Method, system, device and readable storage medium for implementing network service chaining

Abstract

The application discloses a method, system, device and readable storage medium for realizing network service chain. The method for realizing network service chain comprises the following steps: accepting a first message, judging whether to perform a first hop; inserting a service chain field block into a first message header to generate a second message; forwarding the second message to a first network service engine; processing the second message according to a policy routing rule in the first network service engine; and judging whether to enter a next network service engine or to directly send out the second message from a network device port by stripping the service chain field block. The application can realize the network service chain function and dynamically determine a service chain path according to the characteristics of a data flow.

Description

Technical Field

[0001] This invention relates to the field of network service chain technology, and in particular to a method, system, device and readable storage medium for implementing network service chains. Background Technology

[0002] Data centers have various network service engines, such as enhanced ACL (Access Control List) rule processors, network firewalls, intrusion prevention devices, WAF (Web Application Firewall), load balancers, DDoS attack protection and traffic scrubbing devices.

[0003] If every data stream passes through every network service engine, performance bottlenecks and significant latency arise. Traditional service chaining solutions have various functional limitations and cannot meet practical needs.

[0004] NSH: Cannot carry source port information; network service engine policies cannot be based on network entry points; does not support network service engines specifying the next-level processing engine based on their own processing results.

[0005] SRv6: Does not support direct IPv4 packet encapsulation; cannot carry source port information; network service engine policies cannot be based on network entry points; does not support network service engines specifying the next-level processing engine based on their own processing results.

[0006] PBR: Cannot carry source port information; network service engine policies cannot be based on network entry points; does not support network service engines specifying the next-level processing engine based on their own processing results; requires a large amount of network chip ACL resources.

[0007] Common drawback: Whether the service chain strategy is determined by the head node or by the unified scheduling of the service chain controller, the service chain path is determined by matching the data flow using tuple rules, rather than by dynamically determining the matching results from the network service engine. Summary of the Invention

[0008] According to an embodiment of the present invention, a method for implementing a network service chain is provided, comprising the following steps:

[0009] Upon receiving the first message, determine whether to initiate the first hop;

[0010] Insert a service chain field block into the header of the first message to generate the second message;

[0011] Forward the second message to the first network service engine;

[0012] The first network service engine processes the second packet according to policy routing rules;

[0013] Determine whether to enter the next level network service engine or remove the service chain field block, and send it directly from the network device port.

[0014] Furthermore, based on the entry point, network scenario, ACL rules, and packets, a decision is made as to whether to perform a first hop.

[0015] Furthermore, the position of the service chain field block inserted in the first packet header is after MAC SA and before VLAN Ether Type, or after VLAN TAG and before Layer3 Ether Type / Length.

[0016] Furthermore, the methods by which the first network service engine processes packets according to policy routing rules include: dropping, forwarding, and modifying and forwarding.

[0017] Furthermore, the methods for modifying the second message include: modifying the exit Next_DI of the service chain field block to point to the next-level network service engine, or setting the Next_OE_Type field to indicate the type of network service to be processed at the next level.

[0018] Furthermore, Next_DI points to the next-level network service engine or a normal network exit.

[0019] Furthermore, Next_OE_Type points to the type of network service that needs to be processed at the next level.

[0020] According to another embodiment of the present invention, a system for implementing network service chains is provided, comprising:

[0021] The first judgment module is used to receive the first message and determine whether to perform the first hop.

[0022] The field block module is used to insert a service chain field block into the header of the first message to generate the second message.

[0023] The forwarding module is used to forward the second packet to the first network service engine;

[0024] The processing module is used by the first network service engine to process the second packet according to the policy routing rules;

[0025] The second judgment module is used to determine whether to enter the next level network service engine or to remove the service chain field block and send it directly from the network device port.

[0026] According to another embodiment of the present invention, an apparatus for implementing network service chaining is provided, including a memory and a processor. The memory stores a computer program that can be executed by the processor to implement a method for network service chaining.

[0027] According to another embodiment of the present invention, a computer-readable storage medium is provided, which stores a computer program that can be executed by a processor of the device in which the computer-readable storage medium is located, to implement a method for network service chaining.

[0028] The method, system, device, and readable storage medium for implementing network service chains according to embodiments of the present invention can realize network service chain functions and dynamically determine the service chain path based on the characteristics of the data flow.

[0029] It should be understood that both the foregoing general description and the following detailed description are exemplary and intended to provide further illustration of the claimed technology. Attached Figure Description

[0030] Figure 1 A flowchart illustrating a method for implementing a network service chain according to an embodiment of the present invention;

[0031] Figure 2 This is a flowchart illustrating a system for implementing a network service chain according to an embodiment of the present invention. Implementation

[0032] The preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, further illustrating the present invention.

[0033] First, combine Figure 1 A method for implementing a network service chain according to an embodiment of the present invention is described.

[0034] like Figure 1 As shown, the method for implementing a network service chain according to an embodiment of the present invention includes the following steps:

[0035] S1: Receive the first message and determine whether to perform the first hop. In this embodiment, the network chip receives the first message and determines the next hop based on the entry point, network scenario, message, and ACL rules, and decides whether to send it to the first network service engine.

[0036] S2: Insert a service chain field block into the header of the first packet to generate the second packet. In this embodiment, the network chip inserts a service chain field block into the header of the first packet to generate the second packet. The service chain field block includes, but is not limited to, the service chain header identifier, physical entry, entry label, and ACL rule number. Whether the packet has a service chain field block depends on the configuration of the outgoing interface. If the connected device supports service chains, this feature is enabled.

[0037] S3: Forward the second packet to the first network service engine. In this embodiment, the network chip forwards the second packet to the first network service engine or hash-load balances it to the service engine group.

[0038] S4: The first network service engine processes the second packet according to policy routing rules. In this embodiment, the first network service engine decides whether to discard, forward, or modify the packet before forwarding based on the policy routing rules. Modifying the packet involves setting the exit Next_DI field of the modified service chain block to point to the next-level network service engine, or setting the Next_OE_Type field to indicate the network service type that the network chip needs to process next. The network service engine can determine the next-level processing engine based on its processing results and provide the interface index of the next-level processing engine to the network chip for direct use, saving the network chip a significant amount of TCAM storage resources required for ACL matching.

[0039] S5: Determine whether to enter the next level network service engine or remove the service chain field block and send it directly from the network device port. In this embodiment, the network chip forwards the packet to the network service engine of the type indicated by Next_OE_Type or hash load balances it to the engine group according to the network service type indicated by Next_OE_Type. When Next_OE_Type is 0 or all F, the packet is sent out according to the value indicated by Next_DI as the exit index.

[0040] When the network chip sees that Next_OE_Type is all F and Next_DI is not all F, it will directly send Next_DI out as its target exit. Next_DI can be the next level network service engine or a normal network exit.

[0041] The S4 step is repeated, and the next-level network service engine then decides whether to drop, forward, or modify the packet before forwarding it according to the policy routing rules, until the last hop of the service chain, modifying Next_DI and Next_OE_Type of the final exit from the network chip as needed.

[0042] The network service engine sets the Next_DI and Next_OE_Type of the data packet to all F, indicating that it is the last hop.

[0043] When the network chip sees that Next_DI and Next_OE_Type are both F, it looks up the table again according to the normal processing procedure and forwards the packet.

[0044] This embodiment supports multiple network service engines, including but not limited to enhanced ACL rule processors, network firewalls, intrusion prevention devices, WAF application firewalls, DDoS protection and mitigation, and load balancers.

[0045] Furthermore, the position of the service chain field block inserted in the first packet header is after MAC SA and before VLAN Ether Type, or after VLAN TAG and before Layer3 Ether Type / Length.

[0046] like Figure 2 As shown, according to another embodiment of the present invention, a system for implementing a network service chain is provided, comprising: a first judgment module 1, a field block module 2, a forwarding module 3, a processing module 4, and a second judgment module 5.

[0047] Specifically, such as Figure 2 As shown, the first judgment module 1 is used to receive the first packet and determine whether to perform a first hop; the field block module 2 is used to insert a service chain field block into the header of the first packet to generate a second packet; the forwarding module 3 is used to forward the second packet to the first network service engine; the processing module 4 is used to process the second packet in the first network service engine according to the policy routing rules; and the second judgment module 5 is used to determine whether to enter the next level network service engine or to remove the service chain field block and send it directly from the network device port.

[0048] According to another embodiment of the present invention, an apparatus for implementing network service chaining is provided, including a memory and a processor. The memory stores a computer program that can be executed by the processor to implement a method for network service chaining.

[0049] According to another embodiment of the present invention, a computer-readable storage medium is provided, which stores a computer program that can be executed by a processor of the device in which the computer-readable storage medium is located, to implement a method for network service chaining.

[0050] Above, refer to Figure 1 A method for implementing a network service chain according to an embodiment of the present invention is described, with reference to Figure 2 A system for implementing network service chains according to embodiments of the present invention is described. The method, system, device and readable storage medium for implementing network service chains according to embodiments of the present invention can realize network service chain functions and can dynamically determine the service chain path according to the characteristics of the data flow.

[0051] It should be noted that, in this specification, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes that element.

[0052] Although the present invention has been described in detail through the preferred embodiments above, it should be understood that the above description should not be considered as a limitation of the present invention. Various modifications and substitutions to the present invention will be apparent to those skilled in the art after reading the above description. Therefore, the scope of protection of the present invention should be defined by the appended claims.

Claims

1. A method for implementing a network service chain, characterized in that, It includes the following steps: Upon receiving the first message, determine whether to initiate the first hop; A service chain field block is inserted into the header of the first message to generate a second message; Forward the second message to the first network service engine; The first network service engine processes the second packet according to policy routing rules; Determine whether to enter the next level network service engine or remove the service chain field block and send it directly from the network device port; The method by which the first network service engine processes the second packet according to the policy routing rules includes: dropping, forwarding, and modifying and forwarding; Modifying the second message can be done by: changing the exit Next_DI of the service chain field block to point to the next-level network service engine, or setting the Next_OE_Type field to indicate the type of network service to be processed at the next level.

2. The method for implementing a network service chain as described in claim 1, characterized in that, Based on the entry point, network context, ACL rules, and the packet, a decision is made as to whether to perform a first hop.

3. The method for implementing a network service chain as described in claim 1, characterized in that, The first message header is inserted into the service chain field block after MAC SA and before VLAN Ether Type, or after VLAN TAG and before Layer3Ether Type / Length.

4. The method for implementing a network service chain as described in claim 1, characterized in that, The Next_DI points to the next-level network service engine or a normal network exit.

5. The method for implementing a network service chain as described in claim 1, characterized in that, The Next_OE_Type points to the network service type that needs to be processed at the next level.

6. A system for implementing network service chains, characterized in that, Include: The first judgment module is used to receive the first message and determine whether to perform the first hop. A field block module, which is used to insert a service chain field block into the header of the first message to generate a second message; The forwarding module is used to forward the second packet to the first network service engine; The processing module is used to process the second packet in the first network service engine according to the policy routing rules; the method of the first network service engine processing the second packet according to the policy routing rules includes: dropping, forwarding and modifying and forwarding; the method of modifying the second packet includes: modifying the exit Next_DI of the service chain field block to point to the next level network service engine, or setting the Next_OE_Type field to indicate the network service type to be processed at the next level; The second judgment module is used to determine whether to enter the next level network service engine or to remove the service chain field block and send it directly from the network device port.

7. A device for implementing a network service chain, characterized in that, The method includes a memory and a processor, wherein the memory stores a computer program that can be executed by the processor to implement the method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The device contains a computer program that can be executed by a processor of the device in which the computer-readable storage medium is located, to implement the method according to any one of claims 1 to 5.

Images