Data processing method and device for service function chain, equipment and readable medium

Abstract

The embodiment of the invention discloses a data processing method and device for a service function chain, equipment and a readable medium. The method comprises the following steps: acquiring a plurality of service nodes contained in the service function chain to be created, a data transmission sequence of the plurality of service nodes and a target address; according to the data transmission sequence, constructing a virtual router between each service node and the next service node of each service node; respectively configuring routing information corresponding to the target address in each service node and the virtual router according to the data transmission sequence so as to form a service function chain; wherein the configured routing information is used for indicating each service node to transmit the message to be sent to the target address to the virtual router, and the virtual router transmits the message to the next service node. According to the technical scheme, the deployment difficulty of the service function chain can be reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer and communication, in particular to a data processing method of service function chain, a data processing device of service function chain, an electronic device, a computer readable storage medium and a computer program product. BACKGROUND

[0002] When data packets are transmitted in a network, they often need to pass through various service nodes (Service Function), such as firewalls (FW) and load balancers (LB), so as to ensure that the network can provide the user with safe, fast and stable services. The service nodes are logically connected to form an ordered service combination, which is a service function chain (SFC).

[0003] Currently, a network service header (NSH) is added to the packet header of the data packet, and the service nodes transmit the data packet according to the order corresponding to the service function chain based on the information indicated by the NSH, so as to implement the service function chain. This method requires that the service nodes corresponding to the service function chain support the NSH, so that the related network elements need to be modified and adapted for the NSH when the service function chain is deployed, thereby increasing the difficulty of deploying the service function chain. SUMMARY

[0004] Embodiments of the present application provide a data processing method of service function chain, a data processing device of service function chain, an electronic device, a computer readable storage medium and a computer program product, which can reduce the difficulty of deploying the service function chain.

[0005] Other characteristics and advantages of the present application will become apparent from the following detailed description, or will be learned by practice of the application.

[0006] In a first aspect, embodiments of the present application provide a data processing method of service function chain, the method comprising:

[0007] obtaining a plurality of service nodes included in a service function chain to be created, a data transmission order of the plurality of service nodes and a target address;

[0008] constructing a virtual router between each service node and the next service node of the each service node according to the data transmission order;

[0009] configuring, in each of the service nodes and the virtual router, route information corresponding to the target address according to the data transmission sequence, to form the service function chain; wherein the configured route information is used to instruct the each service node to transmit a packet to be sent to the target address to the virtual router, and the virtual router transmits the packet to the next service node.

[0010] In a second aspect, the embodiments of the present application provide another data processing method of a service function chain, the service function chain comprising a plurality of service nodes arranged in a data transmission sequence, and a virtual router deployed between each service node and a next service node of the each service node and used to connect the each service node and the next service node; the method is applied to the each service node, and the method comprises:

[0011] receiving a packet to be transmitted to a target address corresponding to the plurality of service nodes;

[0012] finding first route information corresponding to the target address from route information configured in the each service node;

[0013] transmitting the packet to the virtual router through a connection between the each service node and the virtual router according to the first route information, so that the virtual router finds second route information corresponding to the target address from route information configured in the virtual router, and transmits the packet to the next service node according to the second route information; wherein the first route information and the second route information are configured according to the data transmission sequence.

[0014] In a third aspect, the embodiments of the present application provide still another data processing method of a service function chain, the service function chain comprising a plurality of service nodes arranged in a data transmission sequence, and a virtual router deployed between each service node and a next service node of the each service node and used to connect the each service node and the next service node; the method is applied to the virtual router, and the method comprises:

[0015] receiving a packet sent by the each service node and to be transmitted to a target address corresponding to the plurality of service nodes; wherein the packet is transmitted by the each service node according to first route information corresponding to the target address;

[0016] finding second route information corresponding to the target address from route information configured in the virtual router;

[0017] According to the second routing information, the packet is transmitted to the next service node through a connection between the next service node and the packet; wherein the first routing information and the second routing information are configured according to the data transmission sequence.

[0018] In a fourth aspect, an embodiment of the present application provides a data processing apparatus of a service function chain, the apparatus comprising an obtaining unit, a constructing unit and a configuring unit, wherein:

[0019] The obtaining unit is configured to obtain a plurality of service nodes included in a service function chain to be created, a data transmission sequence of the plurality of service nodes and a target address.

[0020] The constructing unit is configured to construct a virtual router between each service node and a next service node of the each service node according to the data transmission sequence.

[0021] The configuring unit is configured to configure routing information corresponding to the target address in the each service node and the virtual router respectively according to the data transmission sequence, so as to form the service function chain; wherein the configured routing information is used to instruct the each service node to transmit a packet to be sent to the target address to the virtual router, and the virtual router transmits the packet to the next service node.

[0022] In a fifth aspect, an embodiment of the present application provides another data processing apparatus of a service function chain, the service function chain comprising a plurality of service nodes arranged according to a data transmission sequence, and a virtual router arranged between each service node and a next service node of the each service node and used to connect the each service node and the next service node; the apparatus is arranged in the each service node; the apparatus comprises a receiving unit, a searching unit and a sending unit, wherein:

[0023] The receiving unit is configured to receive a packet to be transmitted to a target address corresponding to the plurality of service nodes.

[0024] The searching unit is configured to search first routing information corresponding to the target address from routing information configured in the each service node.

[0025] The sending unit is configured to transmit the packet to the virtual router through a connection between the each service node and the virtual router according to the first routing information, so that the virtual router searches second routing information corresponding to the target address from routing information configured in the virtual router, and transmits the packet to the next service node according to the second routing information; wherein the first routing information and the second routing information are configured according to the data transmission sequence.

[0026] In a sixth aspect, an embodiment of the present application provides another data processing apparatus of a service function chain, the service function chain comprising a plurality of service nodes arranged in a data transmission order, a virtual router for connecting each service node and a next service node of the each service node being deployed between the each service node and the next service node; the apparatus is deployed in the virtual router, and the apparatus comprises a data receiving unit, an information querying unit and a data transmitting unit, wherein:

[0027] The data receiving unit is configured to receive a packet transmitted by the each service node and to be transmitted to a target address corresponding to the plurality of service nodes, wherein the packet is transmitted by the each service node according to first routing information corresponding to the target address.

[0028] The information querying unit is configured to query second routing information corresponding to the target address from routing information configured in the virtual router.

[0029] The data transmitting unit is configured to transmit the packet to the next service node through the connection between the each service node and the next service node according to the second routing information, wherein the first routing information and the second routing information are configured according to the data transmission order.

[0030] In a seventh aspect, an embodiment of the present application provides an electronic device, comprising one or more processors; a storage apparatus configured to store one or more computer programs, when the one or more computer programs are executed by the one or more processors, the electronic device is caused to implement the data processing method of the service function chain.

[0031] In an eighth aspect, an embodiment of the present application provides a computer readable storage medium, and the computer readable storage medium stores a computer program, when the computer program is executed by a processor of an electronic device, the electronic device is caused to execute the data processing method of the service function chain.

[0032] In a ninth aspect, an embodiment of the present application provides a computer program product, comprising a computer program, the computer program is stored in a computer readable storage medium, and a processor of an electronic device reads and executes the computer program from the computer readable storage medium, so that the electronic device executes the data processing method of the service function chain.

[0033] In the technical solution provided by the embodiment of the present application, a virtual router is constructed between the service nodes in the service function chain to be created, so that each service node can transmit a packet to be transmitted to a target address to the virtual router according to the configured routing information corresponding to the target address, and the virtual router can transmit the packet to the next service node according to the configured routing information corresponding to the target address, so as to realize the transmission of the packet in the service function chain according to the data transmission sequence. Compared with the traditional solution, the embodiment of the present application can effectively reduce the deployment difficulty of the service function chain by constructing the virtual router between the adjacent service nodes and configuring the routing information.

[0034] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0035] Figure 1 is a structural schematic diagram of a service function chain data processing system provided by the embodiment of the present application;

[0036] Figure 2 is a flow schematic diagram of a service function chain data processing method provided by the embodiment of the present application;

[0037] Figure 3 is a functional schematic diagram of an operation and maintenance management platform provided by the embodiment of the present application;

[0038] Figure 4 is a flow schematic diagram of another service function chain data processing method provided by the embodiment of the present application;

[0039] Figure 5 is a flow schematic diagram of still another service function chain data processing method provided by the embodiment of the present application;

[0040] Figure 6 is a structural schematic diagram of a service function chain for an internal network accessing an external network service scenario provided by the embodiment of the present application;

[0041] Figure 7 is a structural schematic diagram of a service function chain for an access virtual private cloud service scenario provided by the embodiment of the present application;

[0042] Figure 8 is a structural block diagram of a service function chain data processing device provided by the embodiment of the present application;

[0043] Figure 9 is a structural block diagram of another data processing apparatus of a service function chain provided by the application embodiment;

[0044] Figure 10 is a structural block diagram of still another data processing apparatus of a service function chain provided by the application embodiment;

[0045] Figure 11 is a structural schematic diagram of a computer system of an electronic device suitable for implementing the application embodiment. DETAILED DESCRIPTION

[0046] The exemplary embodiments will be described in detail herein below with reference to the drawings. In the following description, the same numbers refer to the same or similar elements throughout the drawings. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they only represent examples of apparatuses and methods consistent with some aspects of the present application, as detailed in the appended claims.

[0047] The block diagrams shown in the drawings are merely functional entities, and do not necessarily have to correspond to physically independent entities. That is, the functional entities can be implemented in the form of software, or in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0048] The flowcharts shown in the drawings are merely exemplary illustrations, and do not necessarily include all contents and operations, nor do they have to be executed in the order described. For example, some operations can be further divided, and some operations can be combined or partially combined, so that the actual execution order can be changed according to actual conditions.

[0049] In the application embodiments, the term "module" or "unit" refers to a computer program or a part of a computer program having a predetermined function, and works together with other related parts to achieve a predetermined target, and can be implemented entirely or partially by using software, hardware (such as a processing circuit or a memory) or a combination thereof. Similarly, one processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of an integral module or unit that includes the functions of the module or unit.

[0050] It should be noted that: in the present application, "multiple" refers to two or more than two. "And / or" describes the association between the associated objects, indicating that there may be three relationships, for example, A and / or B can represent: A alone, A and B exist together, and B alone. The character " / " generally represents the relationship between the front and rear associated objects as "or".

[0051] To meet user needs, data packets need to be transmitted in a specific order corresponding to business logic in various service nodes (Service Function), thereby forming a service function chain; these service nodes include firewalls (Firewall, FW), load balancing (Load Balancer, LB), intrusion prevention systems (Intrusion Prevention System, IPS), etc.

[0052] Currently, the main way is to select service nodes according to data transmission needs, and connect these service nodes at the logical level to quickly and flexibly build a service function chain (Service Function Chaining, SFC), so that these service nodes form an ordered service combination consistent with data transmission needs, thereby realizing the corresponding business.

[0053] In related technologies, the main way is to add a network service header (Network Service Header, NSH) in the data packet to realize data transmission between service nodes in the service function chain. Specifically, the service function chain defines classifiers, service function forwarders, service functions, and proxy network elements. In this way, when the packet is transmitted between network elements, the packet needs to be extended NSH to carry link identifiers, indexes and other data; at the same time, these network elements in the service function chain are also required to understand and operate these data carried by NSH.

[0054] In this case, the traditional network element needs to be upgraded and modified for NSH before it can be integrated into the service function chain; secondly, the addition of NSH is easy to cause the length of the packet to exceed the maximum transmission unit (Maximum Transmission Unit, MTU) in the data link layer, so that each network element and the underlying device need to process fragmented packets (i.e. MTU problem); finally, the addition of NSH makes the network service need to rely on the platform to support NSH, which also makes it difficult to introduce third-party services.

[0055] Based on this, the embodiment of the present application provides a data processing scheme of a service function chain. After obtaining a plurality of service nodes included in a service function chain to be created and a target address corresponding to the service function chain to be created, the scheme constructs a virtual router between each service node and the next service node of the service node according to a data transmission order of the plurality of service nodes; and configures routing information corresponding to the target address in each service node and the virtual router according to the data transmission order, to form the service function chain. The configured routing information is used to instruct each service node to transmit a message to be sent to the target address to the virtual router, and the virtual router transmits the message to the next service node.

[0056] As can be seen, the scheme constructs a virtual router between the service nodes in the service function chain to be created, and configures routing information for each service node and the virtual router, so that the service nodes in the service function chain and the virtual router can transmit messages in turn through the configured routing information. In this way, additional data such as NSH does not need to be added in the message, and the message can be successfully transmitted to the target address through each service node in the service function chain according to the data transmission order. Since the virtual router and routing used in the scheme are existing mature services, the service function chain can be smoothly supported without special modification. Therefore, the service nodes (including third-party service nodes that need to be introduced) of the service function chain, the forwarding nodes, and possibly the third-party service chain orchestration system in the scheme can all inherit their existing capabilities without special upgrade and modification for the service chain, and do not need to adapt to NSH related protocols to complete data transmission, thereby effectively reducing the deployment difficulty of the service function chain. In addition, the scheme completes message forwarding through the configured routing information, without adding additional data in the message, without increasing the MTU, and avoiding the problems of message fragmentation, recombination, etc. caused by MTU.

[0057] Based on the above data processing scheme of the service function chain, the embodiment of the present application provides a data processing system of a service function chain. As shown in the data processing system of the service function chain in Figure 1 , Figure 1 The data processing system of the service function chain can include a terminal device 101 and a service environment 102. The number of terminal devices 101 can include multiple terminal devices, and the service environment 102 includes a plurality of devices such as servers, virtual devices, and physical devices. A communication connection is established between any device in the terminal device 101 and the service environment 102.

[0058] For example, the terminal device 101 can include any one or more of a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart voice interaction device, a smart household appliance, a vehicle-mounted terminal, an aircraft, and a smart wearable device. The terminal device 101 can be installed with an operation and maintenance management platform for creating and managing a service function chain, and can also be installed with a live broadcast client, a shopping client, an interactive experience client, a map client, and various other clients. The servers in the service environment 102 can be servers or server clusters that provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms, and other basic cloud computing services. That is, virtual cloud resources can be provided in the service environment. The physical devices in the service environment 102 can include terminal devices such as smart phones, tablet computers, notebook computers, and desktop computers, and can also include switches and routers, without limitation. The virtual devices in the service environment 102 can be created based on network resources, cloud resources, and the like.

[0059] In some embodiments, the above data processing method of the service function chain can be executed only by Figure 1 The terminal device 101 in the data processing system of the service function chain shown in FIG. 1 can execute the above data processing method of the service function chain, and the specific execution process is as follows: the terminal device 101 can obtain a plurality of service nodes included in a service function chain to be created, a data transmission order of the plurality of service nodes, and a target address. Then, the terminal device 101 can construct a virtual router between each service node and the next service node of each service node according to the data transmission order. After that, the terminal device 101 can configure route information corresponding to the target address in each service node and the virtual router according to the data transmission order, to form a service function chain; wherein the configured route information is used to instruct each service node to transmit a message to be sent to the target address to the virtual router, and the virtual router transmits the message to the next service node; finally, the terminal device 101 can deploy the service function chain to the service environment 102.

[0060] It should be noted that the embodiments of the present application can be applied to various application scenarios that require the creation of a service function chain, including but not limited to various application scenarios such as games, cloud technologies, artificial intelligence (AI), smart cities, intelligent transportation, and assisted driving. The embodiments of the present application can also be applied to application scenarios that require data transmission, such as game applications, live broadcast applications, and shopping applications, without limitation.

[0061] In specific embodiments of this application, if routing information, network addresses, and other related data or information involve objects, when the embodiments of this application are applied to specific products or technologies, permission or consent from the objects is required, and the collection, use, and processing of related data or information must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0062] The following details the various implementation details of the technical solutions in the embodiments of this application:

[0063] like Figure 2 As shown, Figure 2 This is a flowchart illustrating a data processing method for a service function chain according to an embodiment of this application. This method can be applied to... Figure 1 The data processing system for the service function chain shown in this application embodiment is illustrated by taking the execution of the method by a terminal device (specifically, an operation and maintenance management platform running on the terminal device) as an example. The data processing method for the service function chain may include S201 to S204, which are detailed below:

[0064] S201. Obtain the multiple service nodes contained in the service function chain to be created, the data transmission order of the multiple service nodes, and the target address.

[0065] In this embodiment, the service node includes network elements that provide services such as data forwarding and data security for data transmission. For example, the service node may include a firewall (FW), a load balancer (LB), an intrusion prevention system (IPS), a gateway, etc.

[0066] Data transmission order refers to the transmission order of messages in the service function chain. Messages need to be transmitted through multiple service nodes in the service function chain according to the data transmission order of the service function chain.

[0067] The number of target addresses can be one or more, and the target addresses can be network addresses or network segments, which are not limited here.

[0068] In one embodiment, the service nodes in the service function chain, the data transmission order between service nodes, and the destination address can be configured manually or through other means, and are not limited here. Different service nodes have different service configurations, and the corresponding routing information may also be different; for example, the network address of incoming and outgoing traffic to a transparent gateway generally does not change, but that of VPNs, NATs, and load balancers usually does change.

[0069] In a specific implementation, in a service scenario of accessing an external network from an internal network, the plurality of service nodes can include an internal network gateway, a cloud firewall, and an internal-external network address translation gateway. In actual application, the internal network gateway can include a virtual private network gateway (VPN, referred to as a VPN gateway for short), and the internal-external network address translation gateway can include a network address translation gateway (NAT, referred to as a NAT gateway for short).

[0070] In a service scenario of accessing a virtual cloud resource, the plurality of service nodes can include a dedicated line gateway, a virtual private tunnel network internet gateway, and a cloud gateway. In actual application, the dedicated line gateway and the virtual private tunnel network internet gateway can both be VPN gateways, and the cloud gateway can be a cloud connect network (CCN). The CCN can be used to provide a virtual network connection across regions, and can also be used for interconnection of various gateways and connection with a virtual network. It should be noted that the above is only an example of service nodes included in a service function chain created according to data transmission requirements of two service scenarios. Different service scenarios have different data transmission requirements for service data, different data transmission requirements correspond to different service function chains, and different service function chains include different service nodes.

[0071] S202, according to the data transmission sequence, a virtual router is constructed between each service node and a next service node of each service node.

[0072] In an embodiment of the present application, the virtual router is a logical device that simulates the function of a physical router at the software and hardware layers. Optionally, in order to improve the accuracy and reliability of data transmission and simplify management, the virtual router constructed between each service node and a next service node of each service node can be used only for data transmission between each service node and the next service node, that is, the virtual router can only be configured with routing information about each service node and the next service node.

[0073] In one embodiment, the virtual router can be constructed by constructing a virtual routing and forwarding instance in a physical device. Then, the construction process of the virtual router can include: finding a next service node of each service node from the plurality of service nodes according to the data transmission sequence; finding physical devices corresponding to each service node and the next service node, and constructing a virtual routing and forwarding instance in the physical devices to obtain the virtual router; establishing a connection between each service node and the virtual router, and establishing a connection between the virtual router and the next service node. The physical devices can include switches.

[0074] Specifically, by constructing a virtual routing forwarding instance as a virtual router in a physical device, the message can be transmitted in a physical network, thereby facilitating high-speed transmission of the message, reducing transmission delay, and facilitating transmission reliability and security of the message.

[0075] In one embodiment, the virtual router can be constructed based on a virtual private cloud, and the construction process of the virtual router can include: finding a next service node of each service node from a plurality of service nodes according to a data transmission sequence; obtaining virtual private cloud resources, and constructing a virtual router based on the obtained virtual private cloud resources; establishing a connection between each service node and the virtual router, and establishing a connection between the virtual router and the next service node.

[0076] The virtual private cloud (VPC) is a dynamic configuration pool of cloud computing resources. Cloud computing is a computing mode that distributes computing tasks on a resource pool composed of a large number of computing machines, so that various application systems can obtain computing power, storage space and information services according to needs. The network that provides resources is called "cloud". The resources in the "cloud" are infinitely expandable to users and can be obtained at any time, used on demand, expanded at any time, and paid according to use.

[0077] As a basic capability provider of cloud computing, a cloud computing resource pool (referred to as a cloud platform, such as Infrastructure as a Service (IaaS)) will be established, and a plurality of types of virtual resources will be deployed in the resource pool for external customers to select and use. The cloud computing resource pool mainly includes computing devices (virtualized machines containing operating systems), storage devices, network devices, etc.

[0078] Specifically, the virtual private cloud resources are virtual configurations when they are not carrying services, and do not consume computing resources. Therefore, constructing a virtual router by using virtual private cloud resources can effectively reduce resource consumption. At the same time, the virtual private cloud also has the advantages of flexibility, high scalability, and distributed construction. Specifically, a plurality of service function chains can flexibly call virtual private cloud resources to construct a large number of virtual routers, and the specifications have almost no upper limit. This makes both the number of service function chains and the length of service function chains have greater elastic expansion capability. In addition, the virtual router is constructed by using the virtual private cloud resources in a distributed manner, which also enables the service function chain to have the ability of distributed construction, facilitating the flexible construction and elastic expansion of the service function chain.

[0079] In a specific implementation, the connection between each service node and the virtual router can be established by creating a network interface of the virtual router connected to each service node, and creating a network interface of the virtual router connected to each service node.

[0080] It should be noted that each service node in the service function chain supports establishing a connection with multiple VPCs at the same time. For example, some service nodes in the service function chain have both a previous service node and a next service node. These service nodes can build a VPC to connect with the previous service node and a VPC to connect with the next service node. That is, there are service nodes in the service function chain that are connected to two VPCs. It should be noted that the VPCs connected by the service nodes can be used to provide other services or functions for the service nodes in addition to establishing a connection between the previous service node or the next service node. The specific services or functions can be flexibly set according to actual needs.

[0081] Optionally, a virtual router can also be built in a service function chain by a virtual routing forwarding instance and a virtual private cloud resource according to resources available in the business environment. This makes the service function chain more compatible with existing network elements, which is conducive to further reducing the deployment difficulty of the service function chain.

[0082] S203, configuring routing information corresponding to the target address in each service node and the virtual router according to the data transmission sequence to form a service function chain. The configured routing information is used to instruct each service node to transmit a message to be sent to the target address to the virtual router, and the virtual router transmits the message to the next service node.

[0083] In the embodiments of the present application, the routing information corresponding to the target address includes a next hop address corresponding to the target address. The configuration process of the routing information for each service node can include: finding the next service node of each service node from the multiple service nodes according to the data transmission sequence; if each service node has a next service node, there is a virtual router between each service node and the next service node, and the next hop address corresponding to the target address can be configured in the routing information of each service node to point to the virtual router, so that each service node transmits a message to be sent to the target address (i.e., a message with a destination IP address belonging to the target address) to the virtual router according to the next hop address corresponding to the target address contained in itself. If each service node does not have a next service node, the next hop address corresponding to the target address can be configured in the routing information of each service node according to the networking architecture corresponding to each service node.

[0084] It should be noted that the service node can have its own implementation, including but not limited to routing forwarding, which is not limited here. However, regardless of the implementation, the service node needs to correctly forward the packet to the specified virtual router.

[0085] Meanwhile, the configuration process of the routing information of the virtual router can include: determining the next service node connected by the virtual router in the service function chain; generating the routing information of the virtual router based on the interface identifier of the network interface connecting the virtual router and the next service node, and the network address of the next service node. In the routing information of the virtual router, the next hop address corresponding to the target address points to the next service node.

[0086] In an embodiment, since the connection between the service node and the virtual router mentioned above is established through the network interface; therefore, under the condition that there is a next service node in each service node, the configuration process of the routing information of each service node can include: finding the target network interface connected with the virtual router from the network interfaces contained in each service node, and generating the first routing information with the next hop address corresponding to the target address being the target network interface; configuring the first routing information in each service node, so that each service node sends the packet to be sent to the target address to the virtual router through the target network interface according to the first routing information. It should be understood that different service nodes have different positions in the service function chain, and therefore the first routing information corresponding to different service nodes is different.

[0087] Optionally, the configuration process of the routing information of the virtual router can include: finding the specified network interface connected with the virtual router from the network interfaces contained in the next service node, and generating the second routing information with the next hop address corresponding to the target address being the specified network interface; configuring the second routing information in the virtual router, so that the virtual router sends the packet to be sent to the target address to the next service node through the specified network interface according to the second routing information. Optionally, the network interface connected with the next service node from the network interfaces contained in the virtual router can also be found as the specified network interface, and the second routing information with the next hop address corresponding to the target address being the specified network interface can be generated.

[0088] In an embodiment, the data transmission order of the service function chain can only contain one transmission order, under this condition, for the first transmission order and the second transmission order which are in reverse order, the service function chain corresponding to the first transmission order and the service function chain corresponding to the second transmission order are different service function chains.

[0089] In another embodiment, the data transmission order of the service function chain can include a first transmission order and a second transmission order which are inverse to each other, that is, the chain head of the service function chain can serve as the transmission starting point of the packet in the first transmission order, and the chain tail can serve as the transmission starting point of the packet in the second transmission order. Under this condition, the target address can include a first target address corresponding to the first transmission order and a second target address corresponding to the second transmission order.

[0090] In this embodiment, since the first transmission order and the second transmission order can be inverse to each other, the next service node corresponding to each service node can be determined according to the first transmission order, and a virtual router for connecting each service node and the next service node can be constructed between each service node and the next service node. Alternatively, the next service node corresponding to each service node can be determined according to the second transmission order, and a virtual router for connecting each service node and the next service node can be constructed between each service node and the next service node.

[0091] It should be noted that the virtual routers constructed between the service nodes of the service function chain according to the first transmission order can be the same as or different from the virtual routers constructed according to the second transmission order, and can also be partially the same and partially different.

[0092] In different cases of the constructed virtual routers, the service function chain constructed based on the virtual routers constructed according to the first transmission order is different from the service function chain constructed based on the virtual routers constructed according to the second transmission order. That is, the service function chain for transmitting a packet and the service function chain for transmitting a response packet of the packet can be two different service function chains, and the service nodes included in the two service function chains can also be different, which is not limited herein.

[0093] Further, the configuration process of the routing information of the virtual router can include: obtaining the routing information corresponding to the virtual router; and configuring the routing information of the virtual router according to the obtained routing information. In the routing information corresponding to the virtual router, the next hop address corresponding to the first target address points to the next service node, and the next hop address corresponding to the second target address points to each service node. That is, the same virtual router can realize bidirectional transmission by configuring the corresponding routing information.

[0094] The configuration process for routing information for each service node may include: obtaining the routing information corresponding to each service node; and configuring the routing information of the virtual router based on the obtained routing information. Specifically, in the routing information corresponding to each service node, the next-hop address corresponding to the first destination address points to the virtual router connecting each service node to the next service node in the first transmission order, and the next-hop address corresponding to the second destination address points to the virtual router connecting each service node to the next service node in the second transmission order.

[0095] For specific implementation details, please refer to the appendix. Figure 3 This illustrates a functional diagram of a management system. For example... Figure 3 As shown, the management system includes service management 301, front-end interface 302, SFC orchestrator 303, and VPC management 304; the front-end interface 302 can display basic information such as services, SFCs, and resource configurations. Among them, VPC management 304 mainly includes VPC lifecycle management and routing configuration and IP allocation within the VPC.

[0096] Meanwhile, the SFC orchestrator 303 is mainly used to orchestrate service function chains through service management 301 and VPC management 304 according to the tenant's data transmission needs and specific configuration requirements. This also includes the collaboration between service management 301 and VPC management 304, as well as the lifecycle management of service nodes.

[0097] Service Management 301 is primarily responsible for configuring the service itself and managing the service gateway. The service gateway includes service nodes, i.e., the service forwarding plane.

[0098] It is not difficult to see that Figure 3 The management system in the example constructs the service function chain by building virtual routers using SFCs. This fully leverages the renewable, infinitely expandable, and multi-tenant isolation features of VPCs during the construction process. Compared to existing solutions that require classifiers to select the service function chain for packet transmission at the tenant level, this solution utilizes the multi-tenant isolation feature of VPCs to avoid the relatively low-level, complex, and insecure operation of selecting the service function chain. This simplifies SFC construction and enhances SFC security.

[0099] In this embodiment, virtual routers are constructed between service nodes in the service function chain to be created. By configuring routing information corresponding to the target address in each service node and virtual router according to the data transmission order, packets can be transmitted in the service function chain according to the data transmission order. Compared with traditional solutions, this embodiment does not require upgrading or modifying the service nodes in the service function chain, nor does it rely on protocols such as NSH to complete data transmission. The creation and deployment of the service function chain can be completed based on existing cloud resources and network elements, thereby effectively reducing the deployment difficulty of the service function chain.

[0100] Meanwhile, the flexible and distributed expansion features of virtual routers enable the service nodes and virtual routers in the service function chain to be built and expanded in a distributed manner. This gives both the number and length of service function chains greater elastic scaling capabilities and a wider range of application prospects.

[0101] In one embodiment of this application, another data processing method for service function chains is provided, which can be applied to Figure 1 The data processing system of the service function chain shown can be executed by a terminal device or a device in the business environment, or jointly by a terminal device and a device in the business environment. In this embodiment, the method is described as being executed by a device in the business environment (specifically, a device selected as a service node in the service function chain).

[0102] The service function chain includes multiple service nodes arranged in the order of data transmission, and a virtual router is deployed between each service node and the next service node to connect each service node and the next service node.

[0103] like Figure 4 The diagram illustrates a data processing method for another service function chain. Details of steps S401 to S403 are as follows:

[0104] S401, Receive a message to be transmitted to the target address corresponding to multiple service nodes.

[0105] In this embodiment, each service function chain corresponds to a target address (i.e., the target addresses corresponding to multiple service nodes in each service function chain). After receiving a message, each service node in the service function chain can determine whether the destination IP address of the message matches the target address corresponding to the service function chain. If they match, it indicates that the message needs to be transmitted according to the data transmission order corresponding to the service function chain, and correspondingly, the message is also a message to be transmitted to the target address corresponding to the service function chain.

[0106] S402, find the first routing information corresponding to the target address from the routing information configured by each service node.

[0107] In the embodiments of the present application, each service node is configured with routing information corresponding to different addresses, and the routing information includes routing information corresponding to the target address. Each service node can find the routing information including the target address from the routing information configured by itself after receiving the packet to be transmitted to the target address, and take the found routing information as the first routing information corresponding to the target address. For example, when the packet to be transmitted to the target address is transmitted to the first service node in the service function chain, the first service node can find the routing information corresponding to the target address from the routing information included by itself, and transmit the packet to the second service node through the virtual router deployed between the first service node and the second service node according to the found routing information. Then, the packet is transmitted to the second service node, and the second service node finds the routing information corresponding to the target address from the routing information included by itself, and transmits the packet to the third service node through the virtual router deployed between the second service node and the third service node according to the found routing information, until the packet is transmitted to the target address.

[0108] S403, according to the first routing information, transmitting the packet to the virtual router through the connection between the service node and the virtual router, so that the virtual router finds the second routing information corresponding to the target address from the routing information configured by the virtual router, and transmits the packet to the next service node according to the second routing information; wherein the first routing information and the second routing information are configured according to the data transmission order.

[0109] In the embodiments of the present application, each service node can transmit the packet to the virtual router through the network interface between each service node and the virtual router. In specific implementation, the next hop address included in the found first routing information indicates the network interface of each service node connected to the virtual router; therefore, the network interface of each service node connected to the virtual router can be determined according to the first routing information, and then the packet is transmitted to the virtual router through the found network interface.

[0110] Correspondingly, after receiving the packet, the virtual router also transmits the packet to the next service node according to the routing information corresponding to the target address in the configured routing information; in this way, the packet can be transmitted according to the data transmission order in each network element in the service function chain according to the destination IP address carried by the packet.

[0111] In a possible implementation, the service node can be the last service node in the service function chain in the data transmission sequence; then, the next hop address contained in the first routing information corresponding to the target address can represent a network interface of the device connected by the service node to the device indicated by the target address; therefore, according to the first routing information, it is also possible to transmit the message to the target address through the connection between the device and the device indicated by the target address.

[0112] In the embodiment of the present application, the adjacent service nodes in the service function chain are connected through the virtual router, so that only the routing information corresponding to the target address needs to be configured in each service node and the virtual router according to the data transmission sequence required by the service function chain, and the ordered transmission of the message in the service function chain according to the data transmission sequence can be realized. Therefore, after each service node receives the message to be transmitted to the target address, the message can be forwarded to the virtual router through the routing information after the first routing information corresponding to the target address is found through simple routing query, and the relay forwarding is performed by the virtual router, so that the message can be transmitted to the target address in the service function chain according to the data transmission sequence. As can be seen, compared with the traditional scheme, the embodiment of the present application can realize the correct and ordered transmission of the message in the service function chain by constructing the virtual router and introducing the routing forwarding mode, so as to effectively reduce the deployment difficulty of the service function chain.

[0113] In an embodiment of the present application, another data processing method of the service function chain is provided, which can be applied to the data processing system of the service function chain as shown in Figure 1 The method can be executed by the terminal device or the device in the service environment, or can be executed by the terminal device and the device in the service environment together. In the embodiment of the present application, the method is executed by the device in the service environment (specifically, the device as the virtual router in the service function chain) as an example, as shown in Figure 5 Another flowchart of the data processing method of the service function chain is shown.

[0114] Among them, S501-S503 are introduced in detail as follows:

[0115] S501, receiving the message transmitted by each service node and to be transmitted to the target address corresponding to a plurality of service nodes; wherein the message is transmitted by each service node according to the first routing information corresponding to the target address.

[0116] It should be noted that in the service function chain, a virtual router is deployed between each service node and the next service node, and each service node will transmit the packet to be transmitted to the target address to the virtual router according to the first routing information corresponding to the target address contained by the service node, and correspondingly, the virtual router will receive the packet transmitted by each service node (i.e., the first service node of the two service nodes connected with the virtual router and adjacent in data transmission order) and to be transmitted to the target address. The specific implementation of step S501 can refer to the specific implementation in steps S402 to S403, which is not limited here.

[0117] S502, find the second routing information corresponding to the target address from the routing information configured by the virtual router.

[0118] In the embodiment of the present application, the virtual router deployed between each service node and the next service node is configured with routing information corresponding to different addresses, and the routing information also contains routing information corresponding to the target address. After receiving the packet to be transmitted to the target address, the virtual router finds the routing information corresponding to the target address from the routing information contained by the virtual router, and takes the found routing information as the second routing information corresponding to the target address.

[0119] S503, according to the second routing information, transmitting the packet to the next service node through the connection between the virtual router and the next service node; wherein the first routing information and the second routing information are configured according to the data transmission order.

[0120] In the embodiment of the present application, the virtual router can specifically transmit the packet to the next service node through the network interface between the virtual router and the next service node. In specific implementation, the next hop address contained in the found second routing information indicates the network interface between the virtual router and the next service node; therefore, the network interface through which the virtual router connects the next service node can be determined according to the second routing information, and then the packet is transmitted to the next service node through the found network interface.

[0121] In practical application, please refer to the accompanying drawings Figure 6 , which shows a structure diagram of a service function chain for an intranet accessing an extranet service scenario. As shown in Figure 6 , the intranet connected by the service function chain 601 refers to a tenant branch (i.e., a specific part or branch rented by a tenant in an Internet Data Center (IDC) environment), and the extranet 608 connected refers to the Internet.

[0122] As shown in Figure 6As shown, the service nodes in the service function chain 601 include VPN gateway 603 (i.e., intranet gateway), cloud firewall 605, and NAT gateway 607 (i.e., intranet / internet address translation gateway); the service nodes are interconnected through virtual routers, and a first virtual router, namely VPC-1 604, is built between VPN gateway 603 and cloud firewall 605; and a second virtual router, namely VPC-2 606, is built between cloud firewall 605 and NAT gateway 607.

[0123] Assuming tenant branch 602's network segment is 10.1.0.0 / 16, tenant branch 602 must have internal interconnection routes. Therefore, the routing information configured for tenant branch 602 includes DST = 10.1.0.0 / 16 and NEXTHOP = LOCAL. Here, LOCAL in the routing information of any network element indicates that network addresses within the corresponding network segment of that element can directly communicate with each other. For example, LOCAL in the routing information of tenant branch 602 indicates that network addresses within the corresponding network segment of tenant branch 602 can directly communicate with each other within tenant branch 602. It should be noted that the subsequent assignment of NEXTHOP is also illustrative; the value of NEXTHOP should vary depending on the actual implementation.

[0124] like Figure 6 As shown, tenant branch 602 accesses the Internet from the cloud. Tenant branch 602 connects to the cloud via IPSecVPN (Internet Protocol Security, a VPN technology for remote access). Traffic (i.e., packets) decrypted by the VPN gateway (hereinafter referred to as VPNGW) needs to be restricted and audited by the cloud firewall (hereinafter referred to as CFW), and then source address translation (such as SNAT translation, which translates the source address of the data packet into another address) is performed by the NAT gateway (hereinafter referred to as NATGW) before it can access the Internet.

[0125] Therefore, following the first transmission order in the data transmission sequence, the service function chain can be simply described as: Tenant Branch—VPNGW—CFW—NATGW—External Network, and more specifically as: Tenant Branch—VPNGW—VPC-1—CFW—VPC-2—NATGW—External Network. Here, the network address of Tenant Branch 602 is the source address corresponding to the service function chain, and the network address corresponding to External Network 608 is the destination address corresponding to the service function chain.

[0126] Correspondingly, the packet can also be transmitted from the external network to the tenant branch, and then according to the second transmission sequence in the data transmission sequence, the service function chain can be simply expressed as: external network-NATGW-CFW-VPNGW-tenant branch. The network address of the tenant branch 602 is the target address corresponding to the service function chain, and the network address corresponding to the external network 608 is the source address corresponding to the service function chain.

[0127] For convenience of description, two network interfaces of each service node can be defined by a character "L" and a character "R" respectively, corresponding to the network interface on the left side of the service node and the network interface on the right side of the service node, which will not be described in detail hereinafter. Therefore, the network interfaces of each service node in the service function chain are in turn VPNGW-L, VPNGW-R, CFW-L, CFW-R, NATGW-L and NATGW-R. Among them, VPNGW-R and CFW-L belong to VPC-1; CFW-R, NATGW-L belong to VPC-2. The network properties belonging to the network interface are subject to VPC allocation, and the business traffic complies with VPC routing and security rules.

[0128] After completing the initial construction of the service function chain 601, the routing information of each service node and virtual router in the service function chain 601 can be configured according to the data transmission sequence:

[0129] 1) The routing information configured for the tenant branch 602:

[0130] DST = 10.1.0.0 / 16, NEXTHOP = LOCAL;

[0131] DST = VPNGW, NEXTHOP = PE;

[0132] DST = 0.0.0.0 / 0, NEXTHOP = VPN;

[0133] Among them, DST = 0.0.0.0 / 0 represents the network address corresponding to the external network, which will not be described in detail hereinafter. The first routing information is used for data forwarding between terminal devices in the tenant branch and data forwarding of data packets returned from the external network through the service function chain (i.e. response packets). The first routing information may actually be different depending on the branch networking, but the function is the same.

[0134] The third routing information is used to guide the traffic (i.e., the packet) accessing the Internet to the VPN gateway local to the tenant branch for encryption, and the VPN gateway is connected to the VPNGW in the service function chain through the VPN gateway. After the tenant branch local VPN gateway is encrypted, the ciphertext destination network address of the VPN gateway is the network address of the VPNGW in the service function chain, at this time, the third routing information cannot be matched for secondary encryption, and the packet should be transferred to the provider edge (PE), i.e., the gateway of the tenant branch at the operator side. Thereafter, the ciphertext is routed and forwarded to the VPNGW in the service function chain through the operator network, and enters the VPNGW from the network interface VPNGW-L.

[0135] 2) The routing information configured for the VPN gateway 603:

[0136] DST = 10.1.0.0 / 16, NEXTHOP = VPN (VPNGW-L);

[0137] DST = 0.0.0.0 / 0, NEXTHOP = VPNGW-R;

[0138] The first routing information is used for the packet with the target address indicating the tenant branch 602, and is directed to the VPN channel for encryption. It is worth noting that the encrypted traffic from the VPNGW-L should be able to be forwarded to the Internet, so as to be forwarded to the VPN gateway of the tenant branch 602 through the external network. The second routing information is used for the packet after decryption, with the target address being the network address corresponding to the external network (accessing the external network). The packet enters the VPC-L from the VPNGW-R.

[0139] Optionally, the VPNGW can also be configured with its service function. In this scenario, the VPN channel needs to be configured for encrypted communication with the branch side.

[0140] 3) The routing information configured for the VPC-1 604:

[0141] DST = 10.1.0.0 / 16, NEXTHOP = VPNGW-R;

[0142] DST = 0.0.0.0 / 0, NEXTHOP = CFW-L;

[0143] Similar to 2), the first routing information is used to guide the packet with the target address indicating the tenant branch 602 to the VPNGW, and guide the packet with the target address indicating the external network 608 to the CFW. Here, the VPC-L mainly plays a role of connecting the service node and routing and forwarding.

[0144] 4) The routing information configured for the cloud firewall 605:

[0145] DST = 10.1.0.0 / 16, NEXTHOP = CFW-L;

[0146] DST = 0.0.0.0 / 0, NEXTHOP = CFW-R;

[0147] The first and second routing information are similar to 3) and are not repeated here. Optionally, the operator can also configure the cloud firewall configuration security policy, and can configure more granular protocols, ports, etc. The specific configuration can be performed according to the actual needs of the user. For example, the following is a security rule based on the iptables (a firewall tool) syntax:

[0148] -A FORWARD -s 10.1.0.0 / 16 -d 0.0.0.0 / 0 -j DROP;

[0149] -I FORWARD -s 10.1.3.0 / 24 -d 0.0.0.0 / 0 -j ACCEPT;

[0150] The two rules represent that only the tenant branch side terminal device in the 10.1.3.0 / 24 network segment is allowed to access the Internet.

[0151] 5) The routing information configured for VPC-2 606:

[0152] DST = 10.1.0.0 / 16, NEXTHOP = CFW-R;

[0153] DST = 0.0.0.0 / 0, NEXTHOP = NATGW-L;

[0154] Similar to VPC-1, the first routing information is used to direct the message with a target address indicating the tenant branch 602 to the CFW, and the message with a target address indicating the external network 608 to the NATGW for source address translation.

[0155] 6) The routing information configured for the NAT gateway 607:

[0156] DST = 10.1.0.0 / 16, NEXTHOP = NATGW-L;

[0157] DST = 0.0.0.0 / 0, NEXTHOP = NATGW-R;

[0158] Among them, the routing information on the NATGW is similar to the routing information on the VPC and VPNGW, and can be configured based on the network segment of the business scenario, and is not repeated here.

[0159] In addition, the NATGW itself needs to be configured with a service rule to convert the private network address on the tenant branch side into a public network address routable on the public network.

[0160] -t nat -A POSTROUTING -s 10.1.0.0 / 16 -o ethF -j SNAT --to-source external_ip;

[0161] wherein the external_ip is the converted public network address.

[0162] It is worth noting that the NATGW is usually implemented based on a stateful manner. That is, a session is generated for a request so as to process the response packet and manage the session state. After the traffic enters the public network, it is finally transferred to the target server, such as www.xxxx.com. The target server responds to the corresponding response packet according to the request, and the destination network address of the response packet is the source address in the packet converted by the NATGW.

[0163] The response packet passes through each service node in the service function chain 601 in the second transmission order (i.e., the reverse order of the foregoing example) in turn, and is finally returned to the tenant branch 602, i.e., public network - NATGW - VPC-2 - CFW - VPC-1 - VPNGW - tenant branch. Among them, the NATGW will change the destination network address and port of the response packet back to the source network address and port of the source request (i.e., the network address corresponding to the tenant branch 602 and the port corresponding to the tenant branch 602) based on the generated session, the cloud firewall 60 passes the response packet according to the firewall rule, and the VPNGW implements encryption of the response packet and transfers it to the VPN gateway on the tenant branch side through the VPN channel, and finally returns it to the source request terminal on the branch side.

[0164] At this point, the traffic to and from the internal network accessing the external network passes through the service function chain 601 composed of the VPN gateway 603, the cloud firewall 605, and the NAT gateway 604, and realizes the centralized management and control of the cloud network. The entire service function chain 601 connects the tenant branch and the public network based on the VPC, and does not use complex protocols such as NSH.

[0165] For example, please refer to the attached Figure 7 , which shows a structure diagram of a service function chain for a virtual private cloud access service scenario. As Figure 7As shown, the tenant branch needs to access multiple virtual private clouds on the cloud based on the leased line encryption, and the VPC and the tenant branch are cross-border, and the service function chain 701 is connected with the tenant branch 702 and multiple virtual private clouds (here, virtual private cloud 708 and virtual private cloud 709 are taken as examples for illustration, and in actual application, the number of virtual private clouds can be flexibly adjusted according to actual needs) at both ends. The service nodes in the service function chain 701 include a leased line gateway 703 (hereinafter referred to as DCGW, which connects the branch to provide an interconnection basic network), a VPN gateway 705 (hereinafter referred to as VPNGW, which provides an encryption function), and a CCN gateway 707 (i.e., a gateway connecting multiple VPCs and supporting cross-border, hereinafter referred to as CCNGW). A third virtual router, VPC-3 704, is constructed between the leased line gateway 703 and the VPN gateway 705; and a fourth virtual router, VPC-4 706, is constructed between the VPN gateway 705 and the CCN gateway 707.

[0166] The tenant branch and the cloud are interconnected through the DCGW, and the service function chain 701 can be expressed as: tenant branch-DCGW-VPC-3-VPNGW-VPC-4-CCNGW-virtual private cloud. Due to compliance requirements, the tenant branch needs to encrypt the traffic passing through the leased line gateway, i.e., VPN over leased line.

[0167] In this scenario, a private network segment needs to be allocated for the VPN outer layer. The network segment on the tenant branch side can be set to 10.1.0.0 / 16, the network segments of the virtual private clouds to be accessed are 10.2.0.0 / 16 and 10.3.0.0 / 16, and the network segments of the data centers and the cloud to which the VPN outer layer network address belongs are 10.1.3.0 / 24 and 172.16.0.0 / 16, respectively.

[0168] After completing the initial construction of the service function chain 701, the routing information of each service node and virtual router in the service function chain 701 can be configured according to the data transmission sequence:

[0169] 1) The routing information configured for the tenant branch 702 is:

[0170] DST = 10.1.0.0 / 16, NEXTHOP = LOCAL;

[0171] DST = 10.2.0.0 / 16, NEXTHOP = VPN GW (on the tenant branch 702 side);

[0172] DST = 10.3.0.0 / 16, NEXTHOP = VPN GW (on the tenant branch 702 side);

[0173] DST = 172.16.0.0 / 16, NEXTHOP = DCGW (tenant branch 702 side);

[0174] The route information on the tenant branch 702 side mainly functions to guide the encryption (the second and third routes described above) and guide the encrypted message to the leased line gateway (the fourth route described above, that is, the last route), so that the ciphertext with a private network address as an outer layer is sent to the leased line gateway of the service function chain 701, that is, the DCGW. The DCGW on the tenant branch 702 side interconnects with the cloud DCGW to form a leased line channel, and the private network VPN encrypted traffic reaches the cloud through the channel, realizing the function scenario of VPN over leased line.

[0175] 2) Route information configured for the leased line gateway 604:

[0176] DST = 10.1.3.0 / 24, NEXTHOP = DCGW-L;

[0177] DST = 172.16.0.0 / 16, NEXTHOP = DCGW-R;

[0178] The first route information is used to direct the VPN ciphertext traffic to the leased line gateway on the tenant branch 702 side, and the second route information is guided to VPC-3 and then to the VPNGW.

[0179] 3) Route information configured for the VPC-3 704:

[0180] DST = 10.1.3.0 / 24, NEXTHOP = DCGW-R;

[0181] DST = 172.16.0.0 / 16, NEXTHOP = LOCAL;

[0182] The first route information is similar to 2), which is used to direct the VPN ciphertext traffic to the DCGW and finally to the leased line gateway on the tenant branch 702 side, and the second route information is directed to the VPC-3 local because the outer private network of the VPNGW uses the network segment of the VPC-3, and the traffic is equivalent to forwarding in the VPC-3, so the next hop address is directed to the VPC-3 local.

[0183] 4) Route information configured for the VPN gateway 705:

[0184] DST = 10.1.0.0 / 16, NEXTHOP = VPN (VPNGW-L);

[0185] DST = 10.2.0.0 / 16, NEXTHOP = VPNGW-R;

[0186] DST = 10.3.0.0 / 16, NEXTHOP = VPN GW-R;

[0187] Similar to the previous scenario, the first route information is used for traffic destined to the tenant branch, and the packet is directed to the VPN tunnel for encryption. It is worth noting that the encrypted traffic needs to be routed out of the VPN GW-L and forwarded to VPC-3, i.e., through VPC-3 to DCGW, and finally to the VPN gateway on the tenant branch side. The second and third route information is used for packets that have decrypted and access the virtual private cloud 708 from the VPN GW-R to VPC-4.

[0188] Of course, the VPN GW also needs to be configured with its service functions. In this scenario, the VPN tunnel needs to be configured for encrypted communication with the idc side.

[0189] 5) Route information configured for VPC-4 706:

[0190] DST = 10.1.0.0 / 16, NEXTHOP = VPN GW-R;

[0191] DST = 10.2.0.0 / 16, NEXTHOP = CCNGW-L;

[0192] DST = 10.3.0.0 / 16, NEXTHOP = CCNGW-L;

[0193] The first route information is used for traffic destined to the tenant branch, and the packet is directed to the VPN GW-R for encrypted communication. The second and third route information is used for accessing the virtual private cloud 708 through the CCNGW. Therefore, the next hop address thereof is directed to the CCNGW-L.

[0194] 6) Route information configured for CCN gateway 707:

[0195] DST = 10.1.0.0 / 16, NEXTHOP = CCNGW-L;

[0196] DST = 10.2.0.0 / 16, NEXTHOP = CCNGW-R1;

[0197] DST = 10.3.0.0 / 16, NEXTHOP = CCNGW-R2;

[0198] To address the access to multiple virtual private clouds and cross-region issues, the cloud usually provides a gateway to implement this requirement, which is represented as CCNGW here. Similar to 5), the first routing information is used for traffic to the tenant branch, and the packet is directed to CCNGW-L. The second routing information is directed to virtual private cloud 708, and the third routing information is directed to virtual private cloud 709, where the network interface CCNGW-R1 and the network interface CCNGW-R2 can be the same or different.

[0199] 7) Routing information configured for virtual private cloud 708:

[0200] DST = 10.1.0.0 / 16, NEXTHOP = CCNGW-R1 (to tenant branch 702);

[0201] DST = 10.3.0.0 / 16, NEXTHOP = CCNGW-R1 (to virtual private cloud 709);

[0202] DST = 10.2.0.0 / 16, NEXTHOP = LOCAL (local to virtual private cloud 708);

[0203] Wherein virtual private cloud 708 directs the routing to tenant branch 702 to CCNGW to send the traffic to tenant branch 702 in the reverse order of service function chain 701; directs the routing to virtual private cloud 709 to CCNGW to send the traffic to virtual private cloud 709 through CCNGW; and the network segment within virtual private cloud 708 performs local communication.

[0204] 8) Routing information configured for virtual private cloud 709:

[0205] DST = 10.1.0.0 / 16, NEXTHOP = CCNGW-R2 (to tenant branch 702);

[0206] DST = 10.2.0.0 / 16, NEXTHOP = CCNGW-R2 (to virtual private cloud 708);

[0207] DST = 10.3.0.0 / 16, NEXTHOP = LOCAL (local to virtual private cloud 709);

[0208] Wherein virtual private cloud 709 directs the routing to tenant branch 702 to CCNGW to send the traffic to tenant branch 702 in the reverse order of service function chain 701, and directs the routing to virtual private cloud 708 to CCNGW to send the traffic to virtual private cloud 708 through CCNGW. The network segment within virtual private cloud 709 performs local communication.

[0209] It should be noted that the aforementioned multiple virtual private clouds (virtual private cloud 708, virtual private cloud 709, etc.) connected at both ends of the service function chain 701 can be cross-regional, and the virtual private clouds are interconnected through the CCNGW. In the CCNGW, the destination network address is configured as the address of the virtual private cloud, and the next hop address points to the route of the virtual private cloud. Thus, the service requirement of the tenant branch 702 to access multiple VPCs through VPN over leased line across borders is realized.

[0210] In the embodiment of the present application, the adjacent service nodes in the service function chain are connected through a virtual router. Thus, by configuring the routing information corresponding to the target address in each service node and the virtual router according to the data transmission order required by the service function chain, the ordered transmission of the message in the service function chain according to the data transmission order can be realized. Therefore, after the virtual router in the service function chain receives the message to be transmitted to the target address, by simply querying the routing information, the second routing information corresponding to the target address is found, and then the message is forwarded to the next service node through the routing information, and the message is continuously forwarded by the next service node, so that the message can be transmitted to the target address in the service function chain according to the data transmission order. As can be seen, compared with the traditional scheme, by constructing a virtual router and introducing a routing forwarding mode, the correct and ordered transmission of the message in the service function chain can be realized, thereby effectively reducing the deployment difficulty of the service function chain.

[0211] The device embodiment of the present application is introduced here, which can be used to execute the data processing method of the service function chain in the above-mentioned embodiments of the present application. For details not disclosed in the device embodiment of the present application, please refer to the above-mentioned embodiments of the data processing method of the service function chain.

[0212] The embodiment of the present application provides a data processing device of a service function chain, as shown in Figure 8 The device includes an acquisition unit 801, a construction unit 802, and a configuration unit 803.

[0213] The acquisition unit 801 is configured to acquire a plurality of service nodes included in a service function chain to be created, a data transmission order of the plurality of service nodes, and a target address.

[0214] The construction unit 802 is configured to construct a virtual router between each service node and the next service node of each service node according to the data transmission order.

[0215] The configuration unit 803 is configured to configure, according to the data transmission sequence, route information corresponding to the target address in each service node and a virtual router respectively, to form a service function chain; wherein the configured route information is used to instruct each service node to transmit a message to be sent to the target address to the virtual router, and the virtual router transmits the message to the next service node.

[0216] In an embodiment of the present application, based on the foregoing scheme, when the building unit 802 builds the virtual router between each service node and the next service node of each service node according to the data transmission sequence, it is specifically configured to: find the next service node of each service node from the plurality of service nodes according to the data transmission sequence; obtain a virtual private cloud resource, and build a virtual router based on the obtained virtual private cloud resource; establish a connection between each service node and the virtual router, and establish a connection between the virtual router and the next service node.

[0217] In an embodiment of the present application, based on the foregoing scheme, when the building unit 802 builds the virtual router between each service node and the next service node of each service node according to the data transmission sequence, it is specifically configured to: find the next service node of each service node from the plurality of service nodes according to the data transmission sequence; find the physical device corresponding to each service node and the next service node, and build a virtual routing and forwarding instance in the physical device to obtain the virtual router; the physical device includes a switch; establish a connection between each service node and the virtual router, and establish a connection between the virtual router and the next service node.

[0218] In an embodiment of the present application, the data transmission sequence includes a first transmission sequence and a second transmission sequence which are inverse to each other, and the target address includes a first target address corresponding to the first transmission sequence and a second target address corresponding to the second transmission sequence; based on the foregoing scheme, when the building unit 802 builds the virtual router between each service node and the next service node of each service node according to the data transmission sequence, it is specifically configured to: determine the next service node corresponding to each service node according to the first transmission sequence, and build a virtual router for connecting each service node and the next service node between each service node and the next service node. The configuration unit 803 is specifically configured to: obtain route information corresponding to the virtual router when configuring route information corresponding to the target address in each service node and the virtual router according to the data transmission sequence; wherein in the route information corresponding to the virtual router, the next hop address corresponding to the first target address points to the next service node, and the next hop address corresponding to the second target address points to each service node; and configure the route information of the virtual router according to the obtained route information.

[0219] In an embodiment of the present application, based on the foregoing scheme, the configuration unit 803, when respectively configuring the routing information corresponding to the target address in each service node and the virtual router according to the data transmission sequence, is specifically configured to: find a target network interface connected with the virtual router from the network interfaces included in each service node, and generate first routing information corresponding to the target address, in which the next hop address of the target address is the target network interface; and configure the first routing information in each service node, so that each service node transmits the packet to be sent to the target address to the virtual router through the target network interface according to the first routing information.

[0220] In an embodiment of the present application, the plurality of service nodes include an intranet gateway, a cloud firewall, and an intranet-extranet address translation gateway, and the target address includes an extranet corresponding network address; based on the foregoing scheme, the construction unit 802, when constructing the virtual router between each service node and the next service node of each service node according to the data transmission sequence, is specifically configured to: construct a first virtual router for connecting the intranet gateway and the cloud firewall between the intranet gateway and the cloud firewall, and construct a second virtual router for connecting the cloud firewall and the intranet-extranet address translation gateway between the cloud firewall and the intranet-extranet address translation gateway. The configuration unit 803, when respectively configuring the routing information corresponding to the target address in each service node and the virtual router according to the data transmission sequence, is specifically configured to: respectively configure the routing information corresponding to the target address in the intranet gateway, the first virtual router, the cloud firewall, the second virtual router, and the intranet-extranet address translation gateway according to the data transmission sequence, wherein the configured routing information is used to make the packet to be sent to the target address transmitted to the extranet through the intranet gateway, the first virtual router, the cloud firewall, the second virtual router, and the intranet-extranet address translation gateway in sequence.

[0221] In an embodiment of the present application, the plurality of service nodes sequentially comprise a private line gateway, a virtual private tunnel network Internet gateway and a cloud gateway, and the target address comprises a network address used for indicating a virtual private cloud; based on the foregoing scheme, when the constructing unit 802 constructs a virtual router between each service node and the next service node of each service node according to the data transmission sequence, the third virtual router used for connecting the private line gateway and the virtual private tunnel network Internet gateway is constructed between the private line gateway and the virtual private tunnel network Internet gateway, and the fourth virtual router used for connecting the virtual private tunnel network Internet gateway and the cloud gateway is constructed between the virtual private tunnel network Internet gateway and the cloud gateway. When the configuring unit 803 configures the routing information corresponding to the target address in each service node and the virtual router according to the data transmission sequence, the routing information corresponding to the target address is configured in the private line gateway, the third virtual router, the virtual private tunnel network Internet gateway, the fourth virtual router and the cloud gateway according to the data transmission sequence; wherein the configured routing information is used for making the packet to be sent to the target address transmitted to the virtual private cloud indicated by the target address through the private line gateway, the third virtual router, the virtual private tunnel network Internet gateway, the fourth virtual router and the cloud gateway in sequence.

[0222] It should be noted that the apparatus provided in the above embodiments and the method provided in the above embodiments belong to the same concept, and the specific manner in which each module and unit performs operations has been described in detail in the method embodiments, which will not be described here.

[0223] The apparatus provided in the above embodiments can be arranged in a terminal device or a server. The apparatus provided in the embodiments of the present application constructs a virtual router between the service nodes in the service function chain to be created, so that the packet can be transmitted in the service function chain according to the data transmission sequence by configuring the routing information corresponding to the target address in each service node and the virtual router according to the data transmission sequence. Compared with the traditional scheme, the embodiments of the present application do not require upgrading the service nodes in the service function chain, and do not need to rely on the NSH protocol to complete data transmission, thereby effectively reducing the deployment difficulty of the service function chain.

[0224] Another apparatus for processing data of a service function chain is provided in the embodiments of the present application. The service function chain comprises a plurality of service nodes arranged according to a data transmission sequence, and a virtual router used for connecting each service node and the next service node of each service node is arranged between each service node and the next service node of each service node. The apparatus is arranged in each service node. As shown in the apparatus, Figure 9 The apparatus comprises a receiving unit 901, a searching unit 902 and a sending unit 903.

[0225] The receiving unit 901 is configured to receive a packet to be transmitted to a target address corresponding to a plurality of service nodes;

[0226] The searching unit 902 is configured to search for first routing information corresponding to the target address from routing information configured by each service node.

[0227] The sending unit 903 is configured to transmit the packet to a virtual router through a connection between the sending unit 903 and the virtual router according to the first routing information, so that the virtual router searches for second routing information corresponding to the target address from routing information configured by the virtual router, and transmits the packet to a next service node according to the second routing information; wherein the first routing information and the second routing information are configured according to a data transmission sequence.

[0228] Another data processing apparatus of a service function chain is provided in the embodiments of the present application. The service function chain includes a plurality of service nodes arranged according to a data transmission sequence, and a virtual router is arranged between each service node and a next service node of each service node and is used to connect each service node and the next service node. The apparatus is arranged in the virtual router. As shown in Figure 10 The apparatus includes a data receiving unit 1001, an information searching unit 1002, and a data transmitting unit 1003.

[0229] The data receiving unit 1001 is configured to receive a packet to be transmitted to a target address corresponding to a plurality of service nodes, which is transmitted by each service node according to first routing information corresponding to the target address.

[0230] The information searching unit 1002 is configured to search for second routing information corresponding to the target address from routing information configured by the virtual router.

[0231] The data transmitting unit 1003 is configured to transmit the packet to the next service node through a connection between the data transmitting unit 1003 and the next service node according to the second routing information; wherein the first routing information and the second routing information are configured according to a data transmission sequence.

[0232] The embodiments of the present application further provide an electronic device including one or more processors and a storage device. The storage device is configured to store one or more computer programs. When the one or more computer programs are executed by the one or more processors, the electronic device implements the data processing method of the service function chain as described above.

[0233] Figure 11 A structural schematic diagram of a computer system of an electronic device suitable for implementing the embodiments of the present application is shown.

[0234] It should be noted that, Figure 11The computer system 1100 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0235] like Figure 11 As shown, the computer system 1100 includes a central processing unit (CPU) 1101, which can perform various appropriate actions and processes, such as executing the methods described in the above embodiments, based on a program stored in read-only memory (ROM) 1102 or a program loaded from storage portion 1108 into random access memory (RAM) 1103. The RAM 1103 also stores various programs and data required for system operation. The CPU 1101, ROM 1102, and RAM 1103 are interconnected via a bus 1104. An input / output (I / O) interface 1105 is also connected to the bus 1104.

[0236] In some embodiments, the following components are connected to I / O interface 1105: an input section 1106 including a keyboard, mouse, etc.; an output section 1107 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1108 including a hard disk, etc.; and a communication section 1109 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 1109 performs communication processing via a network such as the Internet. A drive 1110 is also connected to I / O interface 1105 as needed. A removable medium 1111, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 1110 as needed so that computer programs read from it can be installed into storage section 1108 as needed.

[0237] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1109, and / or installed from removable medium 1111. When the computer program is executed by processor (CPU) 1101, it performs various functions defined in the system of this application.

[0238] It should be noted that the computer-readable medium in the embodiments shown in the present application can be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium may, for example, be an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or component, or any combination of the above. More specific examples of computer-readable storage media can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (Compact Disc Read-Only Memory, CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer-readable signal medium can include a data signal propagating in a baseband or as a carrier wave in a propagated data signal, in which the computer-readable computer program is carried. Such a propagated data signal can take various forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer-readable signal medium can also be any computer-readable medium other than the computer-readable storage medium, which can send, propagate or transmit programs for use by or in connection with an instruction execution system, device or component. The computer program contained on the computer-readable medium can be transmitted by any suitable medium, including but not limited to wireless, wired, or the like, or any suitable combination of the above.

[0239] The flowcharts and block diagrams in the drawings illustrate the possible implementation architectures, functions and operations of the apparatus, method and computer program product according to various embodiments of the present application. In the flowcharts or block diagrams, each block can represent a module, a program segment or a part of code, which contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in different order than that shown in the drawings. For example, two blocks represented in succession can actually be executed substantially in parallel, and sometimes they can be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagram or flowchart, and the combination of blocks in the block diagram or flowchart, can be implemented by a dedicated hardware-based system that performs the specified functions or operations, or can be implemented by a combination of dedicated hardware and computer programs.

[0240] The units or modules involved in the embodiments of the present application can be implemented in software or hardware, and the described units or modules can also be arranged in a processor. In some cases, the names of the units or modules do not constitute a limitation on the units or modules themselves.

[0241] Another aspect of the present application also provides a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the data processing method of the service function chain as described above. The computer readable storage medium can be included in the electronic device described in the above embodiments, or can exist separately without being assembled into the electronic device.

[0242] Another aspect of the present application also provides a computer program product, which includes a computer program stored in a computer readable storage medium. The processor of the electronic device reads the computer program from the computer readable storage medium, and the processor executes the computer program to make the electronic device execute the data processing method of the service function chain as described above, which is provided in each of the above embodiments.

[0243] It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, such division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into several modules or units.

[0244] Other embodiments of the present application will be apparent to those skilled in the art from consideration of the specification and practice of the embodiments disclosed herein. The present application is intended to cover any variations, uses, or adaptations of the application following the general principles thereof and including such departures from the present disclosure as come within known use or custom in the art.

[0245] The above is only the preferred exemplary embodiments of the present application, and is not intended to limit the embodiments of the present application. Those skilled in the art can easily make corresponding changes or modifications according to the main idea and spirit of the present application, and therefore the protection scope of the present application should be subject to the protection scope required by the claims.

Claims

1. A data processing method for a service function chain, characterized in that, The method includes: Obtain the multiple service nodes contained in the service function chain to be created, the data transmission order of the multiple service nodes, and the target address; According to the data transmission order, a virtual router is constructed between each service node and the next service node of each service node; According to the data transmission order, routing information corresponding to the target address is configured in each service node and the virtual router to form the service function chain; wherein, the configured routing information is used to instruct each service node to transmit the packet to be sent to the target address to the virtual router, and the virtual router transmits the packet to the next service node.

2. The method according to claim 1, characterized in that, The step of constructing a virtual router between each service node and the next service node according to the data transmission order includes: According to the data transmission order, find the next service node from the plurality of service nodes; Acquire virtual private cloud resources, and construct the virtual router based on the acquired virtual private cloud resources; Establish a connection between each service node and the virtual router, and establish a connection between the virtual router and the next service node.

3. The method according to claim 1, characterized in that, The step of constructing a virtual router between each service node and the next service node of each service node according to the data transmission order includes: According to the data transmission order, find the next service node from the plurality of service nodes; Locate the physical device corresponding to each service node and the next service node, and construct a virtual routing forwarding instance in the physical device to obtain the virtual router; the physical device includes a switch; Establish a connection between each service node and the virtual router, and establish a connection between the virtual router and the next service node.

4. The method according to claim 1, characterized in that, The data transmission order includes a first transmission order and a second transmission order that are reversed of each other, and the destination address includes a first destination address corresponding to the first transmission order and a second destination address corresponding to the second transmission order; The step of constructing a virtual router between each service node and the next service node according to the data transmission order includes: The next service node corresponding to each service node is determined according to the first transmission order, and a virtual router for connecting each service node and the next service node is constructed between each service node and the next service node. The step of configuring routing information corresponding to the target address in each service node and the virtual router according to the data transmission order includes: Obtain the routing information corresponding to the virtual router; wherein, in the routing information corresponding to the virtual router, the next-hop address corresponding to the first target address points to the next service node, and the next-hop address corresponding to the second target address points to each service node; Configure the routing information of the virtual router based on the obtained routing information.

5. The method according to claim 1, characterized in that, The step of configuring routing information corresponding to the target address in each service node and the virtual router according to the data transmission order includes: Find the target network interface connected to the virtual router from the network interfaces contained in each service node, and generate first routing information with the next hop address of the target address as the target network interface; Configure the first routing information in each service node so that each service node sends the packet to be sent to the target address to the virtual router through the target network interface according to the first routing information.

6. The method according to any one of claims 1 to 5, characterized in that, The multiple service nodes include an intranet gateway, a cloud firewall, and an intranet / extranet address translation gateway, and the target address includes the network address corresponding to the extranet. The step of constructing a virtual router between each service node and the next service node according to the data transmission order includes: A first virtual router is constructed between the intranet gateway and the cloud firewall to connect the intranet gateway and the cloud firewall, and a second virtual router is constructed between the cloud firewall and the intranet / internet address translation gateway to connect the cloud firewall and the intranet / internet address translation gateway. The step of configuring routing information corresponding to the target address in each service node and the virtual router according to the data transmission order includes: According to the data transmission order, routing information corresponding to the target address is configured in the dedicated line gateway, the first virtual router, the cloud firewall, the second virtual router, and the internal / external network address translation gateway, respectively. The configured routing information is used to send the message to the target address to the external network through the internal network gateway, the first virtual router, the cloud firewall, the second virtual router, and the internal / external network address translation gateway in sequence.

7. The method according to any one of claims 1 to 5, characterized in that, The plurality of service nodes include, in sequence, a dedicated line gateway, a virtual private tunnel network internet gateway, and a cloud gateway, and the target address includes a network address used to indicate a virtual private cloud. The step of constructing a virtual router between each service node and the next service node according to the data transmission order includes: A third virtual router is constructed between the leased line gateway and the virtual private tunnel network gateway to connect the leased line gateway and the virtual private tunnel network gateway, and a fourth virtual router is constructed between the virtual private tunnel network gateway and the cloud gateway to connect the virtual private tunnel network gateway and the cloud gateway. The step of configuring routing information corresponding to the target address in each service node and the virtual router according to the data transmission order includes: According to the data transmission order, routing information corresponding to the target address is configured in the leased line gateway, the third virtual router, the virtual private tunnel network gateway, the fourth virtual router, and the cloud gateway, respectively; wherein, the configured routing information is used to ensure that the message to be sent to the target address is sent sequentially through the leased line gateway, the third virtual router, the virtual private tunnel network gateway, the fourth virtual router, and the cloud gateway to the virtual private cloud indicated by the target address.

8. A data processing method for a service function chain, characterized in that, The service function chain includes multiple service nodes arranged in the order of data transmission, and a virtual router deployed between each service node and the next service node of each service node; The method is applied to each of the service nodes, and the method includes: Receive messages to be transmitted to the target addresses corresponding to the multiple service nodes; From the routing information configured in each service node, find the first routing information corresponding to the target address; Based on the first routing information, the packet is transmitted to the virtual router through a connection with the virtual router, so that the virtual router can find the second routing information corresponding to the target address from the routing information configured in the virtual router, and transmit the packet to the next service node according to the second routing information; wherein, the first routing information and the second routing information are configured according to the data transmission order.

9. A data processing method for a service function chain, characterized in that, The service function chain includes multiple service nodes arranged in the order of data transmission, and a virtual router is deployed between each service node and the next service node of each service node. The method is applied to the virtual router, and the method includes: Receive a message sent by each of the service nodes, which is to be transmitted to the target address corresponding to the plurality of service nodes; wherein the message is transmitted by each service node according to the first routing information corresponding to the target address; Find the second routing information corresponding to the target address from the routing information configured in the virtual router; According to the second routing information, the message is transmitted to the next service node through a connection with the next service node; wherein the first routing information and the second routing information are configured according to the data transmission order.

10. A data processing device for a service function chain, characterized in that, The device includes an acquisition unit, a construction unit, and a configuration unit, wherein: The acquisition unit is used to acquire multiple service nodes contained in the service function chain to be created, the data transmission order of the multiple service nodes, and the target address; The construction unit is configured to construct a virtual router between each service node and the next service node of each service node according to the data transmission order. The configuration unit is configured to configure routing information corresponding to the target address in each service node and the virtual router according to the data transmission order, so as to form the service function chain; wherein the configured routing information is used to instruct each service node to transmit the packet to be sent to the target address to the virtual router, and the virtual router transmits the packet to the next service node.

11. A data processing apparatus for a service function chain, characterized in that, The service function chain includes multiple service nodes arranged in the order of data transmission, and a virtual router is deployed between each service node and the next service node for connecting each service node and the next service node. The device is deployed at each of the service nodes; the device includes a receiving unit, a searching unit, and a sending unit, wherein: The receiving unit is used to receive messages to be transmitted to the target addresses corresponding to the plurality of service nodes; The lookup unit is used to look up the first routing information corresponding to the target address from the routing information configured in each service node; The sending unit is configured to transmit the packet to the virtual router via a connection with the virtual router according to the first routing information, so that the virtual router can find the second routing information corresponding to the target address from the routing information configured in the virtual router, and transmit the packet to the next service node according to the second routing information; wherein the first routing information and the second routing information are configured according to the data transmission order.

12. A data processing device for a service function chain, characterized in that, The service function chain includes multiple service nodes arranged in the order of data transmission, and a virtual router is deployed between each service node and the next service node for connecting each service node and the next service node. The device is deployed on the virtual router, and the device includes a data receiving unit, an information querying unit, and a data transmission unit, wherein: The data receiving unit is configured to receive a message sent by each service node, which is to be transmitted to the target address corresponding to the plurality of service nodes; wherein the message is transmitted by each service node according to the first routing information corresponding to the target address; The information query unit is used to search for the second routing information corresponding to the target address from the routing information configured in the virtual router; The data transmission unit is configured to transmit the message to the next service node through a connection with the next service node according to the second routing information; wherein the first routing information and the second routing information are configured according to the data transmission order.

13. A computer-readable medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the data processing method for the service function chain as described in any one of claims 1 to 9.

14. An electronic device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the data processing method of the service function chain as described in any one of claims 1 to 9.

Images