A method and device for transmitting virtual machine traffic in a security domain in cloud computing

Abstract

The application provides a kind of transmission method and device of virtual machine traffic in security domain in cloud computing, and relates to virtual machine security technical field.First, the virtual machine sends first traffic message to virtual switch.Second, after receiving first traffic message, the virtual switch encapsulates first traffic message with extensible virtual local area network;First traffic message after encapsulation is modified, and identification label is added respectively, to generate second traffic message;Finally, through tenant gateway, second traffic message is analyzed, and according to identification label, second traffic message is cleaned through preset security domain path, and finally it is transmitted.In the present application, a traffic security solution based on virtual machine granularity is realized, so that virtual machine traffic passes through the defined label, according to the established order required by security business logic, through the security domain path node, filters and cleans the traffic, and realizes deep traffic security.

Description

Technical Field

[0001] This invention relates to the field of virtual machine security technology, and in particular to a method and apparatus for transmitting virtual machine traffic in a security domain in cloud computing. Background Technology

[0002] In cloud computing, networking primarily utilizes Layer 2 technologies and virtualization, with most cloud vendors employing VXLAN for network virtualization. The cloud platform's SDN architecture further facilitates and streamlines network virtualization, enabling network slicing. Network virtualization allows two tenants to use the same network address while isolating data traffic; neither tenant nor application is aware of or able to capture traffic within other virtual networks. With the release of the "Information Security Technology - Basic Requirements for Network Security Level Protection," or Level Protection 2.0 for short, the objects of level protection include network infrastructure, information systems, big data, the Internet of Things, cloud platforms, industrial control systems, mobile internet, and smart devices. The core of Level Protection is level protection, management specifications, and technical standards. Level Protection requires organizations, enterprises, and individuals to implement graded security protection for information systems, supervise and manage the implementation of security protection, thereby ensuring the basic security of information systems. Traffic security in cloud computing is increasingly valued by major cloud vendors, and ensuring the security of traffic emitted by virtual machines is an important research topic.

[0003] However, the following problems exist in the relevant technologies: First, there is no mature solution for virtual machine traffic security.

[0004] Virtual machine traffic security is becoming increasingly important, but there is currently no standard solution for deep security of north-south and east-west traffic of virtual machines. Often, only some of the traffic security needs of north-south traffic of virtual machines can be addressed, and it is impossible to achieve deep security of both north-south and east-west traffic.

[0005] Second, granularity of traffic security cannot be achieved based on virtual machines.

[0006] Traditional network security solutions, particularly traffic security, can only address the overall network and cannot meet the customized traffic security needs of a specific virtual machine. Furthermore, within the same system, it's impossible to create customized traffic security solutions for different virtual machines under different security level assessments.

[0007] Third, traditional cloud data center security solutions cannot meet traffic security requirements in the predetermined order required by business logic.

[0008] When virtual machine data packets are transmitted across the network, they need to pass through various security service nodes to ensure that the system can meet security design requirements. Traditional solutions cannot require virtual machine traffic to pass through these security service nodes in the predetermined order required by security service logic; in other words, they cannot orchestrate the security services of virtual machines in sequence. Summary of the Invention

[0009] This invention provides a method and apparatus for transmitting virtual machine traffic in a security domain during cloud computing, aiming to solve or partially solve the aforementioned technical problems.

[0010] To solve the above-mentioned technical problems, the present invention is implemented as follows: In a first aspect of this application, a method for transmitting virtual machine traffic in a security domain in cloud computing is provided, the method comprising: The virtual machine sends the first traffic packet to the virtual switch; After receiving the first traffic packet, the virtual switch modifies the first traffic packet, adds identification tags, performs scalable virtual local area network encapsulation, and generates the second traffic packet. The second traffic packet is analyzed by the tenant gateway, and the second traffic packet is cleaned by passing through the preset security domain path according to the identification label before being transmitted.

[0011] Optionally, before performing the step of the virtual machine sending the first traffic packet to the virtual switch, the method further includes: The controller distributes flow tables to virtual switches via Openflow and configurations to tenant gateways via Netconf.

[0012] Optionally, when the method is applied to east-west Layer 2 traffic transmission, the virtual switch, after receiving the first traffic packet, modifies the first traffic packet, adds an identification tag, performs scalable virtual LAN encapsulation, and generates the second traffic packet, including the following steps: After receiving the first traffic packet, the virtual switch matches the first traffic packet with the matching field in the preset flow table, and locates the service type field of the outer source IP header and the outer destination IP header of the encapsulated first traffic packet. Modify the last two bits of each service type field to obtain the SPL field of the outer source IP header and the SPL field of the outer destination IP header, respectively. The virtual switch modifies the values ​​of the SPL field in the outer source IP header and the outer destination IP header and uses them as identification tags. The first traffic packet is encapsulated using an extensible virtual local area network to generate a second traffic packet; The second traffic packet is sent to the tenant gateway.

[0013] Optionally, when the method is applied to east-west Layer 3 traffic transmission, the steps of the virtual switch modifying the first traffic packet after receiving it, adding identification tags, performing scalable virtual LAN encapsulation, and generating the second traffic packet include: After receiving the first traffic packet, the virtual switch establishes an extensible virtual local area network tunnel with the tenant gateway, performs extensible virtual local area network encapsulation on the first traffic packet, and sends the encapsulated first traffic packet to the tenant gateway. The tenant gateway receives the first traffic packet, deseals it, and locates the service type field of the outer source IP header and outer destination IP header of the first traffic packet; Modify the last two bits of each service type field to obtain the SPL field of the outer source IP header and the SPL field of the outer destination IP header, respectively. The tenant gateway modifies the values ​​of the SPL field in the outer source IP header and the outer destination IP header and uses them as identification tags. The tenant gateway re-encapsulates the first traffic packet with an extensible virtual local area network to generate a second traffic packet.

[0014] Optionally, when the method is applied to north-south traffic transmission, the virtual switch, after receiving the first traffic packet, modifies the first traffic packet, adds an identification tag, performs scalable virtual local area network encapsulation, and generates the second traffic packet, including: After receiving the first traffic packet, the virtual switch establishes an extensible virtual local area network tunnel with the tenant gateway, performs extensible virtual local area network encapsulation on the first traffic packet, and sends the encapsulated first traffic packet to the tenant gateway. The tenant gateway receives the first traffic packet and deseals it, locating the service type field of the inner source IP header and the inner destination IP header of the first traffic packet; Modify the last two bits of each service type field to obtain the SPL field of the outer source IP header and the SPL field of the outer destination IP header, respectively. The tenant gateway modifies the values ​​of the SPL field in the outer source IP header and the outer destination IP header and uses them as identification tags. The tenant gateway re-encapsulates the first traffic packet with an extensible virtual local area network to generate a second traffic packet.

[0015] Optionally, the steps of analyzing the second traffic packets through a tenant gateway, cleaning the second traffic packets according to the identification label by passing them through a preset security domain path, and finally transmitting them include: The tenant gateway checks the values ​​of the SPL field in the outer source IP header and the outer destination IP header of the second traffic packet, and redirects it to the first security service node according to the security domain path. After receiving the second traffic packet, the first security service node searches for a matching security domain service chain locally based on the values ​​of the SPL field in the outer source IP header and the SPL field in the outer destination IP header. If it does not exist, the second traffic packet will be forwarded directly; If it exists, the second traffic packet is processed. If the security domain service chain is configured with a next-hop address, the processed second traffic packet is forwarded to the next service node for processing. If the security domain service chain is not configured with a next-hop address, the security domain service chain is used as the tail node, the SPL field of the outer source IP header and the SPL field of the outer destination IP header are deleted, and the processed second traffic packet is forwarded to the access point in the outgoing direction of the packet.

[0016] Optionally, in the step of analyzing the second traffic packet through the tenant gateway, cleaning the second traffic packet through a preset security domain path according to the identification label, and finally transmitting it, the preset security domain path includes: When modifying the SPL field of the outer source IP header, SPL=01 means that the traffic sent by the virtual machine will pass through the firewall, SPL=10 means that the traffic sent by the virtual machine will pass through the ADP, and SPL=11 means that the traffic sent by the virtual machine will pass through both the firewall and ADP. When modifying the SPL field in the outer destination IP header, SPL = 01 means that the traffic sent by the virtual machine will pass through DPI, SPL = 10 means that the traffic sent by the virtual machine will pass through IPS, and SPL = 11 means that the traffic sent by the virtual machine will pass through both DPI and IPS.

[0017] A second aspect of the present invention provides a device for transmitting virtual machine traffic in a security domain during cloud computing, the device comprising: The sending module is used by the virtual machine to send the first traffic packet to the virtual switch; The modification and generation module is used to modify the first traffic packet after the virtual switch receives it, add identification tags, encapsulate it into an extensible virtual local area network, and generate the second traffic packet. The transmission module is used to analyze the second traffic packets through the tenant gateway, perform traffic cleaning on the second traffic packets through the preset security domain path according to the identification tag, and finally transmit them.

[0018] Optionally, the policy distribution module is used by the controller to distribute flow tables to virtual switches via Openflow and to distribute configurations to tenant gateways via Netconf.

[0019] Optionally, the generation module can be modified to include: The positioning submodule is used to locate the service type field of the outer source IP header and outer destination IP header of the encapsulated first traffic packet after the virtual switch receives the first traffic packet by matching the matching field in the preset flow table; The modification submodule is used to modify the last two bits of each of the service type fields to obtain the SPL field of the outer source IP header and the SPL field of the outer destination IP header, respectively. The modification submodule is used to modify the values ​​of the SPL field in the outer source IP header and the SPL field in the outer destination IP header through a virtual switch and use them as identification tags; The encapsulation submodule is used to encapsulate the first traffic packet with an extensible virtual local area network to generate the second traffic packet. The sending submodule is used to send the second traffic packet to the tenant gateway.

[0020] A third aspect of the present invention provides an electronic device, the electronic device comprising: At least one processor; and, A memory that is communicatively connected to at least one processor; wherein, The memory stores instructions that can be executed by at least one processor, which enables the at least one processor to perform the method steps proposed in the first aspect of the present invention.

[0021] In a fourth aspect of the present invention, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the method steps proposed in the first aspect of the present invention.

[0022] The embodiments of this invention include the following advantages: First, the virtual machine sends a first traffic packet to the virtual switch. Second, after receiving the first traffic packet, the virtual switch performs scalable virtual local area network encapsulation on the first traffic packet; it then modifies the encapsulated first traffic packet and adds identification tags to generate a second traffic packet; finally, the tenant gateway analyzes the second traffic packet, and based on the identification tags, the second traffic packet is cleaned through a preset security domain path before being transmitted. In this invention, by modifying the last two bits of the service type field in the IP header of the first traffic packet, the labeling process and the security domain processing process for east-west Layer 2 traffic, east-west Layer 3 traffic, and north-south traffic based on the virtual machine are defined. This achieves a traffic security solution based on the virtual machine as the granularity, enabling virtual machine traffic to pass through security domain path nodes according to the defined tags and the predetermined order required by the security business logic, thereby filtering and cleaning the traffic and achieving deep traffic security. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a schematic diagram of the electronic device structure of the hardware operating environment involved in the embodiments of this application; Figure 2 This is a flowchart illustrating a method for transmitting virtual machine traffic in a security domain in cloud computing, according to an exemplary embodiment. Figure 3 This is a schematic diagram illustrating the structure of the service type field in a first traffic packet according to an exemplary embodiment; Figure 4 This is a schematic diagram illustrating the structure of the service type field in a second traffic packet according to an exemplary embodiment; Figure 5 This is a code table defining SPL according to an exemplary embodiment; Figure 6 This is a schematic diagram illustrating the east-west Layer 2 traffic packet encapsulation and forwarding path supporting security domain forwarding according to an exemplary embodiment; Figure 7 This is a schematic diagram illustrating the east-west Layer 3 traffic packet encapsulation and forwarding path supporting security domain forwarding according to an exemplary embodiment; Figure 8This is a schematic diagram illustrating the north-south traffic packet encapsulation and forwarding path supporting security domain forwarding according to an exemplary embodiment; Figure 9 This is a block diagram illustrating a device for transmitting virtual machine traffic in a security domain in cloud computing, according to an exemplary embodiment. Detailed Implementation

[0025] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] In existing technologies, a security domain is a technique that guides network service packets through security service nodes in a sequential manner. It combines SDN (Software Defined Networking) to achieve service orchestration, guiding network packets through security nodes for processing and forwarding in the required order. A security service node is a device in the network that processes a specific service; it can be a physical device or an NFV (Network Function Virtualization) device. Multiple service nodes can exist on a single security domain service chain. Each security service node processes packets according to a security service list specifying the security service type. The security service list specifies the service type and processing order; typical service types currently include FW, ACG, DPI, and IPS nodes.

[0027] Current traditional transmission methods are based on the entire network and cannot be customized to match different virtual machines with secure traffic transmission solutions. In other words, the transmission must pass through all secure service nodes to ensure that security requirements are met.

[0028] Based on this, the inventors proposed the inventive concept of this application: by identifying and labeling the three types of traffic—east-west Layer 2 traffic, east-west Layer 3 traffic, and north-south traffic—and by arranging the nodes of the security domain path according to the security business intent based on the identification of the labels, the traffic is filtered and cleaned to ensure traffic security.

[0029] See Figure 1 , Figure 1 This is a schematic diagram of the electronic device structure of the hardware operating environment involved in the embodiments of this application.

[0030] like Figure 1As shown, the electronic device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to enable communication between these components. The user interface 1003 may include a display screen or an input unit such as a keyboard; optionally, the user interface 1003 may also include a standard wired interface or a wireless interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface). The memory 1005 may be a high-speed random access memory (RAM) or a stable non-volatile memory (N-virtual machine), such as a disk drive. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001.

[0031] Those skilled in the art will understand that Figure 1 The structure shown does not constitute a limitation on the electronic device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0032] like Figure 1 As shown, the memory 1005, which serves as a storage medium, may include an operating device, a data storage module, a network communication module, a user interface module, and electronic programs.

[0033] exist Figure 1 In the illustrated electronic device, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the electronic device of the present invention can be set in the electronic device, and the electronic device calls the transmission device of virtual machine traffic in the security domain in cloud computing stored in the memory 1005 through the processor 1001, and executes the transmission method of virtual machine traffic in the security domain in cloud computing provided in the embodiments of this application.

[0034] Reference Figure 2 Based on the aforementioned hardware operating environment, embodiments of this application provide a method for transmitting virtual machine traffic in a security domain during cloud computing, the method comprising: S201: The virtual machine sends the first traffic packet to the virtual switch.

[0035] In this embodiment, the first traffic packet is the original packet.

[0036] S202: After receiving the first traffic packet, the virtual switch modifies the first traffic packet, adds an identification tag, performs scalable virtual LAN encapsulation, and generates the second traffic packet.

[0037] In this embodiment, the method for modifying the first traffic packet, adding identification tags, and encapsulating it is divided into three types according to different traffic directions, as follows: When the method is applied to east-west Layer 2 traffic transmission: S202-11: After receiving the first traffic packet, the virtual switch matches the first traffic packet with the matching field in the preset flow table, and locates the service type field of the outer source IP header and the outer destination IP header of the encapsulated first traffic packet.

[0038] S202-12: Modify the last two bits of each service type field to obtain the SPL field of the outer source IP header and the SPL field of the outer destination IP header, respectively.

[0039] S202-13: Modify the values ​​of the SPL field in the outer source IP header and the outer destination IP header through a virtual switch and use them as identification tags.

[0040] S202-14: Perform Scalable Virtual Local Area Network (VLAN) encapsulation on the first traffic packet to generate the second traffic packet.

[0041] S202-15: Send the second traffic packet to the tenant gateway.

[0042] In the implementations of S202-11 to S202-15, the control layer aims to customize special security domain paths for virtual machine traffic. The controller distributes flow tables to the virtual switches via OpenFlow and configurations to tenant gateways via Netconf. When raw packets from the virtual machines reach the virtual switches, they are matched against the matching fields in the flow tables on the virtual switches, targeting the source and destination IPs of the virtual machines (for Layer 2 traffic, the source and destination IPs are in the same network segment). When encapsulating the packets from the virtual machines with Scalable Virtual Local Area Network (VLAN), the Security Path Label (SPL) field in the outer source IP header is modified. The virtual switch's OPENVSWITCH.KO modifies the SPL value according to the business logic definition. Simultaneously, the Security Path Label (SPL) field in the outer destination IP header is modified, and the virtual switch's OPENVSWITCH.KO modifies the SPL value according to the business logic definition. This completes the SPL labeling for east-west Layer 2 traffic.

[0043] As an example, assuming the outer source IP has an SPL of 11 and the outer destination IP has an SPL of 11, this means that the data packet will pass through four security service nodes: FW (Firewall), ADP (Attack Detection and Prevention), DPI (Deep Packet Inspection), and IPS (Intelligent Protection Switching).

[0044] In this embodiment, the encapsulation format and traffic path of the east-west Layer 2 traffic are as follows: Figure 6 As shown, a Scalable Virtual LAN tunnel is established between virtual switches on the host machine of a virtual machine. The virtual switches modify the SPL value of the source and destination IPs of the outer layer of the Scalable Virtual LAN, and the traffic is guided by the policy routing of the label to the defined security domain path for traffic scrubbing.

[0045] When the method is applied to east-west Layer 3 traffic transmission: S202-21: After receiving the first traffic packet, the virtual switch establishes an extensible virtual local area network tunnel with the tenant gateway, performs extensible virtual local area network encapsulation on the first traffic packet, and sends the encapsulated first traffic packet to the tenant gateway.

[0046] S202-22: The tenant gateway receives the first traffic packet, deseals it, and locates the service type field of the outer source IP header and outer destination IP header of the first traffic packet.

[0047] S202-23: Modify the last two bits of each service type field to obtain the SPL field of the outer source IP header and the SPL field of the outer destination IP header, respectively.

[0048] S202-24: Modify the values ​​of the SPL field in the outer source IP header and the outer destination IP header through the tenant gateway and use them as identification tags.

[0049] S202-25: The tenant gateway re-encapsulates the first traffic packet with an extensible virtual local area network to generate a second traffic packet.

[0050] In the implementations of S202-21 to S202-25, the control layer aims to customize special security domain paths for virtual machine traffic. The controller issues flow tables to the virtual switches via OpenFlow and configurations to the tenant gateways via Netconf. Raw packets from the virtual machines reach the virtual switches, where a Scalable Virtual Local Area Network (SPL) tunnel is established between the virtual switches and the tenant gateways. The virtual machine traffic is then encapsulated through the Scalable SPL before reaching the tenant gateway. The tenant gateway performs Scalable SPL re-encapsulation, at which point the tenant gateway kernel modifies the Security PathLabel field in the outer source IP header, changing the SPL value according to the business logic definition. Simultaneously, it modifies the Security PathLabel field in the outer destination IP header, changing the SPL value according to the business logic definition. This completes the SPL marking for east-west Layer 3 traffic.

[0051] As an example, assuming the outer source IP has an SPL of 10 and the outer destination IP has an SPL of 10, it means that this data packet will pass through two security service nodes: ADP and IPS.

[0052] In this embodiment, the encapsulation format and traffic path of the east-west three-layer traffic are as follows: Figure 7 As shown, the Scalable Virtual LAN tunnel is established between the virtual machine's host machine and the tenant gateway. The tenant gateway modifies the SPL value of the source and destination IPs of the Scalable Virtual LAN outer layer, and the traffic is guided by the policy routing of the label to the defined security domain path for traffic scrubbing.

[0053] When the method is applied to north-south traffic transmission: S202-31: After receiving the first traffic packet, the virtual switch establishes an extensible virtual local area network tunnel with the tenant gateway, performs extensible virtual local area network encapsulation on the first traffic packet, and sends the encapsulated first traffic packet to the tenant gateway.

[0054] S202-32: The tenant gateway receives the first traffic packet, deseals it, and locates the service type field of the inner source IP header and the inner destination IP header of the first traffic packet.

[0055] S202-33: Modify the last two bits of each service type field to obtain the SPL field of the outer source IP header and the SPL field of the outer destination IP header, respectively.

[0056] S202-34: Modify the values ​​of the SPL field in the outer source IP header and the outer destination IP header through the tenant gateway and use them as identification tags.

[0057] S202-35: The tenant gateway re-encapsulates the first traffic packet with an extensible virtual local area network to generate a second traffic packet.

[0058] In the implementations of S202-3 to S202-35, the control layer aims to customize special security domain paths for virtual machine traffic. The controller issues flow tables to the virtual switches via OpenFlow and configurations to the tenant gateways via Netconf. Raw packets from the virtual machines reach the virtual switches, which establish Scalable Virtual Local Area Network (SLAN) tunnels with the tenant gateways. The virtual machine traffic is encapsulated through the Scalable SLAN before reaching the tenant gateway. The tenant gateway performs Scalable SLAN decapsulation and checks the destination IP of the inner traffic. Finding it to be a public IP, the tenant gateway kernel modifies the Security Path Label (SPL) field in the inner source IP header, adjusting the SPL value according to the business logic definition. Simultaneously, it modifies the Security Path Label field in the inner destination IP header, adjusting the SPL value according to the business logic definition. This completes the SPL labeling for north-south traffic.

[0059] As an example, assuming the source IP has an SPL of 01 and the destination IP has an SPL of 11, this means that the data packet will pass through three security service nodes: FW, DPI, and IPS.

[0060] In this embodiment, the encapsulation format and traffic path of north-south traffic are as follows: Figure 8 As shown, the Scalable Virtual LAN tunnel is established between the virtual machine's host machine and the tenant gateway. The tenant gateway decapsulates the Scalable Virtual LAN, exposes the inner packets, modifies the SPL values ​​of the inner source and destination IPs, and the traffic is guided by the policy routing of the label to the defined security domain path for traffic cleaning.

[0061] It should be noted that the first four bytes of the original IP header, such as Figure 3 As shown, the Service Type field occupies one byte. RFC2474 defines the Service Type field, assigning the first six bits to DSCP (Differentiated Service Code Point) for traffic marking and Quality of Service (QoS) services. The last two bits are the CU (current unused) reserved field. This solution modifies the Service Type field by defining the last two bits, which are not defined in the RFC standard, as a Security Path Label. The modified structure is shown in the diagram below. Figure 4 As shown, the modified IP header now includes a Security Path Label that indicates which security service nodes in the security domain the virtual machine will pass through. By analyzing the service type field in the IP header, it is possible to determine which security domain path nodes the traffic originating from the virtual machine will traverse.

[0062] S203: Analyze the second traffic packet through the tenant gateway, perform traffic cleaning on the second traffic packet through the preset security domain path according to the identification label, and finally transmit it.

[0063] In this embodiment, the specific steps for analyzing the second traffic packet, cleaning the second traffic packet through a preset security domain path according to the identification tag, and finally transmitting it are as follows: S203-1: The tenant gateway checks the values ​​of the SPL field in the outer source IP header and the outer destination IP header of the second traffic packet, and redirects it to the first security service node according to the security domain path.

[0064] S203-2: After receiving the second traffic packet, the first security service node searches for a matching security domain service chain locally based on the values ​​of the SPL field in the outer source IP header and the SPL field in the outer destination IP header.

[0065] S203-3: If it does not exist, the second traffic packet will be forwarded directly.

[0066] S203-4: If it exists, process the second traffic packet. If the security domain service chain is configured with a next-hop address, forward the processed second traffic packet to the next service node for processing. If the security domain service chain is not configured with a next-hop address, use the security domain service chain as the tail node, delete the SPL field of the outer source IP header and the SPL field of the outer destination IP header, and forward the processed second traffic packet to the access point in the outgoing direction of the packet.

[0067] Reference Figure 5 In one feasible implementation, the steps of analyzing the second traffic packet through a tenant gateway, cleaning the second traffic packet according to the identification tag by passing it through a preset security domain path, and finally transmitting it, include: When modifying the SPL field in the outer source IP header, SPL=01 means that traffic originating from the virtual machine will pass through the firewall, SPL=10 means that traffic originating from the virtual machine will pass through the application deployment manager (ADP), and SPL=11 means that traffic originating from the virtual machine will pass through both the firewall and ADP.

[0068] When modifying the SPL field in the outer destination IP header, SPL = 01 means that the traffic sent by the virtual machine will pass through DPI, SPL = 10 means that the traffic sent by the virtual machine will pass through IPS, and SPL = 11 means that the traffic sent by the virtual machine will pass through both DPI and IPS.

[0069] In one feasible implementation, before performing the step of the virtual machine sending the first traffic packet to the virtual switch, the method further includes: The controller distributes flow tables to virtual switches via Openflow and configurations to tenant gateways via Netconf.

[0070] In summary, this invention modifies the last two bits of the service type field in the IP header of the first traffic packet to define the tagging process for east-west Layer 2 traffic, east-west Layer 3 traffic, and north-south traffic based on virtual machines, as well as the processing process for passing through security domains. This achieves a traffic security solution based on virtual machines at the granular level, enabling virtual machine traffic to pass through security domain path nodes in a predetermined order according to the defined tags, thereby filtering and cleaning the traffic and achieving deep traffic security.

[0071] Reference Figure 9 , Figure 9 This is a block diagram illustrating a device for transmitting virtual machine traffic in a security domain in cloud computing, according to an exemplary embodiment. Figure 9 As shown, the device includes: The sending module 901 is used by the virtual machine to send the first traffic packet to the virtual switch; The modification generation module 902 is used to modify the first traffic packet after the virtual switch receives it, add identification tags, encapsulate it into an extensible virtual local area network, and generate a second traffic packet. The transmission module 903 is used to analyze the second traffic packet through the tenant gateway, perform traffic cleaning on the second traffic packet through the preset security domain path according to the identification label, and finally transmit it.

[0072] In one feasible implementation, the policy distribution module is used by the controller to distribute flow tables to virtual switches via Openflow and to distribute configurations to tenant gateways via Netconf.

[0073] In one feasible implementation, the generation module is modified, including: The positioning submodule is used to locate the service type field of the outer source IP header and outer destination IP header of the encapsulated first traffic packet after the virtual switch receives the first traffic packet by matching the matching field in the preset flow table; The modification submodule is used to modify the last two bits of each of the service type fields to obtain the SPL field of the outer source IP header and the SPL field of the outer destination IP header, respectively. The modification submodule is used to modify the values ​​of the SPL field in the outer source IP header and the SPL field in the outer destination IP header through a virtual switch and use them as identification tags; The encapsulation submodule is used to encapsulate the first traffic packet with an extensible virtual local area network to generate the second traffic packet. The sending submodule is used to send the second traffic packet to the tenant gateway.

[0074] Based on the same inventive concept, embodiments of this application also provide an electronic device, the electronic device comprising: At least one processor; and, A memory that is communicatively connected to at least one processor; wherein, The memory stores instructions that can be executed by at least one processor to enable the at least one processor to perform a method for transmitting virtual machine traffic in a security domain in cloud computing.

[0075] Based on the same inventive concept, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements a method for transmitting virtual machine traffic in a security domain in cloud computing.

[0076] Based on the same inventive concept, embodiments of this application also provide a computer program product that, when processed, implements a method for transmitting virtual machine traffic in a security domain during cloud computing.

[0077] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable vehicles (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0078] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.

[0079] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction set implemented in a process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0080] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0081] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. "And / or" indicates that either one or both can be chosen. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0082] The present invention provides a detailed description of a method and apparatus for transmitting virtual machine traffic in a security domain in cloud computing. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for transmitting virtual machine traffic in a security domain in cloud computing, characterized in that, The method includes: The controller distributes flow tables to virtual switches via OpenFlow and configurations to tenant gateways via Netconf. The virtual machine sends the first traffic packet to the virtual switch; After receiving the first traffic packet, the virtual switch modifies it, adds an identification tag, performs scalable virtual LAN encapsulation, and generates a second traffic packet, which includes: After receiving the first traffic packet, the virtual switch matches the first traffic packet with the matching field in the preset flow table, and locates the service type field of the outer source IP header and the outer destination IP header of the encapsulated first traffic packet. The last two bits of each of the service type fields are modified to obtain the SPL field of the outer source IP header and the SPL field of the outer destination IP header, respectively. The values ​​of the SPL field in the outer source IP header and the outer destination IP header are modified by a virtual switch and used as identification tags. The first traffic packet is encapsulated using an extensible virtual local area network to generate a second traffic packet; Send the second traffic packet to the tenant gateway; The second traffic packet is analyzed by the tenant gateway, and the second traffic packet is cleaned by passing through a preset security domain path according to the identification label before being transmitted.

2. The method according to claim 1, characterized in that, When the method is applied to east-west Layer 3 traffic transmission, the virtual switch, after receiving the first traffic packet, modifies the first traffic packet, adds an identification tag, performs scalable virtual local area network encapsulation, and generates a second traffic packet, including the following steps: After receiving the first traffic packet, the virtual switch establishes an extensible virtual local area network tunnel with the tenant gateway, performs extensible virtual local area network encapsulation on the first traffic packet, and sends the encapsulated first traffic packet to the tenant gateway. The tenant gateway receives the first traffic packet, deseals it, and locates the service type field of the outer source IP header and outer destination IP header of the first traffic packet; The last two bits of each of the service type fields are modified to obtain the SPL field of the outer source IP header and the SPL field of the outer destination IP header, respectively. The tenant gateway modifies the values ​​of the SPL field in the outer source IP header and the SPL field in the outer destination IP header and uses them as identification tags. The tenant gateway re-encapsulates the first traffic packet with an extensible virtual local area network to generate a second traffic packet.

3. The method according to claim 1, characterized in that, When the method is applied to north-south traffic transmission, the virtual switch receives the first traffic packet, modifies it, adds an identification tag, performs scalable virtual local area network encapsulation, and generates a second traffic packet. The steps include: After receiving the first traffic packet, the virtual switch establishes an extensible virtual local area network tunnel with the tenant gateway, performs extensible virtual local area network encapsulation on the first traffic packet, and sends the encapsulated first traffic packet to the tenant gateway. The tenant gateway receives the first traffic packet and deseals it, locating the service type field of the inner source IP header and the inner destination IP header of the first traffic packet; The last two bits of each of the service type fields are modified to obtain the SPL field of the outer source IP header and the SPL field of the outer destination IP header, respectively. The tenant gateway modifies the values ​​of the SPL field in the outer source IP header and the SPL field in the outer destination IP header and uses them as identification tags. The tenant gateway re-encapsulates the first traffic packet with an extensible virtual local area network to generate a second traffic packet.

4. The method according to any one of claims 1-3, characterized in that, The steps include: analyzing the second traffic packet through a tenant gateway, cleaning the second traffic packet according to the identification tag by passing it through a preset security domain path, and finally transmitting it; The tenant gateway checks the values ​​of the SPL field in the outer source IP header and the outer destination IP header of the second traffic packet, and redirects it to the first security service node according to the security domain path. After receiving the second traffic packet, the first security service node searches for a matching security domain service chain locally based on the values ​​of the SPL field in the outer source IP header and the SPL field in the outer destination IP header. If it does not exist, the second traffic packet will be forwarded directly; If it exists, the second traffic packet is processed. If the security domain service chain is configured with a next-hop address, the processed second traffic packet is forwarded to the next service node for processing. If the security domain service chain is not configured with a next-hop address, the security domain service chain is used as the tail node, the SPL field of the outer source IP header and the SPL field of the outer destination IP header are deleted, and the processed second traffic packet is forwarded to the access point in the outgoing direction of the packet.

5. The method according to claim 4, characterized in that, In the step of analyzing the second traffic packet through a tenant gateway, cleaning the second traffic packet according to the identification tag by passing it through a preset security domain path, and finally transmitting it, the preset security domain path includes: When modifying the SPL field of the outer source IP header, SPL=01 means that the traffic sent by the virtual machine will pass through the firewall, SPL=10 means that the traffic sent by the virtual machine will pass through the ADP, and SPL=11 means that the traffic sent by the virtual machine will pass through both the firewall and ADP. When modifying the SPL field in the outer destination IP header, SPL = 01 means that the traffic sent by the virtual machine will pass through DPI, SPL = 10 means that the traffic sent by the virtual machine will pass through IPS, and SPL = 11 means that the traffic sent by the virtual machine will pass through both DPI and IPS.

6. A device for transmitting virtual machine traffic in a security domain during cloud computing, characterized in that, The apparatus for performing a method for transmitting virtual machine traffic in a security domain in cloud computing as described in claim 1, the apparatus comprising: The sending module is used by the virtual machine to send the first traffic packet to the virtual switch; The modification generation module is used to modify the first traffic packet after the virtual switch receives it, add identification tags, encapsulate it into an extensible virtual local area network, and generate a second traffic packet. The transmission module is used to analyze the second traffic packet through the tenant gateway, perform traffic cleaning on the second traffic packet through a preset security domain path according to the identification tag, and finally transmit it.

7. The apparatus according to claim 6, characterized in that, The device further includes a policy distribution module, used by the controller to distribute flow tables to virtual switches via Openflow and to distribute configurations to tenant gateways via Netconf.

8. The apparatus according to claim 7, characterized in that, The modification generation module includes: The positioning submodule is used to locate the service type field of the outer source IP header and outer destination IP header of the encapsulated first traffic packet after the virtual switch receives the first traffic packet by matching the matching field in the preset flow table; The modification submodule is used to modify the last two bits of each of the service type fields to obtain the SPL field of the outer source IP header and the SPL field of the outer destination IP header, respectively. The modification submodule is used to modify the values ​​of the SPL field in the outer source IP header and the SPL field in the outer destination IP header through a virtual switch and use them as identification tags; The encapsulation submodule is used to encapsulate the first traffic packet with an extensible virtual local area network to generate the second traffic packet. The sending submodule is used to send the second traffic packet to the tenant gateway.

Images