Data transmission method and device based on container network

Abstract

The embodiment of the invention provides a data transmission method and device based on a container network, and the method comprises the steps: receiving a data packet transmitted by a transmitting end container node, the data packet being configured to carry a target container node network address and first mapping information of an expected receiving end container identifier; the data packet is analyzed to obtain first mapping information of a target container node network address and an expected receiving end container identifier, second mapping information corresponding to the target container node network address is inquired from a locally maintained mapping relation table, and the second mapping information is used for representing a mapping relation between the target container node network address and the current container identifier; if the first mapping information is inconsistent with the second mapping information, discarding the data packet; and if the first mapping information is consistent with the second mapping information, allowing to process the data packet. The method can improve the security of data transmission and reduce resource overhead.

Description

Technical Field

[0001] The embodiments of the present disclosure relate to the field of Internet technology, and in particular to a data transmission method and device based on a container network. Background Art

[0002] Container networking is the network architecture and communication mechanism that container instances rely on to communicate with the outside world. It solves the challenges of network communication in containerized deployment, allowing containers to participate in network communication like virtual machines or physical machines, while providing a more flexible and lightweight network isolation and management method.

[0003] In the prior art, CNI (Container Network Interface) allocates IP addresses for communication between containers. These IP addresses are allocated when a container is created, and are recycled by CNI when the container is destroyed and provided to a new container. Other containers or other components in the container cluster can access the container through the container's IP address.

[0004] However, the inventors have discovered that the prior art has at least the following technical problems: the data transmission method in the prior art has security problems and resource overhead problems. Summary of the invention

[0005] The embodiments of the present disclosure provide a data transmission method and device based on a container network, which can improve the security of data transmission and reduce resource overhead.

[0006] In a first aspect, an embodiment of the present disclosure provides a data transmission method based on a container network, including:

[0007] Receive a data packet sent by a sending-end container node, where the data packet is configured to carry first mapping information of a destination container node network address and an expected receiving-end container identifier;

[0008] Parsing the data packet to obtain first mapping information between the destination container node network address and the expected receiving end container identifier, querying second mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table, where the second mapping information is used to represent a mapping relationship between the destination container node network address and the current container identifier;

[0009] If the first mapping information is inconsistent with the second mapping information, the data packet is discarded; if the first mapping information is consistent with the second mapping information, processing of the data packet is allowed.

[0010] In a second aspect, an embodiment of the present disclosure provides a data transmission method based on a container network, including:

[0011] In response to sending a data packet to a destination container node, acquiring a destination container node network address corresponding to the destination container node from a header of the data packet;

[0012] Querying first mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table to obtain an expected receiving end container identifier; the first mapping information is used to represent a mapping relationship between the destination container node network address and the expected receiving end container identifier;

[0013] The expected receiving end container identifier is added to the data packet so that the data packet carries the first mapping information, and then the data packet is forwarded to the destination container node.

[0014] In a third aspect, an embodiment of the present disclosure provides a data transmission device based on a container network, including:

[0015] A receiving unit, configured to receive a data packet sent by a sending end container node, wherein the data packet is configured to carry first mapping information of a destination container node network address and an expected receiving end container identifier;

[0016] a parsing unit, configured to parse the data packet to obtain first mapping information between the destination container node network address and the expected receiving end container identifier, and query second mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table, wherein the second mapping information is used to represent a mapping relationship between the destination container node network address and the current container identifier;

[0017] A data transmission unit, configured to discard the data packet if the first mapping information is inconsistent with the second mapping information; and to allow processing of the data packet if the first mapping information is consistent with the second mapping information.

[0018] In a fourth aspect, an embodiment of the present disclosure provides a data transmission device based on a container network, including:

[0019] a sending unit, configured to, in response to sending a data packet to a destination container node, obtain a destination container node network address corresponding to the destination container node from a packet header of the data packet;

[0020] A query unit, configured to query first mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table to obtain an expected receiving end container identifier; the first mapping information is used to represent a mapping relationship between the destination container node network address and the expected receiving end container identifier;

[0021] The adding unit is used to add the expected receiving end container identifier to the data packet so that the data packet carries the first mapping information, and then forward the data packet to the destination container node.

[0022] In a fifth aspect, an embodiment of the present disclosure provides an electronic device, including: a processor and a memory;

[0023] The memory stores computer-executable instructions;

[0024] The processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the data transmission method based on the container network as described in the first aspect and various possible designs of the first aspect.

[0025] In a sixth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer execution instructions. When a processor executes the computer execution instructions, the data transmission method based on the container network as described in the first aspect and various possible designs of the first aspect is implemented.

[0026] In a seventh aspect, an embodiment of the present disclosure provides a computer program product, including a computer program, which, when executed by a processor, implements the data transmission method based on a container network as described in the first aspect and various possible designs of the first aspect.

[0027] The data transmission method and device based on the container network provided in this embodiment include: receiving a data packet sent by a sending end container node, the data packet is configured to carry a first mapping information of a destination container node network address and an expected receiving end container identifier; parsing the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier, querying the second mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table, the second mapping information is used to characterize the mapping relationship between the destination container node network address and the current container identifier; if the first mapping information is inconsistent with the second mapping information, the data packet is discarded; if the first mapping information is consistent with the second mapping information, the data packet is allowed to be processed. In this technical solution, since the second mapping information corresponding to the destination container node network address is queried from the locally maintained mapping relationship table, and the first mapping information of the destination container node network address and the expected receiving end container identifier carried in the data packet is verified to be consistent with the local second mapping information, if it is inconsistent, it means that the first mapping information carried in the data packet has expired, discarding the data packet at this time can avoid the sending end container from accessing the wrong container, thereby solving the security problem caused by the data packet forwarding error, and avoiding the resource overhead of the container node by irrelevant traffic, thereby improving the security of data transmission while reducing resource overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0029] Figure 1 A schematic diagram of an application scenario of a data transmission method based on a container network provided in an embodiment of the present disclosure;

[0030] Figure 2 The process of the data transmission method based on the container network provided in the embodiment of the present disclosure Figure 1 ;

[0031] Figure 3 Schematic diagram of the process of the data transmission method based on the container network provided in the embodiment of the present disclosure Figure 1 ;

[0032] Figure 4 The process of the data transmission method based on the container network provided in the embodiment of the present disclosure Figure 2 ;

[0033] Figure 5 A schematic diagram of a data transmission device based on a container network provided in an embodiment of the present disclosure Figure 1 ;

[0034] Figure 6 A schematic diagram of a data transmission device based on a container network provided in an embodiment of the present disclosure Figure 2 ;

[0035] Figure 7 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.

[0037] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and corresponding operation entrances shall be provided for users to choose to authorize or refuse.

[0038] Container networking is the network architecture and communication mechanism that container instances rely on to communicate with the outside world. It solves the challenges of network communication in containerized deployment, allowing containers to participate in network communication like virtual machines or physical machines, while providing a more flexible and lightweight network isolation and management method.

[0039] In the prior art, CNI (Container Network Interface) allocates IP addresses for communication between containers. These IP addresses are allocated when a container is created, and are recycled by CNI when the container is destroyed and provided to a new container. Other containers or other components in the container cluster can access the container through the container's IP address.

[0040] However, the inventors have discovered that the prior art has at least the following technical problems: the data transmission method in the prior art has low security.

[0041] For example, Figure 1As shown, the API Server (Application Programming Interface Server) can send the mapping relationship table between Pod and Pod IP to the Server forwarding data plane through the Server forwarding control surface. When the sending end container Pod sends data to the receiving end Pod.S2, it can obtain the Pod IP address (172.18.1.2) of the receiving end Pod.S2 from the mapping relationship table through the Server forwarding data plane, and send data to the receiving end Pod.S2 through the above Pod IP address. When the Pod IP (172.18.1.2) of Pod.S2 is destroyed by the user scheduling layer, the Pod IP (172.18.1.2) of Pod.S2 will be recycled and then allocated to new containers (such as Pod.S4) for other services. At this time, if the event "Pod.S2's Pod IP (172.18.1.2) is released and recycled and reallocated to the new container Pod.S4" cannot be updated in time due to failures such as network jitter, other containers still believe that Pod.S2 can be accessed through the Pod IP (172.18.1.2). In this way, the data packet may be incorrectly received by the new container Pod.S4, thereby affecting the business logic of both parties and causing unexpected security issues.

[0042] It can be seen that how to improve the security of data transmission between containers is a technical problem that needs to be solved urgently.

[0043] In view of the technical problems in the prior art, the inventor's technical concept is as follows: when a sending container node sends or forwards a data packet to other nodes, the data packet carries first mapping information of the destination container node network address and the expected receiving container identifier. Accordingly, when the receiving container node receives the data packet, the second mapping information (the latest mapping information) of the destination container node network address and the destination container identifier can be obtained locally. By verifying the first mapping information and the second mapping information, it can be determined whether the first mapping information is expired.

[0044] Accordingly, the specific steps may include: first, receiving a data packet sent by a sending end container node, the data packet is configured to carry first mapping information of a destination container node network address and an expected receiving end container identifier. Then, parsing the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier, querying the second mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table, the second mapping information is used to characterize the mapping relationship between the destination container node network address and the current container identifier. Finally, if the first mapping information is inconsistent with the second mapping information, the data packet is discarded; if the first mapping information is consistent with the second mapping information, the data packet is allowed to be processed.

[0045] In this technical solution, the second mapping information corresponding to the destination container node network address is queried from the locally maintained mapping relationship table, and the first mapping information of the destination container node network address and the expected receiving end container identifier carried in the data packet is verified to be consistent with the local second mapping information. If they are inconsistent, it means that the first mapping information carried in the data packet has expired. At this time, the data packet is discarded, which can avoid the sending end container accessing the wrong container, thereby solving the security problem caused by the data packet forwarding error, and avoiding the resource overhead of the container node due to irrelevant traffic, thereby improving the security of data transmission while reducing resource overhead.

[0046] The following is a specific implementation process of the data transmission method and device based on the container network involved in the embodiment of the present disclosure. Some examples are for illustrative purposes only and are not intended to be limiting. The execution subject of the data transmission method based on the container network involved in the embodiment of the present disclosure is an electronic device, which can be a terminal, a server, etc.

[0047] Figure 2 The data transmission method based on the container network provided in the embodiment of the present disclosure is as follows: Figure 1 ,like Figure 2 As shown, the data transmission method based on the container network may include:

[0048] S201: A receiving-end container node receives a data packet sent by a sending-end container node, where the data packet is configured to carry first mapping information of a destination container node network address and an expected receiving-end container identifier.

[0049] In the embodiment of the present disclosure, the data packet sent by the sending container node may be a data packet sent in any scenario. Optionally, this step may include: the receiving container node receives the data packet sent by the sending container node in the scenario of establishing a network connection.

[0050] For example, Figure 3 As shown, the data packets sent by the sending container node are data packet 1 and data packet 2. Among them, data packet 1 carries the first mapping information of the destination container node network address and the expected receiving container identifier: 10.0.1.2 corresponds to d9698d. Data packet 2 carries the first mapping information of the destination container node network address and the expected receiving container identifier: 10.0.1.3 corresponds to d96d0d.

[0051] It should be noted that if the packet header of the data packet does not carry the first mapping information, the data packet is directly processed. Accordingly, the method further includes: detecting whether the packet header of the data packet carries the first mapping information of the destination container node network address and the expected receiving end container identifier; if not, allowing the data packet to be processed; if so, executing step S202 to parse the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier, and querying the second mapping information corresponding to the destination container node network address from the locally maintained mapping relationship table.

[0052] S202: The receiving-end container node parses the data packet to obtain first mapping information between the destination container node network address and the expected receiving-end container identifier, and queries second mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table, where the second mapping information is used to represent a mapping relationship between the destination container node network address and the current container identifier.

[0053] In an embodiment of the present disclosure, the receiving-end container node parses a data packet to obtain first mapping information of a destination container node network address and an expected receiving-end container identifier, including: determining a transmission protocol type of the data packet; and parsing the data packet according to the transmission protocol type to obtain first mapping information of the destination container node network address and the expected receiving-end container identifier.

[0054] Optionally, the transmission protocol type of the data packet includes the IPv4 transmission protocol or the IPv6 transmission protocol. Accordingly, according to the transmission protocol type, the data packet is parsed to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier, including: if the transmission protocol type is the IPv4 transmission protocol, the optional field Options of the packet header of the data packet is parsed to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier; if the transmission protocol type is the IPv6 transmission protocol, the extendable field Extension Headers of the packet header of the data packet is parsed to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier.

[0055] Optionally, the second mapping information corresponding to the destination container node network address is queried from the locally maintained mapping relationship table as the latest mapping information. Figure 3 As shown, from the locally maintained mapping relationship table, querying the second mapping information corresponding to the network address of the destination container node includes: 10.0.1.2 corresponds to aaaaaa; 10.0.1.3 corresponds to d96d0d.

[0056] It should be noted that, in some embodiments, an ingress traffic identifier verification module may be configured in the receiving end container node, and the ingress traffic identifier verification module parses the data packet to obtain first mapping information between the destination container node network address and the expected receiving end container identifier.

[0057] S203: If the first mapping information is inconsistent with the second mapping information, discard the data packet; if the first mapping information is consistent with the second mapping information, allow processing of the data packet.

[0058] In some embodiments, an ingress traffic identification verification module is configured in the receiving end container node, and the ingress traffic identification verification module is used to verify whether the first mapping information is consistent with the second mapping information. If the first mapping information is inconsistent with the second mapping information, the data packet is discarded; if the first mapping information is consistent with the second mapping information, the data packet is allowed to be processed.

[0059] For example, Figure 3 As shown, for data packet 1, the first mapping information (10.0.1.2 corresponds to d9698d) and the second mapping information (10.0.1.2 corresponds to aaaaaa) are inconsistent, so data packet 1 is discarded. For data packet 2, the first mapping information (10.0.1.3 corresponds to d96d0d) and the second mapping information (10.0.1.3 corresponds to d96d0d) are consistent, so data packet 2 is allowed to be processed.

[0060] Here, if the first mapping information is inconsistent with the second mapping information, the data packet is discarded, which means that the expected receiving container identifier in the sending container node that sends or forwards the data packet is outdated. At this time, by discarding the data packet, forwarding to an irrelevant container node can be avoided, thereby improving the security of data transmission while reducing resource overhead.

[0061] The disclosed embodiment provides a data transmission method based on a container network: first, a data packet sent by a sending end container node is received, and the data packet is configured to carry first mapping information of a destination container node network address and an expected receiving end container identifier. Then, the data packet is parsed to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier, and the second mapping information corresponding to the destination container node network address is queried from a locally maintained mapping relationship table, and the second mapping information is used to characterize the mapping relationship between the destination container node network address and the current container identifier. Finally, if the first mapping information is inconsistent with the second mapping information, the data packet is discarded; if the first mapping information is consistent with the second mapping information, the data packet is allowed to be processed.

[0062] In this technical solution, the second mapping information corresponding to the destination container node network address is queried from the locally maintained mapping relationship table, and the first mapping information of the destination container node network address and the expected receiving end container identifier carried in the data packet is verified to be consistent with the local second mapping information. If they are inconsistent, it means that the first mapping information carried in the data packet has expired. At this time, the data packet is discarded, which can avoid the sending end container accessing the wrong container, thereby solving the security problem caused by the data packet forwarding error, and avoiding the resource overhead of the container node due to irrelevant traffic, thereby improving the security of data transmission while reducing resource overhead.

[0063] It should be noted that when the sending container node sends a data packet to the destination container node, the expected receiving container identifier needs to be added to the data packet. Figure 4 As shown, before the receiving-end container node receives the data packet sent by the sending-end container node in step S201, the method further includes:

[0064] S401: In response to sending a data packet to a destination container node, a sending container node obtains a destination container node network address corresponding to the destination container node from a header of the data packet.

[0065] In the embodiment of the present disclosure, when the sending container node sends a data packet to the destination container node, the destination container node network address corresponding to the destination container node can be obtained from the header of the initial data packet.

[0066] Optionally, the header of the initial data packet includes the destination container node network address and valid transmission data. Figure 3 As shown, the header of the initial data packet 1 ( Figure 3 The first line in the packet includes: the destination container node network address (DstIP: 10.0.1.2) and the valid transmission data 1. The header of the initial data packet 2 ( Figure 3 The second line in the figure) includes the destination container node network address (DstIP: 10.0.1.3) and valid transmission data 2.

[0067] S402: The sending container node searches for first mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table to obtain an expected receiving container identifier; the first mapping information is used to represent a mapping relationship between the destination container node network address and the expected receiving container identifier.

[0068] For example, Figure 3As shown, the locally maintained mapping relationship table includes the mapping relationship between the container IP address and the expected receiving end container identifier: 10.0.1.2 corresponds to d9698d; 10.0.1.3 corresponds to d96d0d. In this example, the sending end container node queries the first mapping information corresponding to the destination container node network address (10.0.1.2) and obtains the expected receiving end container identifier d9698d. The sending end container node queries the first mapping information corresponding to the destination container node network address (10.0.1.3) and obtains the expected receiving end container identifier d96d0d.

[0069] S403: The sending container node adds the expected receiving container identifier to the data packet so that the data packet carries the first mapping information, and then forwards the data packet to the destination container node.

[0070] In an embodiment of the present disclosure, the sending end container node adds the expected receiving end container identifier to the data packet, including: determining the transmission protocol type of the data packet; and adding the expected receiving end container identifier to a preset position in the header of the data packet according to the transmission protocol type. Figure 3 As shown, the expected receiving end container identifier is added to the header of the initial data packet to obtain a marked data packet.

[0071] Optionally, the transport protocol type of the data packet includes the IPv4 transport protocol or the IPv6 transport protocol. Accordingly, according to the transport protocol type, the data packet is parsed to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier, including: if the transport protocol type is the IPv4 transport protocol, the expected receiving end container identifier is added to the optional field Options of the packet header of the data packet; if the transport protocol type is the IPv6 transport protocol, the expected receiving end container identifier is added to the expandable field Extension Headers of the packet header of the data packet.

[0072] In some embodiments of the present disclosure, the sending container node can add the expected receiving container identifier to the data packet through the expected receiving container identifier module. Optionally, the expected receiving container identifier module includes a traffic monitoring program, through which the initial data packet sent to other node containers can be monitored; for the initial data packet sent to other node containers, the traffic monitoring program can also query the expected receiving container identifier corresponding to the destination container node network address in the initial data packet, and add it to the network layer header of the initial data packet.

[0073] For example, Figure 3As shown, the expected receiving container identification module can add the expected receiving end container identification corresponding to the destination container node network address (10.0.1.2) as d9698d to the initial data packet 1; and add the expected receiving end container identification corresponding to the destination container node network address (10.0.1.3) as d96d0d to the initial data packet 2.

[0074] Figure 5 A schematic diagram of a data transmission device based on a container network provided in an embodiment of the present disclosure is shown in FIG. Figure 5 As shown, the data transmission device based on the container network includes:

[0075] A receiving unit 501 is configured to receive a data packet sent by a sending end container node, where the data packet is configured to carry first mapping information of a destination container node network address and an expected receiving end container identifier;

[0076] A parsing unit 502 is configured to parse the data packet to obtain first mapping information between the destination container node network address and the expected receiving end container identifier, and query second mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table, where the second mapping information is used to represent a mapping relationship between the destination container node network address and the current container identifier;

[0077] The data transmission unit 503 is configured to discard the data packet if the first mapping information is inconsistent with the second mapping information; and allow processing of the data packet if the first mapping information is consistent with the second mapping information.

[0078] According to one or more embodiments of the present disclosure, the parsing unit 502 parses the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier, including: determining the transmission protocol type of the data packet; and parsing the data packet according to the transmission protocol type to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier.

[0079] According to one or more embodiments of the present disclosure, the parsing unit 502 parses the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier according to the transmission protocol type, including: if the transmission protocol type is the IPv4 transmission protocol, parsing the optional field Options of the packet header of the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier; if the transmission protocol type is the IPv6 transmission protocol, parsing the extendable field ExtensionHeaders of the packet header of the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier.

[0080] According to one or more embodiments of the present disclosure, the method further includes: a detection unit, the detection unit being configured to detect whether the packet header of the data packet carries first mapping information of a destination container node network address and an expected receiving end container identifier; if not, allowing the data packet to be processed; if yes, executing the step of parsing the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier, and querying second mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table.

[0081] According to one or more embodiments of the present disclosure, the receiving unit 501 receives a data packet sent by a sending container node, including: receiving a data packet sent by the sending container node in a network connection establishment scenario.

[0082] Figure 6 A schematic diagram of a data transmission device based on a container network provided in an embodiment of the present disclosure is shown in FIG. Figure 6 As shown, the data transmission device based on the container network includes:

[0083] The sending unit 601 is configured to, in response to sending a data packet to a destination container node, obtain a destination container node network address corresponding to the destination container node from a header of the data packet;

[0084] A query unit 602 is used to query the first mapping information corresponding to the destination container node network address from the locally maintained mapping relationship table to obtain the expected receiving end container identifier; the first mapping information is used to represent the mapping relationship between the destination container node network address and the expected receiving end container identifier;

[0085] The adding unit 603 is configured to add the expected receiving end container identifier to the data packet so that the data packet carries the first mapping information, and then forward the data packet to a destination container node.

[0086] According to one or more embodiments of the present disclosure, the adding unit 603 adds the expected receiving end container identifier to the data packet, including: determining the transmission protocol type of the data packet; and adding the expected receiving end container identifier to a preset position in the header of the data packet according to the transmission protocol type.

[0087] According to one or more embodiments of the present disclosure, the adding unit 603 adds the expected receiving end container identifier to a preset position in the header of the data packet according to the transmission protocol type, including: if the transmission protocol type is the IPv4 transmission protocol, the expected receiving end container identifier is added to the optional field Options of the header of the data packet; if the transmission protocol type is the IPv6 transmission protocol, the expected receiving end container identifier is added to the extensible field Extension Headers of the header of the data packet.

[0088] refer to Figure 7 , which shows a schematic diagram of the structure of an electronic device 700 suitable for implementing the embodiment of the present disclosure, and the electronic device 700 may be a terminal device or a server. The terminal device may include but is not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, personal digital assistants (PDAs), tablet computers, portable multimedia players (PMPs), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0089] like Figure 7 As shown, the electronic device 700 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 to a random access memory (RAM) 703. Various programs and data required for the operation of the electronic device 700 are also stored in the RAM 703. The processing device 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0090] Typically, the following devices may be connected to the I / O interface 705: input devices 706 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 707 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 708 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 709. The communication devices 709 may allow the electronic device 700 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 7 The electronic device 700 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0091] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 709, or installed from a storage device 708, or installed from a ROM 702. When the computer program is executed by the processing device 701, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0092] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0093] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0094] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device executes the method shown in the above embodiment.

[0095] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0096] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0097] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware. The name of a unit does not limit the unit itself in some cases. For example, the first acquisition unit may also be described as a "unit for acquiring at least two Internet Protocol addresses".

[0098] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0099] In a first aspect, according to one or more embodiments of the present disclosure, a method for data transmission based on a container network is provided, including:

[0100] Receive a data packet sent by a sending-end container node, where the data packet is configured to carry first mapping information of a destination container node network address and an expected receiving-end container identifier;

[0101] Parsing the data packet to obtain first mapping information between the destination container node network address and the expected receiving end container identifier, querying second mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table, where the second mapping information is used to represent a mapping relationship between the destination container node network address and the current container identifier;

[0102] If the first mapping information is inconsistent with the second mapping information, the data packet is discarded; if the first mapping information is consistent with the second mapping information, processing of the data packet is allowed.

[0103] According to one or more embodiments of the present disclosure, the parsing of the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier includes: determining a transmission protocol type of the data packet; and parsing the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier according to the transmission protocol type.

[0104] According to one or more embodiments of the present disclosure, the parsing of the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier according to the transmission protocol type includes: if the transmission protocol type is the IPv4 transmission protocol, parsing the optional field Options of the packet header of the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier; if the transmission protocol type is the IPv6 transmission protocol, parsing the extendable field Extension Headers of the packet header of the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier.

[0105] According to one or more embodiments of the present disclosure, the method further includes: detecting whether the packet header of the data packet carries first mapping information of the destination container node network address and the expected receiving end container identifier; if not, allowing the data packet to be processed; if yes, executing the step of parsing the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier, and querying the second mapping information corresponding to the destination container node network address from the locally maintained mapping relationship table.

[0106] According to one or more embodiments of the present disclosure, the receiving a data packet sent by a sending container node includes: receiving a data packet sent by the sending container node in a network connection establishment scenario.

[0107] In a second aspect, according to one or more embodiments of the present disclosure, a method for data transmission based on a container network is provided, including:

[0108] In response to sending a data packet to a destination container node, acquiring a destination container node network address corresponding to the destination container node from a header of the data packet;

[0109] Querying first mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table to obtain an expected receiving end container identifier; the first mapping information is used to represent a mapping relationship between the destination container node network address and the expected receiving end container identifier;

[0110] The expected receiving end container identifier is added to the data packet so that the data packet carries the first mapping information, and then the data packet is forwarded to the destination container node.

[0111] According to one or more embodiments of the present disclosure, adding the expected receiving end container identifier to the data packet includes: determining a transmission protocol type of the data packet; and adding the expected receiving end container identifier to a preset position in a header of the data packet according to the transmission protocol type.

[0112] According to one or more embodiments of the present disclosure, adding the expected receiving end container identifier to a preset position in the header of the data packet according to the transmission protocol type includes: if the transmission protocol type is the IPv4 transmission protocol, adding the expected receiving end container identifier to the optional field Options of the header of the data packet; if the transmission protocol type is the IPv6 transmission protocol, adding the expected receiving end container identifier to the extensible field Extension Headers of the header of the data packet.

[0113] In a third aspect, according to one or more embodiments of the present disclosure, a data transmission device based on a container network is provided, including:

[0114] A receiving unit, configured to receive a data packet sent by a sending end container node, wherein the data packet is configured to carry first mapping information of a destination container node network address and an expected receiving end container identifier;

[0115] a parsing unit, configured to parse the data packet to obtain first mapping information between the destination container node network address and the expected receiving end container identifier, and query second mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table, wherein the second mapping information is used to represent a mapping relationship between the destination container node network address and the current container identifier;

[0116] A data transmission unit, configured to discard the data packet if the first mapping information is inconsistent with the second mapping information; and to allow processing of the data packet if the first mapping information is consistent with the second mapping information.

[0117] According to one or more embodiments of the present disclosure, the parsing unit parses the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier, including: determining the transmission protocol type of the data packet; and parsing the data packet according to the transmission protocol type to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier.

[0118] According to one or more embodiments of the present disclosure, the parsing unit parses the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier according to the transmission protocol type, including: if the transmission protocol type is the IPv4 transmission protocol, parsing the optional field Options of the packet header of the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier; if the transmission protocol type is the IPv6 transmission protocol, parsing the extendable field Extension Headers of the packet header of the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier.

[0119] According to one or more embodiments of the present disclosure, the method further includes: a detection unit, the detection unit being configured to detect whether the packet header of the data packet carries first mapping information of a destination container node network address and an expected receiving end container identifier; if not, allowing the data packet to be processed; if yes, executing the step of parsing the data packet to obtain the first mapping information of the destination container node network address and the expected receiving end container identifier, and querying second mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table.

[0120] According to one or more embodiments of the present disclosure, the receiving unit receives a data packet sent by a sending end container node, including: receiving a data packet sent by the sending end container node in a network connection establishment scenario.

[0121] In a fourth aspect, according to one or more embodiments of the present disclosure, a data transmission device based on a container network is provided, including:

[0122] a sending unit, configured to, in response to sending a data packet to a destination container node, obtain a destination container node network address corresponding to the destination container node from a packet header of the data packet;

[0123] A query unit, configured to query first mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table to obtain an expected receiving end container identifier; the first mapping information is used to represent a mapping relationship between the destination container node network address and the expected receiving end container identifier;

[0124] The adding unit is used to add the expected receiving end container identifier to the data packet so that the data packet carries the first mapping information, and then forward the data packet to the destination container node.

[0125] According to one or more embodiments of the present disclosure, the adding unit adds the expected receiving end container identifier to the data packet, including: determining a transmission protocol type of the data packet; and adding the expected receiving end container identifier to a preset position in a header of the data packet according to the transmission protocol type.

[0126] According to one or more embodiments of the present disclosure, the adding unit adds the expected receiving end container identifier to a preset position in the header of the data packet according to the transmission protocol type, including: if the transmission protocol type is the IPv4 transmission protocol, the expected receiving end container identifier is added to the optional field Options of the header of the data packet; if the transmission protocol type is the IPv6 transmission protocol, the expected receiving end container identifier is added to the extensible field Extension Headers of the header of the data packet.

[0127] In a fifth aspect, according to one or more embodiments of the present disclosure, there is provided an electronic device, comprising: at least one processor and a memory;

[0128] The memory stores computer-executable instructions;

[0129] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the data transmission method based on the container network as described in the first aspect, the second aspect, various possible designs of the first aspect, and various possible designs of the second aspect.

[0130] In a sixth aspect, according to one or more embodiments of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer execution instructions. When a processor executes the computer execution instructions, the data transmission method based on the container network as described in the first aspect, the second aspect, and various possible designs of the first aspect and various possible designs of the second aspect is implemented.

[0131] In a seventh aspect, according to one or more embodiments of the present disclosure, a computer program product is provided, including a computer program, which, when executed by a processor, implements the data transmission method based on a container network as described in the first aspect, the second aspect, and various possible designs of the first aspect and various possible designs of the second aspect.

[0132] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0133] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0134] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

Claims

1. A data transmission method based on a container network, characterized in that: include: Receive a data packet sent by a sending-end container node, where the data packet is configured to carry first mapping information of a destination container node network address and an expected receiving-end container identifier; Parsing the data packet to obtain first mapping information between the destination container node network address and the expected receiving end container identifier, querying second mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table, where the second mapping information is used to represent a mapping relationship between the destination container node network address and the current container identifier; If the first mapping information is inconsistent with the second mapping information, the data packet is discarded; if the first mapping information is consistent with the second mapping information, processing of the data packet is allowed.

2. The data transmission method according to claim 1, characterized in that: The step of parsing the data packet to obtain first mapping information between the destination container node network address and the expected receiving end container identifier includes: Determining a transmission protocol type of the data packet; According to the transmission protocol type, the data packet is parsed to obtain first mapping information between the destination container node network address and the expected receiving end container identifier.

3. The data transmission method according to claim 2, characterized in that: The step of parsing the data packet to obtain first mapping information of the destination container node network address and the expected receiving end container identifier according to the transmission protocol type includes: If the transport protocol type is the IPv4 transport protocol, parsing the optional field Options in the header of the data packet to obtain first mapping information between the destination container node network address and the expected receiving end container identifier; If the transport protocol type is the IPv6 transport protocol, the extendable field Extension Headers of the packet header of the data packet is parsed to obtain first mapping information between the destination container node network address and the expected receiving end container identifier.

4. The data transmission method according to claim 1, characterized in that: Also includes: Detecting whether the packet header of the data packet carries first mapping information of a destination container node network address and an expected receiving end container identifier; If not present, the data packet is allowed to be processed; If so, the step of parsing the data packet to obtain first mapping information between the destination container node network address and the expected receiving end container identifier and querying second mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table is performed.

5. The data transmission method according to claim 1, characterized in that: The receiving of a data packet sent by a sending-end container node includes: Receive data packets sent by the sending container node in the scenario of establishing a network connection.

6. A data transmission method based on a container network, characterized in that: include: In response to sending a data packet to a destination container node, acquiring a destination container node network address corresponding to the destination container node from a header of the data packet; Querying first mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table to obtain an expected receiving end container identifier; the first mapping information is used to represent a mapping relationship between the destination container node network address and the expected receiving end container identifier; The expected receiving end container identifier is added to the data packet so that the data packet carries the first mapping information, and then the data packet is forwarded to the destination container node.

7. The data transmission method according to claim 6, characterized in that: The adding the expected receiving end container identifier to the data packet includes: Determining a transmission protocol type of the data packet; According to the transmission protocol type, the expected receiving end container identifier is added to a preset position in the header of the data packet.

8. The data transmission method according to claim 7, characterized in that: The adding the expected receiving end container identifier to a preset position in the header of the data packet according to the transmission protocol type includes: If the transport protocol type is the IPv4 transport protocol, the expected receiving end container identifier is added to the optional field Options of the packet header of the data packet; If the transport protocol type is the IPv6 transport protocol, the expected receiving end container identifier is added to the extendable field Extension Headers of the packet header of the data packet.

9. A data transmission device based on a container network, characterized in that: include: A receiving unit, configured to receive a data packet sent by a sending end container node, wherein the data packet is configured to carry first mapping information of a destination container node network address and an expected receiving end container identifier; a parsing unit, configured to parse the data packet to obtain first mapping information between the destination container node network address and the expected receiving end container identifier, and query second mapping information corresponding to the destination container node network address from a locally maintained mapping relationship table, wherein the second mapping information is used to represent a mapping relationship between the destination container node network address and the current container identifier; A data transmission unit, configured to discard the data packet if the first mapping information is inconsistent with the second mapping information; and to allow processing of the data packet if the first mapping information is consistent with the second mapping information.

10. A data transmission device based on a container network, characterized in that: include: a sending unit, configured to, in response to sending a data packet to a destination container node, obtain a destination container node network address corresponding to the destination container node from a packet header of the data packet; A query unit, configured to query the first mapping information corresponding to the network address of the destination container node from a locally maintained mapping relationship table to obtain an expected receiving end container identifier; The first mapping information is used to represent a mapping relationship between the destination container node network address and the expected receiving end container identifier; The adding unit is used to add the expected receiving end container identifier to the data packet so that the data packet carries the first mapping information, and then forward the data packet to the destination container node.

11. An electronic device, characterized in that: include: Processor and memory; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory, so that the processor executes the container network-based data transmission method according to any one of claims 1 to 8.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions. When the processor executes the computer-executable instructions, the container network-based data transmission method according to any one of claims 1 to 8 is implemented.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the container network-based data transmission method is implemented.

Images