Dynamic identifier generation and updating method of data cross-border service, switch and equipment

Abstract

The invention provides a dynamic identification generation and updating method for a data cross-border service, a switch and equipment, which realize breakthrough in the aspects of structural design, state management, scheduling strategy, propagation mode and the like of a data identification mechanism. A complete dynamic identification system supporting multi-service isolation, state sensing updating, non-intrusive propagation and boundary analysis auditing is formed, the method is particularly suitable for cross-domain and cross-border data application scenes with high requirements for supervision intensity, data identification precision and real-time performance, and the safety of data propagation is guaranteed. On a critical path of data cross-border transmission, identifiability of service identities, updatability of state information, controllability of identification behaviors and traceability of propagation paths are realized, and capabilities of cross-domain data streams in aspects of compliance supervision, behavior auditing, abnormity traceability and the like are remarkably improved; the method is suitable for data security management requirements in multi-service complex scenes such as government affair cloud, financial science and technology, industrial internet and the like.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data identification, and particularly relates to a dynamic identification generation and update method for data cross-border business, a switch and equipment. BACKGROUND

[0002] In the technical field of data identification and the like, in the aspect of supporting multi-business identification and dynamic identification update in a data cross-border flow scenario, there are still significant deficiencies, and it is difficult to meet the actual needs of multi-business traffic identification and dynamic update of identification content according to business running states. SUMMARY

[0003] Therefore, the present application aims to provide a dynamic identification generation and update method for data cross-border business, a switch and equipment, which realizes fine-grained classification and state synchronous update of identification information in cross-border data flow by constructing a multi-business registration system and a state driving mechanism.

[0004] In order to achieve the above purpose, the present application provides a dynamic identification generation and update method for data cross-border business, which is applied to a programmable switch, and the programmable switch comprises a control plane and a data plane which are connected to each other; the method comprises the following steps.

[0005] The control plane is used to register a business to obtain a business registration table, and an identification data packet with an identity function is created for each business according to business related information in the business registration table, and the business registration and the identification data packet are sent to the data plane;

[0006] The data plane is used to store the received business registration table locally, guide the received identification data packet to a loopback path, and store the business traffic of the business to a business circulation queue according to the business registration table;

[0007] The control plane is used to determine a changed business whose state has changed, generate a new identification data packet and a new business registration table according to the registration information, and send the new business registration table and the new identification data packet to the data plane;

[0008] The data plane is used to store the business traffic of the changed business to a data circulation queue according to the received new business registration table, and update the identification data packet in the loopback path according to a new state field of the received new identification data packet;

[0009] determining a target template data packet passing through the data plane in the loopback path, determining a target service traffic corresponding to the target template data packet in the service loop queue, cloning the target template data packet to obtain an identification data packet copy, and changing packet header information of the identification data packet copy according to the target service traffic to obtain a flow identification packet;

[0010] de-queueing the target service traffic in the data loop queue, and synchronously forwarding the flow identification packet into the de-queued target service traffic.

[0011] Optionally, the method further comprises:

[0012] determining a service source IP in the service related information as a head source IP of the identification data packet;

[0013] performing hash calculation on the service source IP in the service related information to obtain a hash value, and determining the hash value as a port field of a source port of the identification data packet;

[0014] determining a state field of the identification data packet according to a service related state in the service related information;

[0015] integrating the service related information, the head source IP, the port field and the state field to obtain the identification data packet, and setting an update flag bit of the identification data packet to a preset first flag value.

[0016] Optionally, the method further comprises:

[0017] in response to identifying the port field in the source port of the identification data packet, identifying an update flag bit of the identification data packet;

[0018] in response to identifying the first flag value, storing a state field of the identification data packet to a local repository, and setting an output port of the identification data packet as a loopback port to configure the identification data packet to the loopback path.

[0019] Optionally, the method further comprises:

[0020] replacing the first flag value of the update flag bit with a preset second flag value; wherein the first flag value indicates that there is a guiding requirement, and the second flag value indicates that there is no guiding requirement.

[0021] Optionally, the method further comprises:

[0022] determining a service ID of the service;

[0023] in response to the service ID existing in the service registry, determining an available service circulation queue matching the service ID in the service circulation queue table;

[0024] storing the related information of the service flow to the service circulation queue when a preset storage trigger condition is met.

[0025] Optionally, the updating of the identification data packet in the loopback path according to the new state field of the received new identification data packet comprises:

[0026] determining a state field corresponding to the new identification data packet in a local repository according to a header source IP of the new identification data packet;

[0027] replacing the state field in the local repository with the new state field;

[0028] triggering a state field matching failure when the identification data packet corresponding to the change task in the loopback path passes through the data plane, discarding the identification data packet in the loopback path, and guiding the new identification data packet to the loopback path.

[0029] Optionally, the determining of the target service flow corresponding to the target template data packet in the service circulation queue comprises:

[0030] determining a target service ID in the service registry according to a header source IP of the target template data packet;

[0031] determining a target circulation queue in the service circulation queue according to the target service ID, and determining the service flow stored at the head of the target circulation queue as the target service flow.

[0032] Optionally, the changing of the packet header information of the identification data packet copy according to the target service flow to obtain a flow identification packet comprises:

[0033] determining a destination IP of the target service flow;

[0034] replacing a header source IP in the packet header position of the identification data packet copy with the destination IP to obtain the flow identification packet.

[0035] Based on the same inventive concept, the application further provides a programmable switch comprising a control plane and a data plane connected to each other;

[0036] The control plane is configured to register the service, obtain a service registration table, create an identification data packet with an identity function for each service according to service-related information in the service registration table, and send the registered service and the identification data packet to the data plane.

[0037] The data plane is configured to store the received service registration table locally, guide the received identification data packet to a loopback path, and store service traffic of the service to a service circulation queue according to the service registration table.

[0038] The control plane is further configured to determine a changed service with a changed service state, generate a new identification data packet and a new service registration table according to the registration information, and send the new service registration table and the new identification data packet to the data plane.

[0039] The data plane is further configured to store service traffic of the changed service to a data circulation queue according to the received new service registration table, update the identification data packet in the loopback path according to a new state field of the received new identification data packet, determine a target template data packet passing through the data plane in the loopback path, determine target service traffic corresponding to the target template data packet in the service circulation queue, clone the target template data packet to obtain an identification data packet copy, change packet header information of the identification data packet copy according to the target service traffic to obtain a flow identification packet, dequeue the target service traffic in the data circulation queue, and inject the flow identification packet into the dequeued target service traffic for synchronous forwarding.

[0040] Based on the same inventive concept, the application further provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable by the processor, wherein the processor implements the method described above when executing the computer program.

[0041] As can be seen from the above, the dynamic identification generation and update method for data cross-border service provided by the application is applied to a programmable switch including a control plane and a data plane connected to each other; through the cooperation of the control plane and the data plane of the programmable switch, an identification data packet with service semantics is independently generated for each service data stream without relying on the service data body and without changing the original protocol structure, and periodic update, state verification, and flow propagation of the identification are realized, thereby comprehensively improving the identifiability and controllability of cross-border data in the transmission process.

[0042] Firstly, by introducing a service registry and an independent identification data packet mechanism, an identification data packet is allocated to each service, supporting the identification, management and differentiation of multiple services in the same transmission path, solving the problem of identifying different service identities in a shared link, providing accurate service attribution awareness for the regulatory system, and realizing data identification separation and policy isolation in a multi-service environment.

[0043] Secondly, a dynamic identification update mechanism based on state fields is constructed, which perceives service state changes through the control plane and generates new data identification packets, and cooperates with the automatic identification and replacement logic based on state fields in the data plane to build an automatic update capability of identification data packets. This mechanism enables the identification content to evolve dynamically with changes in service permissions and policies, ensuring the timeliness and consistency of data identification and improving the dynamic regulatory capabilities of the system.

[0044] In addition, the long-term residence and template management of identification data packets are realized through the loopback path of programmable switches, and the generation and injection of identification data packets are realized based on the cloning mechanism, so that the identification information can traverse multiple network boundaries and regulatory domains with business data traffic without changing the business data body. This mechanism can be widely adapted to multiple protocols and network structures, and has good deployment compatibility and scalability.

[0045] On the key path of data cross-border transmission, the identification of service identity, the update of state information, the controllability of identification behavior and the traceability of propagation path are realized, which significantly improves the capabilities of cross-domain data flow in compliance regulation, behavior audit, abnormal traceability, etc., and can meet the data security governance needs in complex multi-service scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the present application or related art, the following will briefly introduce the drawings needed to be used in the embodiments or related art descriptions. Obviously, the drawings in the following description are only embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0047] Figure 1 A schematic diagram of the method for generating and updating dynamic identification of data cross-border services by the programmable switch of the embodiment of the present application;

[0048] Figure 2 A flowchart of the method for generating and updating dynamic identification of data cross-border services of the embodiment of the present application;

[0049] Figure 3 A flowchart of the identification data packet generation of the embodiment of the present application;

[0050] Figure 4A flowchart for directing an identification packet to a loopback path for embodiments of the present application;

[0051] Figure 5 A flowchart for storing service traffic of a service to a service loop queue for embodiments of the present application;

[0052] Figure 6 A flowchart for updating an identification packet for embodiments of the present application;

[0053] Figure 7 A flowchart for service flow dequeue for embodiments of the present application;

[0054] Figure 8 A flowchart for deterministic flow identification packet for embodiments of the present application;

[0055] Figure 9 A schematic diagram of a programmable switch for embodiments of the present application;

[0056] Figure 10 A schematic diagram of an electronic device for embodiments of the present application. DETAILED DESCRIPTION

[0057] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the drawings and in conjunction with specific embodiments.

[0058] It should be noted that, unless otherwise defined, technical terms or scientific terms used in embodiments of the present application should be understood as their common meanings to those having ordinary skill in the art to which embodiments of the present application belong. The terms “first”, “second” and similar terms used in embodiments of the present application do not represent any order, number or importance, but are only used to distinguish different components. The terms “include” or “contain” and similar terms mean that the elements or objects before the terms encompass the elements or objects listed after the terms and their equivalents, without excluding other elements or objects. The terms “connect” or “connected” and similar terms are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. The terms “up”, “down”, “left”, “right” and the like are only used to represent relative positional relationships, and when the absolute positions of the described objects are changed, the relative positional relationships can also be changed accordingly.

[0059] In this document, it should be understood that any number of elements in the drawings is used for illustration only and is not limiting, and any naming is only used for differentiation and does not have any limiting meaning.

[0060] Based on the above description of the background art, there are also the following situations in the related art:

[0061] With the development of global digital trade, international collaborative office and cross-border platform services, data cross-border flow has become an important support for the digital economy. In the fields of government affairs, finance, medical treatment and industry, data cross-border sharing has become a norm. However, when data crosses the boundaries of countries, organizations and networks, its flow path is extremely complex, and it faces multiple challenges such as security regulation, compliance tracking and responsibility audit.

[0062] Especially in cross-border scenarios, there are the following core problems: data flows out from multiple companies and multiple business sources, the business is diverse and the format is not the same, the data flow crosses multiple security boundaries in the process, it is difficult to identify the data business traffic source, data related information, cross-domain policy information and other information on the security boundary, and multiple data business traffic needs to be identified. For example, a data export company holds data A and data B. When data A and data B are pulled, the data business traffic is identified, and relevant data information is written in the identification. When data A is not allowed to cross the border, but data A is found to be transmitted to the overseas when passing through the security boundary, the illegal data cross-border behavior can be quickly prevented. Therefore, multi-business identification technology is needed to support the normal operation of data cross-border behavior.

[0063] And with the continuous operation of data business, data business information changes, data volume transmission size, data transmission security policy and other information change constantly. For example, when a data export company transmits data A to overseas, the total amount of data A increases continuously, and the total amount of data A that is limited to export is a certain threshold. When reading the transmission data total amount information in the identification at the security boundary, it is found that the total amount of data A transmission exceeds the threshold, and the illegal data cross-border behavior can be prevented. Therefore, in the data cross-border traffic, dynamic variable identification information is needed to support the normal operation of data cross-border.

[0064] Therefore, there is an urgent need for a cross-domain identification method with multi-business awareness and dynamic updating capability, which can realize full-link data identity recognition and traceability before data export, transmission and landing.

[0065] To further understand the development status of the related art, there is a traceability technology based on data packet tail marking in the related art. When the data packet passes through the network node, the information such as source IP, MAC, etc. is added to the tail of the data packet, and is added hop by hop. When the data leaves the exit node, the marking information is removed and is mirrored to the audit system, and the path record is saved. However, this method is only suitable for small networks such as enterprise networks. In the data cross-border open network environment scenario, it changes the structure characteristics of the original data packet, such as packet length, which affects the transmission and analysis of the data packet in the network. Therefore, this scheme cannot realize the identification and dynamic update of the identification content of multiple services in the data cross-border scenario. Moreover, this scheme relies on software implementation, and cannot realize the functions of multiple service identification sending and dynamic updating on hardware devices such as switches.

[0066] The related art can also combine SDN centralized control and hybrid marking technology to realize the traceability of abnormal traffic. The system uses a controller to generate a marking strategy, marks the data packet and records the log for suspicious traffic. The marking and storage operations are triggered by an abnormal detection mechanism, and the switch information is written into the data packet header. In the traceability, the controller reconstructs the path according to the marking information and the switch mapping table. However, this scheme writes identification information in the header, and the available space in the data packet header is extremely limited. Moreover, the length of the identification of multiple services is different, which may cause the identification information to be unable to be written or lost. Therefore, it is impossible to identify multiple service traffic. Moreover, this scheme only marks abnormal traffic and does not support multiple service traffic. Moreover, the identification content is fixed, and there is no support scheme for dynamic update of the identification content.

[0067] The related art can also propose a method for copying data packets through multicast + Recirculate based on programmable switches (such as Tofino), which is used to simulate test traffic generation in high-load scenarios. The multi-port output and replication strategy can be flexibly configured, which is used for device performance evaluation. However, this scheme does not have the functions of dynamic generation and update of identification. The replication of data packets is based on preset rules and static configuration, and cannot dynamically refresh or version evolution of the identification content according to the actual business state change. It cannot support the timeliness and accuracy requirements of the identification in the real business environment. Moreover, it has no multiple service identification capability, and generates simulated load traffic. It does not design classification or identification of data flow according to service granularity, lacks the injection capability of key information such as service ID and data source, and has no management capability for multiple concurrent flows.

[0068] The data identification scheme in the related art, such as the Ali Cloud big data development and management platform DataWorks, gives the original data a watermark label as an identifier, and traces the source according to the watermark information when the data is leaked. However, it cannot support fine identification and isolation of multiple businesses, and the watermark identification method usually gives a unified logical label or steganographic information to the original data in the data generation stage, mainly for responsibility tracking after leakage. This method pays more attention to the ownership of data content rather than network behavior itself, and lacks an association mechanism with network business flow. In the scenario where multiple businesses share the same cross-border link, the watermark scheme cannot distinguish the data flow path and propagation behavior of different businesses, and it is difficult to meet the business-level compliance policy isolation and audit requirements. Moreover, the identification content is static and fixed, and lacks dynamic updating capability. Once the watermark is embedded in the original data, it remains unchanged during the data life cycle, and its content cannot reflect the changes in the subsequent business status.

[0069] In the related art, telemetry instructions and metadata identification can also be embedded in data plane messages to realize real-time hop-by-hop collection of network status (such as latency, congestion, and packet loss) without the need for control plane intervention, thereby improving the accuracy and efficiency of network monitoring. This scheme directly fills in the identification content in the data packet header, but in the field of data cross-border, it cannot identify multiple business traffic without interfering with the normal transmission of business traffic. Moreover, due to the varying length of the identification content, the scheme of writing identification in the data packet header lacks stability and cannot support dynamic updating of the identification content.

[0070] In the related art, programmable switches can also automatically generate and clone probe packets to perform network port scanning, offload scanning logic (such as port probing and response analysis) to the switch data plane (such as P4 implementation), and use hardware parallel processing capabilities to achieve high-speed scanning. However, it lacks multi-business identification capability, and the data packets generated by iMap are mainly network control type probe packets that do not carry business ID or business status semantic information. It does not have a dynamic identification updating mechanism, and the scanning task is delivered in the form of table entry delivery, which cannot dynamically update the business metadata in the data packet. All data packet structures are uniform and fixed in function, and cannot distinguish business ownership or support multi-business concurrent identification, which is not suitable for fine-grained identification management of multiple businesses in shared transmission channels.

[0071] A high-performance network test framework based on programmable switches is also proposed in the related art. By offloading traffic generation, measurement and analysis tasks to the switch data plane (such as P4 implementation), the hardware parallel processing capability is utilized to achieve microsecond-level delay and high-throughput network testing. Compared with traditional software solutions (such as Iperf), the performance is significantly improved, and it is suitable for large-scale network verification, fault diagnosis and performance optimization. However, similar to IMAP, all packet structures are uniform and fixed in function, and cannot distinguish business attribution or support multiple concurrent business identification, which is not suitable for fine-grained identification management of multiple businesses in a shared transmission channel. Therefore, they cannot meet the key requirement of generating updateable and identifiable identification data packets for real business flows in the data cross-border scenario.

[0072] As can be seen, the data identification schemes in the related art still have significant deficiencies in supporting multi-business identification and dynamic identification update in the data cross-border flow scenario, and it is difficult to meet the actual demand of multi-business traffic identification and dynamic update of identification content according to the business running state.

[0073] First, some schemes based on packet marking or tail extension can add identification in business traffic, but are only suitable for local controllable network environment. If this scheme is used for multi-business identification in the data cross-border scenario, due to the openness of the network environment, the normal transmission behavior of the data packet may be affected during the data packet transmission process, such as packet or identification information parsing anomalies caused by packet fragmentation. At the same time, this scheme does not have a dynamic update scheme for identification information, and when applied to cross-border fields, it cannot dynamically update the identification information according to the running state of the business fact. Therefore, this scheme cannot support the identification scheme of multiple businesses in the data cross-border field, and it relies on software implementation and cannot implement multi-business identification and dynamic update of identification information on high-performance hardware such as switches.

[0074] Secondly, the marking scheme for SDN network and the representative research work In-band Network Telemetry (INT) identify traffic in the packet header, but the packet header field space is limited, which may result in that the multi-business identification information cannot be written or lost, so the multi-business identification scheme cannot be implemented. At the same time, this scheme does not have special identification field design for business running state, and cannot dynamically modify the identification information according to the business running state.

[0075] Third, based on part of the switch-based packet duplication and generation scheme and representative research work such as iMap, HyperTester, although the programmable switch can be used to generate identification packets, the core goal of the scheme is network testing, scanning or traffic generation. The packet structure generated in the related scheme is single and the content is static, which does not have the ability to generate and update multi-service identification packets, and cannot generate dynamic identification packets for different services.

[0076] Finally, the static identification scheme based on data watermark embeds the identification in the form of watermark in the original data. This scheme can only be used for responsibility tracking after data leakage, and in the data cross-border scenario, it cannot be identified during the data business traffic flow process. Therefore, this scheme cannot support multi-service identification in the data cross-border field, and it cannot obtain the business running state according to the update of the identification.

[0077] In summary, the related technology in the identification packet generation and update for data cross-border flow mainly has the following common defects:

[0078] Lack of multi-service concurrent identification capability, unable to build independent identification structure and transmission logic for different services;

[0079] The identification content is static and cannot be updated, and cannot evolve dynamically with the change of the business state, making it difficult to meet the real-time supervision needs;

[0080] With the acceleration of international data element circulation, cross-border data transmission becomes increasingly frequent in the fields of government affairs, finance, medical treatment, and industrial Internet. In order to meet the needs of business collaboration, user service and intelligent decision-making, data is constantly cross-domain flowing between multiple organizations, systems and network boundaries. However, when data crosses different legal supervision areas, network operators and security policy environments, its transmission path is complex, the nodes are not trustworthy, and the network behavior is difficult to be uniformly supervised, which brings significant challenges to data compliance, security and traceability.

[0081] In actual cross-border transmission scenarios, there are often multiple business systems concurrently sharing the same link, and different businesses have different identification granularity, supervision policies and response methods. The identification mechanism in the related technology cannot support such concurrent business environment and cannot independently identify and classify different business flows, limiting the ability to implement compliance policies according to business ownership. At the same time, data state has dynamic change characteristics, such as authorization adjustment, sensitive level improvement and business policy evolution. The existing identification method is usually static generation and lacks a synchronous update mechanism, resulting in lagging identification information and inability to accurately reflect the real-time business state of data in the cross-border flow process. Therefore, there is an urgent need for an identification generation and update mechanism that supports multi-service management and dynamic identification update to build a new identification system suitable for cross-domain cross-border data supervision.

[0082] The data cross-border service dynamic identification generation and update method provided by the embodiments of the present application is applied to a programmable switch, the programmable switch comprises a control plane and a data plane connected with each other; through the cooperation of the control plane and the data plane of the programmable switch, an identification data packet with service semantics is independently generated for each service data stream without relying on the service data body and without changing the original protocol structure, and the periodic update, state checking and stream propagation of the identification are realized, and the identifiability and controllability of cross-border data in the transmission process are comprehensively improved.

[0083] Firstly, by introducing a service registration table and an independent identification data packet mechanism, an identification data packet is allocated for each service, supporting the differentiation, identification and management of multiple services in the same transmission path, solving the problem of being unable to identify the identities of different services in a shared link, providing accurate service attribution perception ability for a regulatory system, and realizing data identification separation and policy isolation in a multi-service environment.

[0084] Secondly, a dynamic identification update mechanism based on a state field is constructed, the control plane perceives the service state change and generates a new data identification packet, and the automatic identification and replacement logic based on the state field in the data plane is used to construct the automatic update capability of the identification data packet. The mechanism enables the identification content to dynamically evolve with the adjustment of service authority and the change of policy, guarantees the timeliness and consistency of data identification, and improves the dynamic regulatory capability of the system.

[0085] In addition, the long-term residence and template management of the identification data packet are realized through the loopback path of the programmable switch, and the generation and injection of the identification data packet are realized based on the cloning mechanism, so that the identification information accompanies the service data flow to pass through multiple network boundaries and regulatory domains without changing the service data body. The mechanism can be widely adapted to various protocols and network structures, and has good deployment compatibility and scalability.

[0086] On the key path of data cross-border transmission, the service identity is identifiable, the state information is updatable, the identification behavior is controllable, and the propagation path is traceable, which significantly improves the ability of cross-domain data flow in compliance regulation, behavior audit, abnormal traceability and the like, and can meet the data security governance needs in a multi-service complex scenario.

[0087] In some embodiments, as shown in Figure 1 The data cross-border service dynamic identification generation and update method is applied to a programmable switch, the programmable switch comprises a control plane and a data plane connected with each other.

[0088] The data plane and the control plane can be deployed in one device. The data plane can correspond to one device, and the data plane can correspond to one plane. The two devices can remotely communicate to realize the multi-service dynamic identification generation and update.

[0089] In a cross-border data flow scenario, data often needs to be transmitted across multiple organizations, systems, and even national boundaries. The path is complex and variable, network nodes are scattered and difficult to trust, regulatory perspectives are limited, and it is difficult to effectively perceive the actual data flow process. The related technology faces two core challenges in this scenario: first, there is a lack of accurate identification mechanism for different services, making it difficult to separate data sources, purposes, and paths for management, and making it difficult to classify and regulate by service dimension; second, the identification method generally uses static and one-time marking methods, which cannot reflect the real-time changes of service status, making it difficult to adapt to the needs of frequent data policy adjustments, and also difficult to support the complex reality of multiple services sharing transmission paths.

[0090] To solve the above problems, the present application provides a dynamic identification generation and update method for cross-border data services, aiming to build an identification system with concurrent multi-service identification capability and state-driven update capability. The system cooperates the control plane and the data plane of the programmable switch to independently generate identification data packets with business semantics for each cross-border data flow without relying on business data ontology and without changing the original protocol structure, and to realize periodic update, state verification and stream propagation of the identification, thereby improving the identifiability and controllability of cross-border data in the transmission process.

[0091] The control plane uses its global awareness of service attributes to generate identification data packets with unique identification and version information for each service flow by maintaining a service registration table and a state field. The data plane realizes identification, residence, cloning and replacement of identification data packets based on programmable mechanism, supports long-term storage and on-demand distribution of identification template data packets, and ensures that the identification information always matches the service state. By decoupling and dynamically associating the identification data packets with the actual service flow, the present application realizes a multi-service identification generation and update mechanism in a cross-domain and cross-network environment.

[0092] First, the control plane maintains a service registration table, defines a unique service ID and service-related information (such as service source IP, service details, service running status, etc.) for each service, and dynamically generates identification data packets according to upper service policies or state changes. Each identification data packet carries the service source IP, a port field calculated by a special hash function (used to identify whether it is an identification data packet), and a state field (used to identify whether to update the identification data packet), which is used to identify its business attribution and current validity.

[0093] Then, the identification data packet is injected into the data plane of the programmable switch and is identified by matching its port segment (e.g., a hash value of the source IP calculated by a special hash function). After successful identification, it is indicated that the identification data packet needs to be permanently resident in the data plane, and the identification data packet is guided into the lo loopback port of the switch to enter the loopback path, and the identification data packet is resident in the form of a template (the identification data packet in the loopback path is also called an identification template data packet), thereby realizing persistent storage of the identification data packet in the data plane. The data plane simultaneously maintains a state field of the local multi-service identification data packet, that is, records the state field corresponding to each service, and when the control plane updates the identification data packet and reissues it, the data plane can compare the state field to determine whether the identification data packet passing through the data plane in the loopback path is the latest version, and automatically complete the elimination of the old packet and the replacement of the new packet, thereby realizing automatic updating of the identification data packet when the service changes.

[0094] Meanwhile, a plurality of service circulation queues for storing real-time information of services are designed in the data plane, and when the service data stream passes through the data plane, the system can trigger the multi-service circulation queue enqueue operation according to a preset strategy (e.g., the number of data packets reaches a threshold) to temporarily store the service flow-related information. When the identification data packet passes through the data plane again from the loopback port of the loopback path, the service circulation queue dequeue operation is triggered, and the identification data packet passing through the data plane is cloned, the header information of the cloned identification data packet copy is modified according to the target service flow, the related information (e.g., destination IP) of the target service flow is embedded, a flow identification packet is generated, and the flow identification packet is forwarded together with the target service flow, thereby realizing the generation and updating mechanism of the identification data packet with service attributes. The identification (template) data packet is still retained in the loopback path as a template for subsequent cloning, thereby constituting a closed loop of "generation-residence-cloning-updating" of the identification life cycle.

[0095] The dynamic identification generation and updating method for data cross-border services provided by the embodiment of the application realizes fine-grained classification and state synchronous updating of identification information in cross-border data streams by constructing a multi-service registration system and a state driving mechanism. One core purpose of the embodiment of the application is to provide a parallel identification mechanism for a multi-service environment, and by designing a service registration table, an identification template and a state field, an independent identification data packet can be generated for each type of cross-border service data stream, thereby realizing service-level identification isolation and classification management. Another core purpose of the embodiment of the application is to realize the dynamic updating capability of identification content, and by real-time sensing and issuing of the service state change by the control plane, the old identification packet is replaced and the new identification template is accepted in the data plane, thereby maintaining the consistency of the identification information and the current service policy, and supporting the whole life cycle management of cross-border data.

[0096] The data cross-border service dynamic identification generation and update method provided by the embodiments of the present application can support dynamic generation and update of multiple service identifications in a complex cross-border environment, improve data identifiability, path traceability and state controllability, and provide key support for compliance supervision, behavior audit and responsibility attribution of cross-border data flow. The method can be widely applied to cross-domain data exchange environments with concurrent services and frequent service state changes, has good scalability, flexibility and state awareness, and provides key support for real-time, accuracy and controllability of cross-border data identification.

[0097] The data cross-border service dynamic identification generation and update method provided by the embodiments of the present application will be described in detail below with reference to the accompanying drawings.

[0098] In some embodiments, as shown in Figure 2 The data cross-border service dynamic identification generation and update method comprises the following steps.

[0099] Step 201: Register the service by using the control plane to obtain a service registration table, create an identification data packet with an identity function for each service according to the service related information in the service registration table, and send the registered service and the identification data packet to the data plane.

[0100] In specific implementation, this step implements registration of multiple services and generation of identification data packets, and creates an identification template data packet with an identity function for different services for subsequent identification data packet generation and update.

[0101] Specifically, the control plane maintains a service registration table for recording basic information of various services, including but not limited to the following fields.

[0102] Service ID: a unique number of the service, used for indexing the service, etc.

[0103] Source IP address: IP address of the service hosting device;

[0104] Service basic information: company to which the service belongs, data information involved, data sensitivity level, etc.

[0105] Service statistical information: cumulative number of service requests, cumulative data uplink and downlink, etc.

[0106] Update flag: used for identifying the data packet update, the update flag of the identification data packet issued by the control plane is set to 1, and the update flag is set to 0 after the data plane identifies successfully and updates the identification data packet.

[0107] When the service registry is completed initialization, the control plane generates a corresponding identification template data packet according to the registration information (such as service original IP and service related information) of each service. Each identification data packet carries the service source IP, the port field (identifying whether it is an identification data packet) calculated by a special hash function, and the state field (identifying whether to update the identification data packet), which is used to identify its service attribution and current validity. The generated identification data packet is actively issued to the programmable switch data plane by the control plane and is identified as an identification data packet (identified by the port field) in the data plane. It will be used for subsequent data plane loopback residence and clone distribution operations.

[0108] Step 202: store the received service registry locally by using the data plane, direct the received identification data packet to the loopback path, and store the service traffic of the service to the service loop queue according to the service registry.

[0109] In specific implementation, this step realizes the identification data packet persistence residence based on the loopback mechanism. In order to realize the long-term effective existence and reuse of the identification data packet in the data plane, the present application realizes the identification data packet persistence residence based on the programmable switch loopback port (Loopback) mechanism. This mechanism uses the data forwarding capability of the programmable switch to direct the identification data packet to the loopback path inside the programmable switch, so that it persists in the data plane as a template data packet for subsequent cloning and injection operations.

[0110] Specifically, after the service registry enters the data plane, the service registry is stored locally for data enqueuing, data dequeuing, and identification state updating. After the identification data packet enters the data plane of the programmable switch, the data plane identifies it by matching its port field (such as the special hash value of the source port for the source IP). The port field is used to distinguish between regular data packets and identification data packets. Regular data packets are normally forwarded, and identification data packets are persistently resident. After successful identification, it is determined that the data packet is an identification data packet and needs to be persistently resident. The identified data packet is not forwarded to the external network interface, but is internally routed through the configured loopback port, i.e. the output port of the data packet is set to the loopback port of the switch loopback path, so as to direct the received identification data packet to the loopback path and make it return to the data plane for the next round of forwarding. After completing a loop, the identification data packet will continue to be forwarded through the loopback port when it is processed by the data plane again, thereby forming a closed loop residence path. This mechanism makes the identification data packet always remain in the data plane of the programmable switch without the intervention of the control plane, and has low delay, high reliability, and residence capability.

[0111] Meanwhile, in order to realize multi-service scheduling and identification sending control, a plurality of service cyclic queues are arranged in the data plane. In the cross-border data flow transfer scene, there are often a plurality of concurrent service systems sharing a transmission link or an export device. The identification injection requirements of different services are different, and may have different regulatory priorities, sending frequencies or identification strategies. Therefore, the application introduces a multi-service scheduling and identification sending control mechanism to support differential and controllable management of identification packet generation and injection for multiple services on a shared link.

[0112] Specifically, when the service traffic establishes a connection and reaches a certain condition (such as sending n data packets), an identification data packet is sent. The identification data packets sent by different services are also different, and the relevant traffic information (such as IP, port, etc.) needs to be stored in the form of service traffic to the data plane of the programmable switch. When the identification data packet passes through the data plane, the relevant traffic information is extracted, and the identification data packet is cloned and modified according to the relevant traffic information and sent out. The programmable switch stores the traffic information in the data plane in the form of a cyclic queue. Each service needs a cyclic queue, and multiple services need multiple cyclic queues.

[0113] Since the programmable switch cannot dynamically increase the cyclic queue and other data structures after startup, the application sets multiple service cyclic queues in the data plane, uses the bit splicing function of the data plane to splice the service ID and the cyclic queue index value, and forms multiple service cyclic queues. Thus, when a service is added or modified, the programmable switch can be completed without stopping. Moreover, after deleting a service, the service ID can be reused to realize the reuse of the service cyclic queue, thereby increasing the utilization rate of programmable switch resources.

[0114] When the data stream carrying the service enters the switch, it is determined whether there is a service (such as a cross-border service) that needs to be dynamically identified by looking up the service registration table (including the service ID and the service source IP, and the one-to-one correspondence between them, i.e. the service ID and the service source IP of the same service correspond one-to-one). For any service, if its task ID exists in the service registration table, it is determined that the service is a service that needs to be dynamically marked. For services that need to be dynamically identified, each service indexes a usable service cyclic queue in the service cyclic queue through the service ID, and the programmable switch does not need to be restarted to add, delete or modify the service. When each traffic of the corresponding service establishes a connection, the traffic information is put into the corresponding usable service cyclic queue every time n data packets are transmitted.

[0115] The service cyclic queue realizes unified scheduling and fine-grained control of identification injection behavior in a multi-service environment, ensures that the generation frequency and content of the identification data packet always remain consistent with the service characteristics and regulatory strategies, and is a key support for realizing multi-service state separation and policy-driven identification propagation.

[0116] Step 203: using the control plane to determine the changed service of which the service state has changed, generating a new identification data packet and a new service registration table according to the registration information, and sending the new service registration table and the new identification data packet to the data plane.

[0117] Step 204: using the data plane to store the service traffic of the changed service to the data cycle queue according to the received new service registration table, and updating the identification data packet in the loopback path according to the new state field of the received new identification data packet.

[0118] In specific implementation, steps 203-204 can realize automatic updating of the identification data packet. To cope with dynamic changes of service policy, permission or state, an automatic updating mechanism is introduced in the identification data packet system, which ensures that the identification data packet residing in the programmable switch is always consistent with the service state issued by the control plane, and meets the real-time and correctness requirements of cross-border data identification.

[0119] Specifically, when the service state changes (such as service level upgrade, compliance policy change, access authorization adjustment, etc.), the control plane will generate a new identification data packet based on the updated service information, and modify the identification information in it, such as service related information, service statistical information, update flag bit, etc. The new identification data packet is then issued by the control plane to the data plane of the programmable switch.

[0120] After receiving the new service registration table, the data plane will process the changed service according to the new service registration table to store the traffic information of the changed service to the corresponding available service cycle queue.

[0121] The data plane receives the new identification data packet, matches the service source IP in the new identification data packet to obtain the service ID, and checks the update flag. When the update flag is 1, it indicates that the identification is updated successfully, and the identification data packet needs to be updated. The state field of the corresponding service is further updated according to the new identification data packet, that is, the old state field corresponding to the identification data packet before the update is updated to the new state field corresponding to the new identification data packet. When the identification data packet passes through the data plane, if the state field of the identification data packet is the same as the state field stored in the data plane (local register), the current identification data packet is the latest version, and the loopback residence in the loopback path of the switch is continued. Otherwise, if the state field of the identification data packet is different from the state field stored in the data plane (local register), the current identification data packet is an old version of the identification data packet, and the current old version of the identification data packet is discarded. Since the state field stored in the data plane (local register) has been updated to the new state field corresponding to the service, the new identification data packet can pass the test, and the new identification data packet can be permanently resident in the loopback path. Thus, the automatic update mechanism of the identification data packet is realized.

[0122] The automatic update mechanism of the identification data packet realizes automatic identification and update logic of the identification packet state on the data plane side, without the continuous intervention of the control plane, effectively reduces the load of the control channel, ensures the rapid synchronization of the identification information of the service after the policy change, improves the accuracy and timeliness of the cross-border data identification management, and provides a dynamically consistent basic template for subsequent identification cloning and propagation.

[0123] Step 205: Determine the target template data packet passing through the data plane in the loopback path, and determine the target service traffic corresponding to the target template data packet in the service circulation queue. Clone the target template data packet to obtain an identification data packet copy, and change the header information of the identification data packet copy according to the target service traffic to obtain a flow identification packet.

[0124] Step 206: Dequeue the target service traffic in the data circulation queue, and inject the flow identification packet into the dequeued target service traffic for synchronous forwarding.

[0125] In specific implementation, steps 205-206 realize the cloning generation and flow injection of the identification data packet.

[0126] In order to realize the synchronous propagation of identification information and service traffic, so that the identification can cross multiple network boundaries, nodes and areas along with the real data path, the application designs an identification data packet injection mechanism based on data plane cloning operation. The mechanism is based on the identification (template) data packet residing in the loopback path, generates identification data packet copies on demand, and modifies the IP information of the identification data packet copies according to the target service traffic, inserts the identification data packet copies into the target service traffic for forwarding, so that the identification data packet and the service data packet have the same forwarding path, thereby realizing the accompanying propagation of identification and data.

[0127] Specifically, when the data plane passes through the service data stream, the service registration information and the matching rule in the service registration table are stored in the multi-service circular queue according to the service registration information and the matching rule. When the identification data packet passes through the data plane through the loopback port, the service ID and other information are matched, the traffic related information is taken out from the corresponding service circular queue through the service ID, and the target service traffic is dequeued. Then the identification data packet is cloned, and the original data packet continues to reside through the loopback path of the loopback network card, while the identification data packet copy is generated as identification data, and the IP information of the identification data packet copy header is modified to obtain the stream identification packet. The stream identification packet is injected into the target service traffic for synchronous forwarding, realizing the cloning generation and stream injection of the identification data packet.

[0128] In the data plane, the identification service is realized, the identification data packet is cloned, the header is modified, and the identification generation and injection process is injected and propagated. The identification data packet becomes a controllable and synchronous service identity signal, providing data identity recognition and state judgment basis for the border device.

[0129] After the identification data packet crosses the network boundary and propagates to the target system or the monitoring device along with the service traffic, it needs to be identified and analyzed to extract the service information, state field and policy metadata carried therein, for the border security device, monitoring system or compliance platform to perform audit recording, policy judgment or behavior tracing. Therefore, the application further designs an identification data packet identification and analysis mechanism suitable for border devices to ensure that the identification information is effectively perceived and utilized during the flow process.

[0130] Specifically, when the identification data packet is cloned and passed to the border device (such as firewall, border gateway, monitoring probe) along with the stream, the egress device quickly identifies the identification data packet according to the special hash value of the source IP or port field. After identifying the identification data packet, the border device decrypts and analyzes the content of the identification data packet, obtains the basic information of the target service traffic and the statistical information of the current service. Then subsequent processing is performed, such as recording audit log, performing access control, performing cross-border behavior alarm or archiving, etc.

[0131] In addition, the identification data packet can also be used as a signal input of a trigger event for starting policy evaluation on the monitoring platform, binding original service logs in the compliance system, generating a link tracking report in the upper-level supervision system, or interacting with a behavior analysis module in the data transmission system to improve overall controllability.

[0132] The data identity visibility across borders is realized, the non-intrusive identification is supported, the identity meta-information can be obtained without decrypting the service flow content, the existing security equipment can be deployed in a fusion manner, the compatibility is high, the implementation cost is low, the policy-driven flow control, auditing and accountability can be implemented according to the analysis result.

[0133] It can be seen that, compared with the related art, the present application has the following key innovations:

[0134] 1. Multi-service identification and isolation mechanism.

[0135] A service registration table is maintained through a control plane, an independent service identification (such as a service ID) and initial policy information are allocated for each service system or flow source, and an identification data packet corresponding to the service is generated. In combination with the service matching and scheduling logic in the data plane, multiple service flows can exist in parallel in a shared outbound link, the identification granularity is refined from the link level to the service level, and the resolution capability of data compliance auditing is significantly improved.

[0136] 2. State-driven identification dynamic update mechanism.

[0137] An update flag field is introduced in the identification data packet, and a data packet automatic replacement mechanism based on state field comparison in the data plane is designed. When the control plane detects that the service state changes, the automatic elimination of the old identification (template) data packet residing in the switch can be realized by constructing a new identification data packet and reissuing it, and the elimination and update of the identification template data packet in the loop path are realized, so that the identification data packet always reflects the real-time state of the current service.

[0138] 3. Persistent storage and clone distribution mechanism of identification data packet.

[0139] The loop port mechanism of the switch is used to make the identification data packet continuously reside in the data plane to form a "template packet" without repeated generation. After the actual service flow meets certain conditions (such as flow counting and time policy), the data plane can perform a cloning operation based on the template packet and generate a "flow identification packet" combined with the service context information, which is forwarded synchronously with the real service flow to realize the accompanying propagation path of the identification.

[0140] 4. Multi-service scheduling and injection control capability.

[0141] To meet the scheduling requirements in a multi-service scenario, multiple service cyclic queue structures are introduced, combined with traffic triggering conditions and policy control, to achieve flexible control of the sending frequency, timing and content of the identification data packets. This mechanism supports control capabilities such as automated scheduling and dynamic policy adjustment, improving the efficiency of identification distribution and resource utilization.

[0142] 5. Boundary identification and identification analysis capability.

[0143] The identification data packet structure includes identifiable special port segments and service source information, which enables boundary devices to quickly identify the identification data packet and extract the service identity and status without analyzing the original service traffic, providing a reliable data foundation for compliance audit, security analysis and cross-domain behavior supervision.

[0144] In summary, the present application has made breakthroughs in the structure design, state management, scheduling policy and propagation method of the data identification mechanism, forming a complete dynamic identification system that supports multi-service isolation, state-aware updating, non-intrusive propagation and boundary analysis audit, especially suitable for cross-domain and cross-border data application scenarios that require high supervision intensity, data identification accuracy and real-time performance, ensuring the safety of data propagation.

[0145] Based on the above innovations, the present application has the following beneficial effects:

[0146] Firstly, the present application realizes data identification separation and policy isolation in a multi-service environment. By introducing a service registration table and independent identification template data packet mechanism, an identification data packet is allocated for each service flow, supporting the differentiation, identification and management of multiple service flows in the same transmission path, solving the problem of identifying different service identities in a shared link, and providing accurate service attribution awareness capability for the supervision system.

[0147] Secondly, the present application has made a breakthrough in the dynamic identification updating mechanism based on the state field. By sensing the business state changes through the control plane and generating new version identification packets, combined with the automatic identification and replacement logic based on the state field in the data plane, the version updating capability of the identification data packet is constructed. This mechanism enables the identification content to dynamically evolve with changes in business permissions and policies, ensuring the timeliness and consistency of data identification and improving the dynamic supervision capability of the system.

[0148] In addition, the present application realizes long-term residence and template management of identification data packets through the switch loopback port, and generates and injects identification data packets based on the cloning mechanism, so that the identification information can accompany the business data traffic through multiple network boundaries and supervision domains without changing the business data body. This mechanism can be widely adapted to various protocols and network structures, with good deployment compatibility and scalability.

[0149] In summary, the application realizes the identifiable business identity, the updatable state information, the controllable identification behavior and the traceable propagation path on the key path of cross-border data transmission, significantly improves the ability of cross-domain data flow in compliance supervision, behavior audit, abnormal traceability, etc., and is suitable for data security governance needs in complex business scenarios such as government cloud, financial technology, industrial internet, etc.

[0150] In some embodiments, as shown in Figure 3 According to the business related information in the business registration table, an identification data packet with identity identification function is created for each business, including:

[0151] Step 301: Determine the business source IP in the business related information as the head source IP of the identification data packet;

[0152] Step 302: Hash calculation is performed on the business source IP in the business related information to obtain a hash value, and the hash value is determined as the port field of the source port of the identification data packet;

[0153] Step 303: Determine the state field of the identification data packet according to the business related state in the business related information;

[0154] Step 304: Integrate the business related information, the head source IP, the port field and the state field to obtain the identification data packet, and set the update flag position of the data packet to a preset first mark value.

[0155] In specific implementation, for example, a multinational automobile manufacturing group deploys an industrial internet platform globally, and its production base in country A needs to transmit production line data in real time to the global quality data center in country B for collaborative optimization. The platform connects more than 100 welding robots, PLC controllers and edge computing nodes, and generates TB-level heterogeneous industrial data every day. Cross-border transmission involves three core network services, and the data sensitivity differs significantly:

[0156] Business A: Global-WeldParam-Sync (global welding parameter synchronization service), real-time or quasi-real-time acquisition and transmission of vehicle body welding key process parameters (current, voltage, pressure, welding time), high sensitivity data, such as data directly bearing the core competitiveness of the enterprise, leakage will lead to the replication of core process Know-How.

[0157] Business B: CNC-Spindle-Health-Feed (spindle health state feedback service), periodic upload of high-frequency vibration spectrum and current ripple data of the spindle of the welding robot, medium sensitivity data, although it does not expose the core process, but deeply reflects the device performance boundary and fault mode, with high engineering value.

[0158] Business C; Plant-KPI-Report-Transfer (Plant KPI Report Transfer Service), transfer of aggregated and desensitized statistical indicators such as body qualification rate, equipment OEE, low sensitivity data, only for management decision support, lowest information density and sensitivity.

[0159] The process of creating an identity data packet with an identity function for each business according to the business-related information in the business registration table includes: in the control plane, the system administrator completes the registration operation for the three types of businesses respectively, constructs a business registration table, and the content includes the business ID (such as the IDs of the three businesses are 1, 2, and 3), the business source IP, the department (process group, equipment group, production management group), data sensitivity level, data information details, data statistical information, and other fields.

[0160] The controller generates three independent identity data packets according to the registration information of each business, and the source IP in the header of the identity data packet is set to the business source IP. The port field of the source port is set to the hash value obtained by hashing the business source IP, which facilitates the identification of the identity data packet by the data plane, and the addition of the corresponding table entries of the business source IP and the business ID in the business registration table in the data plane. When the identity data packet arrives at the data plane, the business ID is obtained by looking up the table through the built-in header source IP. At the same time, the state field of the identity data packet is determined according to the business-related state in the business-related information, and the state field is updated as the business state changes. Then, the business-related information, the header source IP, the port field, and the state field are integrated to obtain the identity data packet, and the update flag position of the identity data packet is set to a preset first marker value. Exemplarily, the update flag position of the identity template data packet issued by the control plane is set to the first marker value (for example, 1), and the update flag position is set to the second marker value (for example, 0) after the data plane identifies and updates the identity data packet.

[0161] In some embodiments, as shown in Figure 4 the received identity data packet is guided to a loopback path, including:

[0162] Step 401: In response to identifying the port field in the source port of the identity data packet, identifying the update flag bit of the identity data packet;

[0163] Step 402: In response to identifying the first flag value, storing the state field of the identity data packet to the local repository, and setting the output port of the identity data packet to the loopback port to configure the identity data packet to the loopback path.

[0164] In some embodiments, after setting the output port of the identity data packet to the loopback port, including:

[0165] Step 403: replacing the first flag value of the update flag bit with a preset second flag value; wherein the first flag value indicates that there is a guidance requirement, and the second flag value indicates that there is no guidance requirement.

[0166] In a specific implementation, in the data plane of the programmable switch, after receiving the identification data packets of the above three services, the identification data packets are quickly identified through the port field, it is determined that all the identification data packets need to be processed by persistent residence, and it is checked that the update flag bits of the identification data packets are all 1, then the identification data packets are looped back through the loopback port, and the state fields of the corresponding services in the local register are updated to the state fields carried by the identification data packets. The identification data packets are continuously rotated and long-term resident in the switch, and are used as service identification templates and are not forwarded to the external egress port. At this time, the identification data packets corresponding to the services A, B and C are introduced into the loopback path and long-term stored in the data plane of the switch, and wait for the arrival of the corresponding service data flow and trigger cloning.

[0167] Further, after the identification data packets corresponding to the services A, B and C are introduced into the loopback path, the replacement of the state fields in the local register is completed, and the update of the identification data packets is completed according to the replaced state fields, the automatic update and elimination of the identification data packets are realized, at this time, the first flag value (1) of the update flag bit is replaced with a preset second flag value (0); wherein the first flag value indicates that there is a guidance requirement, and the second flag value indicates that there is no guidance requirement, indicating that the identification data packets in the loopback path do not need to be updated, and the latest version of the identification data packets already exists in the loopback path.

[0168] In some embodiments, as shown in FIG. 5, storing the service traffic of the service to the service circulation queue according to the service registration table includes: Figure 5

[0169] Step 501: determining the service ID of the service;

[0170] Step 502: in response to the existence of the service ID in the service registration table, determining the available service circulation queue matching the service ID in the service circulation queue table;

[0171] Step 503: storing the related information of the service traffic to the service circulation queue when a preset storage trigger condition is met.

[0172] ​In specific implementation, each service is indexed by a service ID to a service circulation queue, and the service can be added, deleted or modified without restarting the switch. When a connection is established for each traffic of the corresponding service, the related service traffic is stored in the corresponding service circulation queue when a preset storage trigger condition is met (every n data packets are transmitted). When the identification data packet of the corresponding service loops through the data plane, it is checked whether the service circulation queue stores related information. If yes, the related traffic information is dequeued, cloned and modified to realize that an identification data packet is sent every n data packets for each traffic in each service.

[0173] For example, the real-time transmission traffic of service A is 100, and when a certain service traffic transmits to the nth data packet, the service traffic is stored in the available service circulation queue. When the identification data packet of service A loops through the data plane, the multiple service circulation queues are checked to determine the target service circulation queue storing the service traffic of service A, and the target service circulation queue is controlled to dequeue the target traffic information. Then, the identification data packet of service A is cloned, and the header information of the cloned identification data packet is modified according to the target traffic information to realize the flow-based sending control of the identification data packet.

[0174] In some embodiments, as shown in Figure 6 The identification data packet in the loopback path is updated according to the new state field of the received new identification data packet, including:

[0175] Step 601: determining the state field corresponding to the new identification data packet in the local repository according to the header source IP of the new identification data packet;

[0176] Step 602: replacing the state field in the local repository with the new state field;

[0177] Step 603: triggering a state field matching failure when the identification data packet corresponding to the change task in the loopback path passes through the data plane, eliminating the identification data packet in the loopback path, and guiding the new identification data packet to the loopback path.

[0178] In specific implementation, when the control plane issues the identification data packet, the data plane updates the state field in the internal local repository. First, the old state field corresponding to the new identification data packet is determined in the local repository according to the header source IP of the new identification data packet, and the old state field in the local repository is replaced with the new state field. When the old identification data packet passes through the loopback port, the state field is matched. Since the state field in the local repository has been updated to the new state field, the old identification data packet is eliminated because the old state field cannot complete the state field matching, and the new identification data packet can continue to reside in the loopback path by completing the matching, thereby realizing the automatic update of the identification data packet.

[0179] For example, in a certain process adjustment, the Global-WeldParam-Sync service (service A) involves a major update of the welding voltage control strategy, the sensitivity level is raised, and the control plane updates the service related information in real time to generate a new identification data packet. After the new identification data packet is sent to the data plane, the data plane updates the state field in the local register for field matching according to the new identification field of the new identification data packet. When the old identification data packet loops back to the data plane, the old state field fails to match because the state field in the local register has been updated to the new state field, which triggers the elimination of the old identification data packet, and the new identification data packet replaces the old identification data packet to implement identification residence, thereby realizing automatic update of the identification content without interrupting the traffic or manual intervention.

[0180] Using this mechanism, the statistical information in the identification data packet can be updated. For example, the total amount of data transmitted by service A to the outside increases in real time, and the statistical information in the identification data packet also needs to be updated in real time. Therefore, the identification data packet update mechanism is triggered every certain period of time or when the total amount of data transmission increases by a certain value, and a new identification data packet is updated to the data plane to ensure the accuracy of the statistical information in the identification data packet in the data plane.

[0181] In some embodiments, as shown in Figure 7 determining target service traffic corresponding to the target template data packet in the service circulation queue, including:

[0182] Step 701: determining the target service ID in the service registration table according to the source IP in the header of the target template data packet;

[0183] Step 702: determining the target circulation queue in the service circulation queue according to the target service ID, and determining the service traffic stored at the head of the target circulation queue as the target service traffic.

[0184] In specific implementation, when the target template data packet arrives at the data plane through the loopback port, the service circulation queue is checked, the target service ID is determined by searching the service registration table according to the source IP in the header of the target template data packet, the target circulation queue is determined in the service circulation queue according to the target service ID, the service traffic stored at the head of the target circulation queue is determined as the target service traffic, the target service traffic is dequeued, and the service traffic is obtained.

[0185] In some embodiments, as shown in Figure 8 changing the header information of the identification data packet copy according to the target service traffic to obtain a flow identification packet, including:

[0186] Step 801: determining the destination IP of the target service traffic;

[0187] Step 802: replace the head source IP in the packet header position of the identification data packet copy with the destination IP to obtain a flow identification packet.

[0188] In specific implementation, after the target service traffic is dequeued, the target template data packet is cloned by using the cloning mechanism of the programmable switch to obtain an identification data packet copy, and the original identification data packet corresponding to the target template data packet continues to be looped on the loopback network card. The packet header position of the identification data packet copy is dynamically modified by using the dequeued target service traffic, the head source IP in the packet header position of the identification data packet copy is replaced with the destination IP to obtain a flow identification packet, and the flow identification packet is sent to the egress consistent with the target service traffic to implement flow injection of the identification data packet together with the real traffic data to cross the border.

[0189] Exemplarily, the identification data packet of service A loops through the data plane and dequeues a piece of service traffic. The data plane of the programmable switch generates an identification data packet copy by cloning, modifies the destination IP (head source IP) of the identification data packet copy to the destination IP corresponding to the target service traffic, and makes necessary modifications to some other fields (such as check value, etc.), and finally sends to the egress of the programmable switch. The identification data packet copy can be used as a flow identification packet to implement flow injection and forwarding.

[0190] When the identification data packet copy crosses the border gateway together with the real target service traffic, after the packet type is quickly identified as an identification data packet through the hash value of some port fields, the service identification content carried in the identification data packet copy is parsed, including the company, service, data information, and sensitivity of the traffic, etc., and different strategies are executed.

[0191] Exemplarily, when the service traffic of service A crosses a certain border gateway, the service identification content carried in the corresponding identification data packet copy is parsed to know that the service traffic belongs to the Global-WeldParam-Sync service of a multinational automobile manufacturing group and belongs to high-sensitivity data, so that the traceability log is recorded, and the statistical information is checked. For example, the transmission of high-sensitivity information is limited to 1 GB, and the statistical field shows that the total amount of transmitted information exceeds 1 GB, so that an alarm is issued and an alarm log is recorded.

[0192] Through the identification generation, update, injection, and identification mechanism provided in the present application, the three types of services are respectively implemented on the switch to have clear identity distinction, real-time synchronization of policy state, controllable identification sending, and instant and accurate monitoring and identification, thereby providing controllable, auditable, and synchronized compliance technical support for data cross-border flow.

[0193] It should be noted that the method of the embodiments of the present application can be executed by a single device, for example, a computer or a server, etc. The method of the embodiments can also be applied to a distributed scenario, and be completed by multiple devices cooperating with each other. In the distributed scenario, one of the multiple devices can only execute one or more steps in the method of the embodiments of the present application, and the multiple devices can interact with each other to complete the method.

[0194] It should be noted that some embodiments of the present application are described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in a different order and still achieve desirable results. Additionally, the processes depicted in the figures do not necessarily require the particular order shown or sequential order in order to achieve the desired results. In some implementations, multitasking and parallel processing can be advantageous.

[0195] Based on the same inventive concept, the present application also provides a programmable switch corresponding to the method of any of the above embodiments.

[0196] Reference Figure 9 , the programmable switch comprises a control plane 10 and a data plane 20 connected with each other;

[0197] The control plane 10 is configured to register the services to obtain a service registration table, create an identity data packet with an identity function for each service according to the service related information in the service registration table, and send the registered services and the identity data packet to the data plane;

[0198] The data plane 20 is configured to store the received service registration table locally, guide the received identity data packet to a loopback path, and store the service traffic of the services to a service circulation queue according to the service registration table;

[0199] The control plane 10 is further configured to determine a changed service with a changed service state, generate a new identity data packet and a new service registration table according to the registration information, and send the new service registration table and the new identity data packet to the data plane;

[0200] The data plane 20 is further configured to store the service traffic of the changed service to the data circulation queue according to the received new service registration table, update the identification data packet in the loopback path according to the received new state field of the identification data packet, determine a target template data packet passing through the data plane in the loopback path, and determine target service traffic corresponding to the target template data packet in the service circulation queue, clone the target template data packet to obtain an identification data packet copy, and change the packet header information of the identification data packet copy according to the target service traffic to obtain a flow identification packet, and de-queue the target service traffic in the data circulation queue, and inject the flow identification packet into the de-queued target service traffic for synchronous forwarding.

[0201] For the convenience of description, the above apparatus is described in various modules according to functions. Of course, the functions of the modules can be implemented in one or more software and / or hardware in the implementation of the present application.

[0202] The apparatus of the above embodiments is used to implement the dynamic identification generation and update method of the corresponding data cross-border service in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here again.

[0203] Based on the same inventive concept, the present application also provides an electronic device corresponding to the method of any of the above embodiments, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the data cross-border service dynamic identification generation and update method of any of the above embodiments when executing the program.

[0204] Figure 10 A more specific hardware structure of an electronic device provided by the present embodiment is shown, which can include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040 and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030 and the communication interface 1040 are connected to each other through the bus 1050 for communication within the device.

[0205] The processor 1010 can be implemented in the form of a general-purpose CPU (Central Processing Unit, central processor), a microprocessor, an application specific integrated circuit (ASIC), or one or more integrated circuits, etc., for executing related programs to implement the technical solutions provided by the present embodiment.

[0206] The memory 1020 can be implemented in the form of a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 1020 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present specification are implemented by software or firmware, the related program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0207] The input / output interface 1030 is configured to connect an input / output module to realize information input and output. The input / output module can be configured as a component in the device (not shown in the figure) or can be externally connected to the device to provide corresponding functions. The input device can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device can include a display, a speaker, a vibrator, an indicator light, etc.

[0208] The communication interface 1040 is configured to connect a communication module (not shown in the figure) to realize the communication interaction between the device and other devices. The communication module can realize communication through a wired manner (such as a USB, a network cable, etc.) or through a wireless manner (such as a mobile network, WIFI, Bluetooth, etc.).

[0209] The bus 1050 includes a channel for transmitting information between various components (such as the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040) of the device.

[0210] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, the device can also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device can also only contain the components necessary to implement the embodiments of the present specification, and does not have to contain all the components shown in the figure.

[0211] The electronic device of the above embodiments is used to implement the dynamic identification generation and update method of the corresponding data cross-border service in any of the preceding embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here.

[0212] Based on the same inventive concept, corresponding to the method of any of the above embodiments, the present application also provides a non-transitory computer readable storage medium storing computer instructions for causing the computer to execute the dynamic identification generation and update method of the data cross-border service according to any of the above embodiments.

[0213] The computer readable medium of the embodiments can include permanent and non-permanent, removable and non-removable media, which can realize information storage by any method or technology. The information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device.

[0214] The storage medium of the above embodiments stores computer instructions for causing the computer to perform the data cross-border service dynamic identification generation and update method according to any one of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here again.

[0215] It can be understood that before using the technical solutions of various embodiments of the present application, the type, use range, use scenario, etc. of the personal information involved will be informed to the user in a proper manner, and the authorization of the user will be obtained.

[0216] For example, in response to receiving the user's active request, prompt information is sent to the user to explicitly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can voluntarily choose whether to provide personal information to the electronic device, application program, server or storage medium, etc. software or hardware that performs the operation of the technical solutions of the present application according to the prompt information.

[0217] As an optional but not limited implementation manner, in response to accepting the user's active request, the way of sending prompt information to the user may, for example, be a pop-up window manner, in which the prompt information can be presented in the form of text. In addition, the pop-up window can also carry selection controls for the user to select "agree" or "disagree" to provide personal information to the electronic device.

[0218] It can be understood that the above notification and user authorization process is only illustrative, and does not limit the implementation manner of the present application, and other ways that meet the relevant laws and regulations can also be applied to the implementation manner of the present application.

[0219] Those skilled in the art will understand that the foregoing discussion of any of the embodiments is merely illustrative of the application and is not intended to limit the scope of the application as described in the appended claims. Numerous variations and modifications will be readily apparent to those skilled in the art, and the generic principles defined herein can be applied to other embodiments without departing from the scope of the application. In addition, any one or more features of any embodiment can be combined with any one or more features of any other embodiment, or with any other known or future invented features or methods, without departing from the scope of the application.

[0220] In addition, to simplify the description and discussion, and so as not to make the embodiments of the application difficult to understand, the well-known power / ground connections to integrated circuit (IC) chips and other components can or can not be shown in the provided drawings. Further, devices can be shown in block diagram form in order to avoid making the embodiments of the application difficult to understand, and this also takes into account the fact that the details regarding the implementation of these block diagram devices are highly dependent on the platform to which the embodiments of the application are to be implemented (i.e., these details should be well within the understanding of one of ordinary skill in the art). Where specific details are set forth in order to describe an illustrative embodiment of the application, it will be apparent to one of ordinary skill in the art that the embodiments of the application can be practiced without, or with variations of, these specific details. Thus, the description is to be considered as illustrative and not restrictive, and the scope of the application is to be determined not with the assistance of the foregoing description alone.

[0221] While the application has been described in connection with specific embodiments thereof, it will be understood that many modifications, variations and alternatives will be apparent to those skilled in the art as a result of the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) can use the embodiments discussed.

[0222] It is therefore intended that the embodiments of the application embrace all such alternatives, modifications and variations as falling within the broad scope of the appended claims. Accordingly, any and all modifications, variations or equivalent alternative embodiments resulting from a combination of the features of the above-described embodiments, or from the substitution of one or more features for another, are contemplated or recognized by this disclosure and are within the scope of the application as set forth in the following claims.

Claims

1. A method for dynamic identification generation and update of data cross-border service, characterized in that, The application is applied to a programmable switch, which comprises a control plane and a data plane connected with each other; the method comprises: registering services by using the control plane to obtain a service registration table, creating an identification data packet with an identity function for each service according to service-related information in the service registration table, and sending the service registration and the identification data packet to the data plane; storing the received service registration table in the local by using the data plane, guiding the received identification data packet to a loopback path, and storing service traffic of the service to a service circulation queue according to the service registration table; determining a changed service with a changed service state by using the control plane, generating a new identification data packet and a new service registration table according to the registration information, and sending the new service registration table and the new identification data packet to the data plane; storing service traffic of the changed service to a data circulation queue according to the received new service registration table by using the data plane, and updating the identification data packet in the loopback path according to a new state field of the received new identification data packet; determining a target template data packet passing through the data plane in the loopback path, determining target service traffic corresponding to the target template data packet in the service circulation queue, cloning the target template data packet to obtain an identification data packet copy, and changing packet header information of the identification data packet copy according to the target service traffic to obtain a flow identification packet; dequeueing the target service traffic in the data circulation queue, and synchronously forwarding the flow identification packet into the dequeued target service traffic.

2. The method of claim 1, wherein, The method of creating an identification data packet with an identity function for each service according to service-related information in the service registration table comprises: determining a service source IP in the service-related information as a head source IP of the identification data packet; performing hash calculation on the service source IP in the service-related information to obtain a hash value, and determining the hash value as a port field of a source port of the identification data packet; determining a state field of the identification data packet according to a service-related state in the service-related information; integrating the service-related information, the head source IP, the port field and the state field to obtain the identification data packet, and setting an update flag position of the identification data packet to a preset first flag value.

3. The method of claim 1, wherein, The method of guiding the received identification data packet to a loopback path comprises: responding to the identification of the port field in the source port of the identification data packet, identifying an update flag position of the identification data packet; responding to the identification of the first flag value, storing a state field of the identification data packet to a local library, and setting an output port of the identification data packet as a loopback port to configure the identification data packet to the loopback path.

4. The method of claim 3, wherein, After the setting of the output port of the identification data packet as the loopback port, the method comprises: Replace the first flag value of the update flag with a preset second flag value; wherein the first flag value indicates that there is a guidance requirement, and the second flag value indicates that there is no guidance requirement.

5. The method of claim 1, wherein, The storing of the service traffic of the service into the service circulation queue according to the service register table comprises: Determining the service ID of the service; In response to the existence of the service ID in the service register table, determining the available service circulation queue matching the service ID in the service circulation queue table; When a preset storage trigger condition is met, storing the related information of the service traffic into the service circulation queue.

6. The method of claim 1, wherein, The updating of the identification data packet in the loopback path according to the new state field of the received new identification data packet comprises: Determining the state field corresponding to the new identification data packet in the local repository according to the header source IP of the new identification data packet; Replacing the state field in the local repository with the new state field; When the identification data packet corresponding to the change task in the loopback path passes through the data plane, triggering a state field matching failure, eliminating the identification data packet in the loopback path, and guiding the new identification data packet to the loopback path.

7. The method of claim 1, wherein, The determining of the target service traffic corresponding to the target template data packet in the service circulation queue comprises: Determining the target service ID in the service register table according to the header source IP of the target template data packet; Determining the target circulation queue in the service circulation queue according to the target service ID, and determining the service traffic stored at the head of the target circulation queue as the target service traffic.

8. The method of claim 1, wherein, The changing of the packet header information of the identification data packet copy according to the target service traffic to obtain a flow identification packet comprises: Determining the destination IP of the target service traffic; Replacing the header source IP in the packet header position of the identification data packet copy with the destination IP to obtain the flow identification packet.

9. A programmable switch, comprising: The system comprises a control plane and a data plane connected with each other; The control plane is configured to register a service to obtain a service register table, create an identification data packet with an identity function for each service according to service related information in the service register table, and send the service registration and the identification data packet to the data plane; The data plane is configured to store the received service register table locally, guide the received identification data packet to a loopback path, and store the service traffic of the service into a service circulation queue according to the service register table; The control plane is further configured to determine a change service with a changed service state, generate a new identification data packet and a new service register table according to the registration information, and send the new service register table and the new identification data packet to the data plane; The data plane is further configured to store the service traffic of the change service into a data circulation queue according to the received new service register table, and update the identification data packet in the loopback path according to the new state field of the received new identification data packet. Determine a target template data packet passing through the data plane in the loopback path, and determine a target service flow corresponding to the target template data packet in the service loop queue, clone the target template data packet to obtain an identification data packet copy, and change packet header information of the identification data packet copy according to the target service flow to obtain a flow identification packet. Dequeue the target service flow in the data loop queue, and inject the flow identification packet into the dequeued target service flow for synchronous forwarding.

10. An electronic device comprising a memory, a processor, and a computer program stored on the memory and running on the processor, characterized in that, The processor implements the method of any one of claims 1 to 8 when executing the program.

Images