A flow data control method, device and medium

Abstract

The present application relates to the field of cloud computing, and discloses a flow data control method, device, and medium, including: obtaining a first message and parsing the first message to obtain the source IP, destination IP, and destination MAC of the first message, so as to determine the first message category according to the IP information and MAC information of the first message and process the message. The IP information is sent to an open virtual network controller, so that the open virtual network controller determines whether the first message meets a first preset condition according to the source IP and the destination MAC. If the first preset condition is met, the first message is sent to a security network element so that the security network element can process the message securely. In this solution, the open virtual network controller determines whether the first message meets the preset condition to classify the message, and sends the message that meets the preset condition to the security network element so as to process the message securely. There is no need to install additional physical security equipment, and the system cost is low.

Description

Technical Field

[0001] The present application relates to the field of cloud computing, and in particular to a flow data control method, device, and medium. Background Art

[0002] With the development of cloud computing technology, more and more companies choose to build their own cloud platforms as internal office platforms. In application scenarios such as remote office, the business running on the cloud platform needs to connect to the external network to obtain relevant information to provide services to internal users. Therefore, the cloud platform needs to communicate with the external network, which makes the cloud platform vulnerable to external malicious attacks.

[0003] Currently, most enterprises use physical security hardware devices to process cloud platform traffic for security protection. However, this method requires planning and deployment at the network planning node, and configuration and debugging one by one. Not only is the equipment cost high, but it cannot be flexibly adjusted according to cloud platform updates.

[0004] It can be seen that how to provide a lower-cost way to process the data traffic of the cloud platform is an urgent problem that technical personnel in this field need to solve. Summary of the invention

[0005] The purpose of this application is to provide a traffic data control method, which is applied to a virtual router on an OpenStack platform, including:

[0006] Obtain a first message and parse the first message to obtain a source IP, a destination IP, and a destination MAC of the first message;

[0007] Sending the source IP, the destination IP and the destination MAC to the open virtual network controller so that the open virtual network controller determines whether the first message meets the first preset condition;

[0008] If the first preset condition is met, the first message is sent to a security network element so that the security network element can perform security processing on the first message.

[0009] Preferably, the first preset condition includes:

[0010] The source IP of the first message is a preset IP, and the destination MAC of the first message is a first preset MAC;

[0011] Or the destination IP of the first message is the preset IP and the destination MAC is not the second preset MAC.

[0012] Preferably, after the step of sending the source IP, the destination IP and the destination MAC to the open virtual network controller so that the open virtual network controller determines whether the first message meets the first preset condition, the method further includes:

[0013] If the first preset condition is not met, determining whether the first message meets a second preset condition;

[0014] If the second preset condition is met, forwarding the first message according to the destination IP;

[0015] The second preset condition includes: the destination IP of the first message is a preset IP and the destination MAC of the first message is a second preset MAC; or the source IP of the first message is a preset IP and the source MAC of the first message is a second preset MAC.

[0016] Preferably, when there are multiple security network elements in the OpenStack platform, sending the first message to the security network element includes:

[0017] Use hash algorithm to determine the target security network element;

[0018] The first message is sent to the target security network element. In order to solve the above technical problems, the present application also provides a flow data control method, which is applied to the OpenStack platform security network element, including:

[0019] Acquire a message to be processed, where the first message is a first message sent by a virtual router of the OpenStack platform, and the source IP and the destination MAC meet a first preset condition;

[0020] Performing security processing on the data in the message to be processed to generate a second message;

[0021] The second message is sent to the virtual router.

[0022] Preferably, the step of securely processing the data in the message to be processed to generate the second message includes:

[0023] Determine whether the source IP of the second message is a preset IP;

[0024] If the source IP of the second message is a preset IP, encrypting the data in the second message;

[0025] If the source IP of the second message is not the preset IP, determining whether the destination IP of the second message is the preset IP;

[0026] If the destination IP of the second message is a preset IP, a content security check and decryption operation is performed on the data in the second message.

[0027] Preferably, sending the second message to the virtual router includes:

[0028] The source MAC of the second message is changed to the MAC of the security network element, and the MAC of the second message is changed to the second preset MAC.

[0029] In order to solve the above technical problems, the present application also provides a data flow control device, which is applied to an OpenStack platform virtual router, and the device includes:

[0030] A parsing module, used to obtain a first message and parse the first message to obtain a source IP, a destination IP and a destination MAC of the first message;

[0031] A judgment module, used for sending the source IP, the destination IP and the destination MAC to the open virtual network controller, so that the open virtual network controller determines whether the first message meets the first preset condition;

[0032] A sending module is used to send the first message to a security network element so that the security network element can perform security processing on the first message if the first preset condition is met.

[0033] In order to solve the above technical problems, the present application also provides a data flow control device, including a memory for storing a computer program;

[0034] A processor is used to implement the steps of the data flow control method when executing the computer program.

[0035] In order to solve the above technical problems, the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the data flow control method are implemented.

[0036] The present application provides a method for controlling flow data, including: obtaining a first message and parsing the first message to obtain the source IP, destination IP and destination MAC of the first message, so as to determine the first message category according to the IP information and MAC information of the first message and thus process the message. The source IP, destination IP and destination MAC are sent to an open virtual network controller, so that the open virtual network controller determines whether the first message meets a first preset condition according to the source IP and destination MAC, and if the first preset condition is met, the first message is sent to a security network element so that the security network element can process the first message securely. It can be seen that in this solution, the open virtual network controller of the OpenStack platform determines whether the first message meets the preset condition to classify the message, and sends the message that meets the preset condition to the security network element so as to process the message securely. There is no need to install additional physical security equipment, and the system cost is low.

[0037] In addition, the present application also provides a flow data control device and medium, which correspond to the above method and have the same effect as above. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0039] Figure 1 A flow chart of a flow data control method provided in an embodiment of the present application;

[0040] Figure 2 A flow chart of traffic data forwarding provided in an embodiment of the present application;

[0041] Figure 3 A flow chart of a flow data control method provided in an embodiment of the present application;

[0042] Figure 4 A structural diagram of a data flow control device provided in an embodiment of the present application;

[0043] Figure 5 A structural diagram of a flow data control device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0045] The core of this application is to provide a flow data control method, device, and medium to reduce the equipment cost for secure processing of cloud platform flow data.

[0046] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0047] In the cloud platform working scenario, the cloud computing platform needs to be connected to the external network for data exchange, which causes the cloud computing platform to face the security risk of external network attacks. In order to solve this problem, the present application provides a flow data control method, which is applied to the virtual router and security network element of the OpenStack platform, and the message status is judged by the open virtual network controller to classify and process the message. Specifically, it includes obtaining a first message and parsing the first message to obtain the source IP, destination IP and destination MAC of the first message, so as to determine the first message category according to the IP information and MAC information of the first message and process the message. The source IP, destination IP and destination MAC are sent to the open virtual network controller, so that the open virtual network controller determines whether the first message meets the first preset condition according to the source IP and destination MAC. If the first preset condition is met, the first message is sent to the security network element so that the security network element can safely process the first message. It can be seen that in this scheme, the open virtual network controller of the OpenStack platform determines whether the first message meets the preset condition to classify the message, and sends the message that meets the preset condition to the security network element so as to safely process the message. There is no need to install additional physical security equipment, and the system cost is low.

[0048] Figure 1 A flow chart of a traffic data control method provided in an embodiment of the present application, the method is applied to a virtual router of an OpenStack platform, such as Figure 1 As shown, the method includes:

[0049] S10: Obtain a first message and parse the first message to obtain a source IP, a destination IP, and a destination MAC of the first message.

[0050] The first message includes two types: an access message sent by a virtual machine in the cloud platform to access an external network and a response message from the external network to the cloud platform request. The source IP of the access message is the IP address of the subnet where the virtual machine is located, the target IP is the IP address of the accessed external network, the source MAC is the MAC address of the subnet where the virtual machine is located, and the target MAC is the MAC address of the network segment where the router is located.

[0051] Figure 2 A flow chart of traffic data forwarding provided in an embodiment of the present application, such as Figure 2 As shown, the dotted line is the north-south wandering forwarding path without the injection of security services. The router matches the destination IP address, forwards the message, and accesses the external network. The solid line is the traffic forwarding path after adding the security service injection function. The source IP address and destination MAC in the message are matched in the router, and the traffic that meets the first preset condition is forwarded to the security network element virtual machine. After the security network element processes the message, it is forwarded to the router again. The router forwards the traffic data to the external network according to the destination IP address.

[0052] In a specific implementation, after the router obtains a request message sent by the cloud computing platform virtual machine or a response message sent by the external network, it parses the first message to obtain information such as the source IP, destination IP and destination MAC, and request data of the first message.

[0053] S11: Send the source IP, destination IP and destination MAC to the open virtual network controller, so that the open virtual network controller determines whether the first message meets the first preset condition.

[0054] S12: If the first preset condition is met, the first message is sent to the security network element so that the security network element can perform security processing on the first message.

[0055] In a specific implementation, the first preset condition can be data predetermined by the cloud platform operation and maintenance personnel, or can be user-defined data. It is understandable that since the virtual machines in the cloud computing platform are updated frequently, their IP information and MAC information change quickly. If the corresponding relationship between the security network element and the virtual machine and the router is manually configured, the user's workload will increase. Therefore, a corresponding interface function can be pre-set in the OpenStack cloud environment, and the user can update the first preset condition by calling the interface function.

[0056] In this embodiment, in order to more conveniently determine whether the first message meets the first preset condition, an open virtual network controller is selected to determine the first message. The first preset condition includes: the source IP of the first message is a preset IP, the destination MAC of the first message is a first preset MAC; or the destination IP of the first message is a preset IP and the destination MAC is not a second preset MAC. Specifically, based on the policy routing function of the open virtual network controller, after receiving the message, the virtual router first determines the destination IP and destination MAC of the message. If the first delivery policy of the virtual router is matched, it is determined that the message is forwarded from the security network element to the router, and the message is forwarded to the virtual machine corresponding to the target IP. If the first delivery policy is not matched, the source IP address and destination MAC of the message are judged. If the second delivery policy of the virtual router is matched, it is determined that the message is a message for the internal virtual machine of the cloud platform to access the external network, and the message is forwarded to the security network element. If the second delivery policy is not matched, the destination IP of the message is judged. If the third delivery policy is matched, it is determined that the message is a message for accessing the internal virtual machine from the external network, and the message is forwarded to the security network element.

[0057] The present application provides a method for controlling flow data, including: obtaining a first message and parsing the first message to obtain the source IP, destination IP and destination MAC of the first message, so as to determine the first message category according to the IP information and MAC information of the first message and thus process the message. The source IP, destination IP and destination MAC are sent to an open virtual network controller, so that the open virtual network controller determines whether the first message meets a first preset condition according to the source IP and destination MAC, and if the first preset condition is met, the first message is sent to a security network element so that the security network element can process the first message securely. It can be seen that in this solution, the open virtual network controller of the OpenStack platform determines whether the first message meets the preset condition to classify the message, and sends the message that meets the preset condition to the security network element so as to process the message securely. There is no need to install additional physical security equipment, and the system cost is low.

[0058] As a preferred embodiment, the first preset condition includes: the source IP of the first message is a preset IP, the destination MAC of the first message is a first preset MAC; or the destination IP of the first message is a preset IP and the destination MAC is not a second preset MAC.

[0059] In a specific implementation, if the source IP of the first message is a preset IP, and the destination MAC of the first message is the first preset MAC, it indicates that the message is a message for a virtual machine in the cloud computing platform to access an external network; if the destination IP of the first message is a preset IP and the destination MAC is not the second preset MAC, it indicates that the message is a message for an external network to access a virtual machine. In order to ensure the information security of the cloud computing platform, messages that meet the first preset condition need to be sent to a secure network element so that the secure network element can process the message securely.

[0060] It should be noted that the first preset MAC mentioned in this application is the MAC of the designated subnet gateway, and the second preset MAC is the MAC of the subnet gateway where the security network element is located.

[0061] It is understandable that the cloud computing platform is used to provide virtual machines for different users, and different users have different requirements for the security of the cloud computing platform. If all the messages of the virtual machines are processed securely, it may cause excessive workload of the security network element and waste computing resources. In order to solve this problem, in this embodiment, only the virtual machines whose source IP is the preset IP and source MAC is the preset MAC are processed securely.

[0062] In the specific implementation, the virtual machine sends the message accessing the external network to the virtual machine router of the cloud computing platform. The virtual router first performs conventional routing according to the destination IP, and then matches whether the source IP address is an IP address within the specified subnet segment, and whether the destination MAC is the MAC of the specified subnet gateway. If a match is found, the next hop destination address of the message is set to the address of the security network element virtual machine and forwarded. After the message responded by the external network enters the cloud platform, it first reaches the router. If the policy routing matches that the destination IP address of the message is the IP of the specified subnet, rerouting is performed, and the next hop destination of the message is set to the security network element and forwarded to the security network element virtual machine.

[0063] In this embodiment, by setting the first preset condition that the source IP of the first message is the preset IP and the destination MAC of the first message is the first preset MAC; or the destination IP of the first message is the preset IP and the destination MAC is not the second preset MAC, the messages of the virtual machine accessing the external network and the messages of the external network accessing the virtual machine are sent to the security network element to facilitate harmless processing of the messages.

[0064] As a preferred embodiment, after the step of sending the source IP, destination IP and destination MAC to the open virtual network controller so that the open virtual network controller determines whether the first message meets the first preset condition, it also includes: if the first preset condition is not met, determining whether the first message meets the second preset condition; if the second preset condition is met, forwarding the first message according to the destination IP; the second preset condition includes: the destination IP of the first message is a preset IP and the destination MAC of the first message is a second preset MAC; or the source IP of the first message is a preset IP and the source MAC of the first message is a second preset MAC.

[0065] In a specific implementation, in addition to accepting the request sent by the virtual machine to access the external network, the virtual router also needs to send the message that has been securely processed by the security network element to the target virtual machine or the external network. It can be understood that when the message does not meet the first preset condition, if the destination IP of the first message is the preset IP and the destination MAC of the first message is the second preset MAC, it indicates that the first message is a message from the external network to access the cloud computing platform; or if the source IP of the first message is the preset IP and the source MAC of the first message is the second preset MAC, it indicates that the first message is a message to access the external network.

[0066] It is understandable that in order to ensure that the cloud computing system can work normally when there are a large number of messages, multiple security network elements need to be set in the cloud computing platform. When there are multiple security network elements in the OpenStack platform, sending the first message to the security network element includes: using a hash algorithm to determine a target security network element, and sending the first message to the target security network element.

[0067] Figure 3 A flow chart of a traffic data control method provided in an embodiment of the present application is applied to a security network element of an OpenStack platform, such as Figure 3 As shown, the method includes:

[0068] S20: Acquire a message to be processed, where the first message is a first message sent by the virtual router of the OpenStack platform, and the source IP and the destination MAC meet a first preset condition;

[0069] S21: performing security processing on the data in the message to be processed to generate a second message;

[0070] S22: Send the second message to the virtual router.

[0071] After the message arrives at the security network element, the data in the message is first securely processed to produce a second message, and then the second message is forwarded to the router. The security network element does not change the destination IP and source IP of the message, but only changes the source MAC and destination MAC of the message. At this time, the source MAC of the message is the MAC of the security network element, and the destination MAC is the MAC of the subnet gateway where the security network element is located.

[0072] After the message arrives at the router, the policy routing matches the destination IP address as an address in the specified business subnet, and the destination MAC is the MAC of the gateway of the subnet where the security network element is located. The release action is executed without any processing, and the message is forwarded to the destination virtual machine according to the destination IP. At this point, all routing for message forwarding is completed.

[0073] This embodiment provides a traffic data control method for north-south security service injection based on OpenStack, which is applicable to the OpenStack cloud environment using OVN on the control plane. It takes advantage of the fact that north-south traffic needs to pass through the virtual machine router and uses OVN's policy routing to import north-south traffic into the security network element virtual machine, thereby achieving the effect of security network element injection. This invention can allow the cloud platform to access the third-party security network element to ensure the security of north-south data, and also provides the function of load balancing of multiple security network elements, which can greatly improve the bandwidth of security services and meet the iterative upgrade of customers' bandwidth requirements.

[0074] The present application provides a method for controlling flow data, including: obtaining a first message and parsing the first message to obtain the source IP, destination IP and destination MAC of the first message, so as to determine the first message category according to the IP information and MAC information of the first message and thus process the message. The source IP, destination IP and destination MAC are sent to an open virtual network controller, so that the open virtual network controller determines whether the first message meets a first preset condition according to the source IP and destination MAC, and if the first preset condition is met, the first message is sent to a security network element so that the security network element can process the first message securely. It can be seen that in this solution, the open virtual network controller of the OpenStack platform determines whether the first message meets the preset condition to classify the message, and sends the message that meets the preset condition to the security network element so as to process the message securely. There is no need to install additional physical security equipment, and the system cost is low.

[0075] As a preferred embodiment, performing security processing on the data in the message to be processed to generate the second message includes: determining whether the source IP of the second message is a preset IP;

[0076] If the source IP of the second message is the preset IP, the second message is a message for the virtual machine to access the external network, and the data in the second message is encrypted;

[0077] If the source IP of the second message is not the preset IP, determining whether the destination IP of the second message is the preset IP;

[0078] If the destination IP of the second message is a preset IP, the second message is a message for an external network to access a virtual machine in a cloud computing platform, and a content security check and decryption operation are performed on the data in the second message.

[0079] In the above embodiments, the data flow control method is described in detail, and the present application also provides embodiments corresponding to the data flow control device. It should be noted that the present application describes the embodiments of the device part from two perspectives, one is based on the functional module perspective, and the other is based on the hardware perspective.

[0080] Figure 4 A structural diagram of a data flow control device provided in an embodiment of the present application is applied to a virtual router of an OpenStack platform, such as Figure 4 As shown, the device comprises:

[0081] The parsing module 10 is used to obtain a first message and parse the first message to obtain a source IP, a destination IP and a destination MAC of the first message.

[0082] The judgment module 11 is used to send the source IP, the destination IP and the destination MAC to the open virtual network controller, so that the open virtual network controller can judge whether the first message meets the first preset condition.

[0083] The sending module 12 is used to send the first message to the security network element so that the security network element can perform security processing on the first message if a first preset condition is met.

[0084] The specific process of the data flow control device provided in this embodiment processing a message includes:

[0085] When a message sent by a virtual machine to access the external network arrives at the router, the router first performs conventional routing based on the destination IP, and then matches whether the source IP address is an IP address within the specified subnet segment, and whether the destination MAC is the MAC of the specified subnet gateway. If a match is found, the next-hop destination address of the message is set to the address of the security network element virtual machine and forwarded. If multiple security network elements are used for load balancing, one is selected as the next hop based on the message information through a hash algorithm.

[0086] After the external network response message enters the cloud platform, it first reaches the router. If the policy routing matches the destination IP address of the message to the IP of the specified subnet, it will reroute and set the next hop destination of the message to the secure network element and forward it to the secure network element virtual machine. If multiple secure network elements are used for load balancing, one is selected as the next hop based on the message information through the hash algorithm.

[0087] After the message arrives at the security network element, the data in the message is first processed securely and then forwarded to the router. The security network element does not change the destination IP and source IP of the message, but only changes the source MAC and destination MAC of the message. At this time, the source MAC of the message is the MAC of the security network element, and the destination MAC is the MAC of the subnet gateway where the security network element is located.

[0088] After the message arrives at the router, the policy routing matches the destination F address as an address within the specified business subnet, and the destination MAC is the MAC of the gateway of the subnet where the security network element is located. The release action is executed without any processing, and the message is forwarded to the destination virtual machine according to the destination IP. At this point, all routing for message forwarding is completed.

[0089] Since the embodiments of the apparatus part correspond to the embodiments of the method part, please refer to the description of the embodiments of the method part for the embodiments of the apparatus part, which will not be repeated here.

[0090] The present application provides a flow data control device, including: obtaining a first message and parsing the first message to obtain the source IP, destination IP and destination MAC of the first message, so as to determine the first message category according to the IP information and MAC information of the first message and process the message. The source IP, destination IP and destination MAC are sent to an open virtual network controller, so that the open virtual network controller determines whether the first message meets the first preset condition according to the source IP and destination MAC. If the first preset condition is met, the first message is sent to a security network element so that the security network element can process the first message securely. It can be seen that in this solution, the open virtual network controller of the OpenStack platform determines whether the first message meets the preset condition to classify the message, and sends the message that meets the preset condition to the security network element so as to process the message securely. There is no need to install additional physical security equipment, and the system cost is low.

[0091] Figure 5 A structural diagram of a flow data control device provided in another embodiment of the present application is shown in FIG. Figure 5 As shown, the flow data control device comprises: a memory 20 for storing a computer program;

[0092] The processor 21 is used to implement the steps of the flow data control method in the above embodiment when executing the computer program.

[0093] The terminal device provided in this embodiment may include but is not limited to a smart phone, a tablet computer, a laptop computer or a desktop computer.

[0094] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 can be implemented in at least one hardware form of a digital signal processor (DSP), a field-programmable gate array (FPGA), and a programmable logic array (PLA). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a central processing unit (CPU); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a graphics processing unit (GPU), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an artificial intelligence (AI) processor, which is used to process computing operations related to machine learning.

[0095] The memory 20 may include one or more computer-readable storage media, which may be non-transitory. The memory 20 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 20 is at least used to store the following computer program 201, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps of the traffic data control method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 20 may also include an operating system 202 and data 203, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 202 may include Windows, Unix, Linux, etc. Data 203 may include but is not limited to a first message, a second message, a preset IP, etc.

[0096] In some embodiments, the flow data control device may further include a display screen 22 , an input / output interface 23 , a communication interface 24 , a power supply 25 , and a communication bus 26 .

[0097] Those skilled in the art will understand that Figure 5 The structure shown in the figure does not constitute a limitation on the flow data control device, and may include more or less components than those shown in the figure.

[0098] The flow data control device provided in the embodiment of the present application includes a memory and a processor. When the processor executes a program stored in the memory, it can implement the following method:

[0099] A first message is obtained and the first message is parsed to obtain a source IP, a destination IP, and a destination MAC of the first message.

[0100] The source IP, the destination IP and the destination MAC are sent to the open virtual network controller so that the open virtual network controller can determine whether the first message meets the first preset condition.

[0101] If the first preset condition is met, the first message is sent to the security network element so that the security network element can perform security processing on the first message.

[0102] The present application provides a flow data control device, including: obtaining a first message and parsing the first message to obtain the source IP, destination IP and destination MAC of the first message, so as to determine the first message category according to the IP information and MAC information of the first message and process the message. The source IP, destination IP and destination MAC are sent to an open virtual network controller, so that the open virtual network controller determines whether the first message meets the first preset condition according to the source IP and destination MAC. If the first preset condition is met, the first message is sent to a security network element so that the security network element can process the first message securely. It can be seen that in this solution, the open virtual network controller of the OpenStack platform determines whether the first message meets the preset condition to classify the message, and sends the message that meets the preset condition to the security network element so as to process the message securely. There is no need to install additional physical security equipment, and the system cost is low.

[0103] Finally, the present application also provides an embodiment corresponding to a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps recorded in the above method embodiment are implemented.

[0104] The present application provides a flow data control device, including: obtaining a first message and parsing the first message to obtain the source IP, destination IP and destination MAC of the first message, so as to determine the first message category according to the IP information and MAC information of the first message and process the message. The source IP, destination IP and destination MAC are sent to an open virtual network controller, so that the open virtual network controller determines whether the first message meets the first preset condition according to the source IP and destination MAC. If the first preset condition is met, the first message is sent to a security network element so that the security network element can process the first message securely. It can be seen that in this solution, the open virtual network controller of the OpenStack platform determines whether the first message meets the preset condition to classify the message, and sends the message that meets the preset condition to the security network element so as to process the message securely. There is no need to install additional physical security equipment, and the system cost is low.

[0105] It is understandable that if the method in the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

[0106] The flow data control method, device, and medium provided by the present application are introduced in detail above. The various embodiments in the specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same and similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of the present application, several improvements and modifications can be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

[0107] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

Claims

1. A flow data control method, characterized in that: Applicable to OpenStack platform virtual routers, including: Obtain a first message and parse the first message to obtain a source IP, a destination IP, and a destination MAC of the first message; Sending the source IP, the destination IP and the destination MAC to the open virtual network controller so that the open virtual network controller determines whether the first message meets the first preset condition; If the first preset condition is met, the first message is sent to the security network element so that the security network element can perform security processing on the first message; wherein the security network element does not change the destination IP and source IP of the message, but only changes the source MAC and destination MAC of the message, and the source MAC of the message after the change is the MAC of the security network element, and the destination MAC is the MAC of the subnet gateway where the security network element is located; Wherein, after the step of sending the source IP, the destination IP and the destination MAC to the open virtual network controller so that the open virtual network controller determines whether the first message meets the first preset condition, the step further includes: If the first preset condition is not met, determining whether the first message meets a second preset condition; If the second preset condition is met, forwarding the first message according to the destination IP; The second preset condition includes: the destination IP of the first message is a preset IP and the destination MAC of the first message is a second preset MAC; or the source IP of the first message is a preset IP and the source MAC of the first message is a MAC of a security network element; The first preset condition includes: The source IP of the first message is a preset IP and the destination MAC of the first message is a first preset MAC; or the destination IP of the first message is the preset IP and the destination MAC is not the second preset MAC; The first preset MAC is the MAC of the designated subnet gateway, and the second preset MAC is the MAC of the subnet gateway where the security network element is located.

2. The flow data control method according to claim 1, characterized in that: When there are multiple security network elements in the OpenStack platform, sending the first message to the security network element includes: Use hash algorithm to determine the target security network element; Send the first message to the target security network element.

3. A flow data control method, characterized in that: Applied to OpenStack platform security network elements, including: Receiving the first message sent by the OpenStack platform virtual router after executing the traffic data control method according to claim 1 or 2, wherein the first message is a first message sent by the OpenStack platform virtual router and the source IP and destination MAC meet a first preset condition; Performing security processing on the data in the message to be processed to generate a second message; The second message is sent to the virtual router.

4. The flow data control method according to claim 3, characterized in that: After the data in the to-be-processed message is securely processed to generate a second message, the method further includes: Determine whether the source IP of the second message is a preset IP; If the source IP of the second message is a preset IP, encrypting the data in the second message; If the source IP of the second message is not the preset IP, determining whether the destination IP of the second message is the preset IP; If the destination IP of the second message is a preset IP, a content security check and decryption operation is performed on the data in the second message.

5. The flow data control method according to claim 3, characterized in that: The sending the second message to the virtual router comprises: The source MAC of the second message is changed to the MAC of the security network element, and the destination MAC of the second message is changed to the second preset MAC.

6. A flow data control device, characterized in that: Applied to the virtual router of the OpenStack platform, the device includes: A parsing module, used to obtain a first message and parse the first message to obtain a source IP, a destination IP and a destination MAC of the first message; A judgment module, used for sending the source IP, the destination IP and the destination MAC to the open virtual network controller, so that the open virtual network controller determines whether the first message meets the first preset condition; A sending module, used for sending the first message to the security network element if the first preset condition is met so that the security network element can perform security processing on the first message; wherein the security network element does not change the destination IP and source IP of the message, but only changes the source MAC and destination MAC of the message, and the source MAC of the message after the change is the MAC of the security network element, and the destination MAC is the MAC of the subnet gateway where the security network element is located; The judgment module is also used for the step of sending the source IP, the destination IP and the destination MAC to the open virtual network controller so that the open virtual network controller judges whether the first message meets the first preset condition. If the first preset condition is not met, judge whether the first message meets the second preset condition; if the second preset condition is met, forward the first message according to the destination IP; the second preset condition includes: the destination IP of the first message is a preset IP and the destination MAC of the first message is a second preset MAC; or the source IP of the first message is a preset IP and the source MAC of the first message is the MAC of the security network element; The first preset condition includes: The source IP of the first message is a preset IP and the destination MAC of the first message is a first preset MAC; or the destination IP of the first message is the preset IP and the destination MAC is not the second preset MAC; The first preset MAC is the MAC of the designated subnet gateway, and the second preset MAC is the MAC of the subnet gateway where the security network element is located.

7. A flow data control device, characterized in that: comprising a memory for storing a computer program; A processor, configured to implement the steps of the flow data control method as claimed in any one of claims 1 to 5 when executing the computer program.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the flow data control method according to any one of claims 1 to 5 are implemented.

Images