the cluster shrinking information carried in the cluster shrinking request is sent to the control node, so that the control node removes the corresponding working node from the target cluster according to the cluster shrinking information; according to the cluster shrinking information, the access rules corresponding to the removed working node are deleted from the second virtual firewall. The cluster shrinking information includes the node identification and network information of the working node to be removed. For example, before the current cluster shrinks, it includes the control node M, the working node D1, the working node D2, the working node D3 and the working node D4, and the cluster shrinking information includes the node identification and network information of the working node D2 and the working node D3. Then, the working node D2 and the working node D3 can be removed from the current cluster, and the access rules corresponding to the working node D2 can be deleted from the second virtual firewall C, and the access rules corresponding to the working node D3 can be deleted from the second virtual firewall D, thereby completing the shrinking of the target cluster.

[0113] In some embodiments, the method for deleting the access rules corresponding to the removed working nodes from the second virtual firewall according to the cluster scaling-down information can be: the server generates an access rule deletion request according to the cluster identifier and cluster scaling-down information carried in the cluster scaling-down request, and sends the access rule deletion request to the hardware firewall; when the hardware firewall receives the access rule deletion request, it determines the second virtual firewall whose access rules need to be deleted according to the cluster identifier in the access rule deletion request, and deletes the access rules corresponding to the node identifier in the cluster scaling-down information from the second virtual firewall whose access rules need to be deleted.

[0114] In some embodiments, when all the access prevention rules of the second virtual firewall are deleted, the second virtual firewall is deleted. For example, before the current cluster is reduced in capacity, it includes control node M, working node D1, working node D2, working node D3 and working node D4, a second virtual firewall C is deployed between control node M and working node D1 and working node D2, a second virtual firewall D is deployed between control node M and new working node D3 and working node D4, and the cluster reduction information includes the node identification and network information of working node D1 and working node D2. Then, working node D1 and working node D2 can be removed from the current cluster, and the access rules corresponding to working node D1 and working node D2 can be deleted from the second virtual firewall C. Since all the access prevention rules of the second virtual firewall C are deleted, the second virtual firewall C can be deleted.

[0115] In some embodiments, the user terminal displays a cluster management page, which includes a cluster creation option, a cluster expansion option, and a cluster reduction option; in response to a user triggering operation on the cluster reduction option, a cluster reduction page is displayed, which includes a third input box for a cluster identifier and a fourth input box for cluster reduction information; the cluster identifier and cluster reduction information selected or input by the user are obtained, and the cluster identifier selected or input by the user is displayed in the third input box and the cluster reduction information selected or input by the user is displayed in the fourth input box; in response to a user triggering operation on a confirmation button in the cluster reduction page, a cluster reduction request is generated according to the cluster identifier displayed in the third input box and the cluster reduction information displayed in the fourth input box, and the cluster reduction request is sent to the server; when the server receives the cluster reduction request, if the cluster identifier carried by the cluster reduction request is the cluster identifier of the target cluster, it is determined that the server has obtained the cluster reduction request of the target cluster.

[0116] In some embodiments, the server controls the display device to display a cluster management page, which includes a cluster creation option, a cluster expansion option, and a cluster reduction option; in response to a user triggering operation on the cluster reduction option, a cluster reduction page is displayed, which includes a third input box for a cluster identifier and a fourth input box for cluster reduction information; the cluster identifier and cluster reduction information selected or input by the user are obtained, and the cluster identifier selected or input by the user is displayed in the third input box and the cluster reduction information selected or input by the user is displayed in the fourth input box; in response to a user triggering operation on a confirmation button in the cluster reduction page, a cluster reduction request is generated according to the cluster identifier displayed in the third input box and the cluster reduction information displayed in the fourth input box; if the cluster identifier carried by the cluster reduction request is the cluster identifier of the target cluster, it is determined that the server has obtained the cluster reduction request of the target cluster.

[0117] In some embodiments, when all the access control rules of the second virtual firewall are deleted, the server generates a firewall deletion request based on the firewall identifier of the second virtual firewall and sends the firewall deletion request to the hardware firewall; when the hardware firewall receives the firewall deletion request, it deletes the second virtual firewall corresponding to the firewall identifier in the firewall deletion request.

[0118] In some embodiments, when a cluster termination request of a target cluster is obtained, a cluster termination request is sent to a control node, so that the control node deletes all working nodes in the target cluster according to the cluster termination request; when it is determined that all working nodes in the target cluster have been deleted, the control node of the target cluster is deleted; when the control node has been deleted, the access rule corresponding to the control node is deleted from the first virtual firewall. The cluster termination request includes a cluster identifier of the cluster to be terminated, and the cluster to be terminated can be any cluster that has been created.

[0119] In some embodiments, the user terminal displays a cluster management page, which includes a cluster creation option, a cluster expansion option, a cluster reduction option and a cluster termination option; in response to the user's triggering operation on the cluster termination option, a cluster termination page is displayed, which includes a fifth input box for the cluster identifier; the cluster identifier selected or input by the user is obtained, and the cluster identifier selected or input by the user is displayed in the fifth input box; in response to the user's triggering operation on the confirmation button in the cluster termination page, a cluster termination request is generated according to the cluster identifier displayed in the fifth input box, and the cluster termination request is sent to the server; when the server receives the cluster termination request, if the cluster identifier carried by the cluster termination request is the cluster identifier of the target cluster, it is determined that the server has obtained the cluster termination request of the target cluster.

[0120] In some embodiments, the server controls a display device to display a cluster management page, which includes a cluster creation option, a cluster expansion option, a cluster reduction option, and a cluster termination option; in response to a user triggering operation on the cluster termination option, a cluster termination page is displayed, which includes a fifth input box for a cluster identifier; the cluster identifier selected or input by the user is obtained, and the cluster identifier selected or input by the user is displayed in the fifth input box; in response to a user triggering operation on a confirmation button in the cluster termination page, a cluster termination request is generated according to the cluster identifier displayed in the fifth input box; if the cluster identifier carried by the cluster termination request is the cluster identifier of the target cluster, it is determined that the server has obtained the cluster termination request of the target cluster.

[0121] It is understandable that users can also expand, shrink or terminate clusters other than the target cluster. The specific implementation process of expanding, shrinking or terminating clusters other than the target cluster can refer to the specific implementation methods of expanding, shrinking or terminating the target cluster mentioned above, which will not be repeated here. Among them, the server can determine the cluster that needs to be expanded according to the cluster identifier in the cluster expansion request, determine the cluster that needs to be shrunk according to the cluster identifier in the cluster shrink request, and determine the cluster that needs to be terminated according to the cluster identifier in the cluster termination request.

[0122] See also Fig. 9 , Fig. 9 It is a schematic block diagram of the structure of a network function virtualization orchestrator provided by an embodiment of the present invention.

[0123] like Fig. 9 As shown, the network function virtualization orchestrator 200 includes:

[0124] An acquisition module 210 is configured to acquire a cluster creation request, wherein the cluster creation request includes network information of a control node of a target cluster to be created;

[0125] A firewall configuration module 220, configured to create and configure a first virtual firewall between the control node and the NFVO according to the network information of the control node;

[0126] The node creation module 230 is configured to create the control node, and when the control node is created and enters a working state, create one or more working nodes;

[0127] The firewall configuration module 220 is further configured to create and configure a second virtual firewall between the control node and the working node according to the created network information of each working node and the network information of the control node.

[0128] In some embodiments, the firewall configuration module 220 is further configured to:

[0129] According to the network information of each of the created working nodes and the node grouping rule carried in the cluster creation request, each of the created working nodes is divided into a plurality of working node groups;

[0130] A second virtual firewall between the control node and each of the working node groups is created and configured according to the network information of each working node in each of the working node groups and the network information of the control node.

[0131] In some embodiments, the second virtual firewall between the control node and different working node groups is different, and the second virtual firewall between the control node and each working node in the working node group is the same.

[0132] In some embodiments, the network function virtualization orchestrator 200 further includes:

[0133] The acquisition module 210 is further configured to acquire status information of each of the working nodes;

[0134] The display module is used to display the network topology diagram of the target cluster in the cluster management page of the NFVO when it is determined according to the status information that the current status of each of the working nodes is in a working status.

[0135] In some embodiments, the network function virtualization orchestrator 200 further includes a cluster expansion module configured to:

[0136] When a cluster expansion request of the target cluster is obtained, one or more new working nodes are created according to the cluster expansion information carried in the cluster expansion request;

[0137] The access rules of the second virtual firewall are updated according to the network information of each of the newly created working nodes.

[0138] In some embodiments, the network function virtualization orchestrator 200 further includes a cluster scaling module configured to:

[0139] When a cluster shrinking request is obtained, cluster shrinking information carried in the cluster shrinking request is sent to the control node, so that the control node removes the corresponding working node from the target cluster according to the cluster shrinking information;

[0140] According to the cluster shrinkage information, the access rule corresponding to the removed working node is deleted from the second virtual firewall.

[0141] In some embodiments, the network function virtualization orchestrator 200 further includes a cluster termination module configured to:

[0142] When a cluster termination request of the target cluster is obtained, sending the cluster termination request to the control node, so that the control node deletes all working nodes in the target cluster according to the cluster termination request;

[0143] When it is determined that all working nodes in the target cluster have been deleted, deleting the control node of the target cluster;

[0144] In a case where the control node has been deleted, the access rule corresponding to the control node is deleted from the first virtual firewall.

[0145] It should be noted that technical personnel in the relevant field can clearly understand that for the convenience and conciseness of description, the specific working process of the network function virtualization orchestrator described above can refer to the corresponding process in the aforementioned firewall configuration method embodiment, and will not be repeated here.

[0146] An embodiment of the present invention further provides a storage medium for computer-readable storage, wherein the storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement any firewall configuration method provided in the description of the embodiment of the present invention.

[0147] The storage medium may be an internal storage unit of the server described in the foregoing embodiment, such as a hard disk or memory of the server. The storage medium may also be an external storage device of the server, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc., equipped on the server.

[0148] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware embodiment, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0149] It should be understood that the term "and / or" used in the present specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, including these combinations. It should be noted that, in this article, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "including a..." does not exclude the presence of other identical elements in the process, method, article or system including the element.

[0150] The serial numbers of the embodiments of the present invention are only for description and do not represent the advantages and disadvantages of the embodiments. The above description is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed by the present invention, and these modifications or replacements should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A firewall configuration method, characterized in that: include: Obtaining a cluster creation request, wherein the cluster creation request includes network information of a control node of a target cluster to be created; Creating and configuring a first virtual firewall between the control node and a network function virtualization orchestrator NFVO according to the network information of the control node; Creating the control node, and when the control node is created and enters a working state, creating one or more working nodes; According to the created network information of each of the working nodes and the network information of the control node, a second virtual firewall between the control node and the working nodes is created and configured.

2. The firewall configuration method according to claim 1, characterized in that: The creating and configuring a second virtual firewall between the control node and the working node according to the created network information of each working node and the network information of the control node includes: According to the network information of each of the created working nodes and the node grouping rule carried in the cluster creation request, each of the created working nodes is divided into a plurality of working node groups; A second virtual firewall between the control node and each of the working node groups is created and configured according to the network information of each working node in each of the working node groups and the network information of the control node.

3. The firewall configuration method according to claim 2, characterized in that: The second virtual firewalls between the control node and different working node groups are different, and the second virtual firewalls between the control node and each working node in the working node group are the same.

4. The firewall configuration method according to claim 1, characterized in that: After creating and configuring the second virtual firewall between the control node and the working node according to the created network information of each working node and the network information of the control node, the method further includes: Obtaining status information of each of the working nodes; When it is determined according to the status information that the current status of each of the working nodes is in a working status, a network topology diagram of the target cluster is displayed in a cluster management page of the NFVO.

5. The firewall configuration method according to claim 1, characterized in that: The method further comprises: When a cluster expansion request of the target cluster is obtained, one or more new working nodes are created according to the cluster expansion information carried in the cluster expansion request; The access rules of the second virtual firewall are updated according to the network information of each of the newly created working nodes.

6. The firewall configuration method according to any one of claims 1 to 5, characterized in that: After creating and configuring the second virtual firewall between the control node and the working node according to the created network information of each working node and the network information of the control node, the method further includes: When a cluster shrinking request is obtained, cluster shrinking information carried in the cluster shrinking request is sent to the control node, so that the control node removes the corresponding working node from the target cluster according to the cluster shrinking information; According to the cluster shrinkage information, the access rule corresponding to the removed working node is deleted from the second virtual firewall.

7. The firewall configuration method according to any one of claims 1 to 5, characterized in that: After creating and configuring the second virtual firewall between the control node and the working node according to the created network information of each working node and the network information of the control node, the method further includes: When a cluster termination request of the target cluster is obtained, sending the cluster termination request to the control node, so that the control node deletes all working nodes in the target cluster according to the cluster termination request; When it is determined that all working nodes in the target cluster have been deleted, deleting the control node of the target cluster; In a case where the control node has been deleted, the access rule corresponding to the control node is deleted from the first virtual firewall.

8. A network function virtualization orchestrator NFVO, characterized in that: include: An acquisition module is configured to acquire a cluster creation request, wherein the cluster creation request includes network information of a control node of a target cluster to be created; a firewall configuration module, configured to create and configure a first virtual firewall between the control node and the NFVO according to the network information of the control node; A node creation module is configured to create the control node, and when the control node is created and enters a working state, create one or more working nodes; The firewall configuration module is further configured to create and configure a second virtual firewall between the control node and the working nodes according to the created network information of each working node and the network information of the control node.

9. A server, characterized in that: The server includes a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for realizing connection communication between the processor and the memory, wherein when the computer program is executed by the processor, the steps of the firewall configuration method according to any one of claims 1 to 7 are implemented.

10. A storage medium for computer-readable storage, characterized in that: The storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the steps of the firewall configuration method according to any one of claims 1 to 7.

Images