Security forwarding engine implementation method, device, equipment and storage medium

Abstract

The embodiment of the present application provides a method, apparatus, device and storage medium for implementing a secure forwarding engine, the method comprising: a DPU receives a first message whose destination address is a user virtual machine, the DPU implements a secure forwarding engine based on an open source project, wherein the secure forwarding engine is associated with an access control policy and a flow table unloading function, and forwards the first message according to the access control policy and the flow table unloading function. The embodiment of the present application implements a secure forwarding engine based on an open source project, processes the first message through the secure forwarding engine, combines the access control policy and the flow table unloading function, reduces the configuration complexity, and simplifies the processing logic of the flow table.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of communication technology, and in particular to a method, apparatus, device and storage medium for implementing a secure forwarding engine. Background Art

[0002] With the continuous development of business informatization, the network security boundary is becoming increasingly blurred. Traditional hardware firewalls deployed at the network boundary cannot effectively protect the east-west traffic in the cloud. Faced with the increasing east-west traffic, the traditional OVS (Open vSwitch, open source virtual switch) security group and kernel firewall combination solution can no longer meet user needs in terms of performance and security functions. In the long-term development of OVS, there are many manufacturers who have tried to expand security functions in OVS. In addition to expanding access control and connection tracking based on security groups, higher-level security functions need to rely on other open source tools or kernel implementations. This implementation method has a lot of functional redundancy and consumes a lot of DPU (Data Processing Unit) resources, making it impossible to deploy and run lightweight.

[0003] The existing firewall offloading technology solutions mainly include: (1) Security function configuration is completely based on the access control and connection tracking of the OVS security group, but the supported functional items are few. When configuring connection monitoring through the OVS flow table, multiple commands need to be combined to take effect, and the configuration is complicated. (2) Based on the joint implementation of P4-OVS and VPP (Vector Packet Processing), the virtual machine is deployed to VPP for security business processing. This deployment method consumes a lot of DPU hardware resources. Both P4-OVS and VPP have comprehensive forwarding capabilities. The joint deployment of the two has the problem of functional redundancy and resource consumption. Summary of the invention

[0004] The embodiment of the present application provides a method for implementing a secure forwarding engine, which can greatly reduce configuration complexity and simplify flow table processing logic.

[0005] In a first aspect, an embodiment of the present application provides a method for implementing a secure forwarding engine, including:

[0006] The DPU receives a first message whose destination address is a user virtual machine;

[0007] The DPU implements a secure forwarding engine based on an open source project, where the secure forwarding engine is associated with access control policies and flow table offloading functions;

[0008] The first message is forwarded according to the access control policy and the flow table offloading function.

[0009] The embodiment of the present application implements a security forwarding engine based on an open source project, processes the first message through the security forwarding engine, combines the access control policy and the flow table unloading function, reduces the configuration complexity, and simplifies the processing logic of the flow table.

[0010] Optionally, the security forwarding engine is associated with an access control policy and a table unloading function, including:

[0011] The firewall IPFW in the security forwarding engine performs table matching on the first message;

[0012] When matching the access control policy table item configured by the user, the firewall extracts flow information according to the access control policy table item configured by the user; or,

[0013] When no access control policy entry configured by the user is matched, the firewall extracts flow information according to the default rule.

[0014] Optionally, the firewall creates a session table entry after extracting the flow information;

[0015] The firewall generates a first flow table according to the session table entry and the first rule, and sends the generated first flow table to the hardware driver.

[0016] Optionally, after receiving the first flow table, the hardware driver converts the first flow table into a second flow table corresponding to the first processor, and writes the second flow table into a device including the hardware driver.

[0017] Optionally, the firewall sends the first message to the virtual port through a PMD-driven data plane development kit DPDK according to the access control policy.

[0018] Optionally, the DPU receives a first message whose destination address is a user virtual machine, including:

[0019] The first processor sends the first message to the security forwarding engine when the second flow table is not matched;

[0020] The data plane development kit DPDK driven by PMD running in the security forwarding engine receives the first message.

[0021] In a second aspect, an embodiment of the present application provides a method for implementing a secure forwarding engine, including:

[0022] The user virtual machine sends a first message based on the DPU;

[0023] The DPU implements a secure forwarding engine based on an open source project, and the secure forwarding engine is associated with access control policies and flow table offloading functions;

[0024] According to the access control policy and the flow table offloading function, the first message is forwarded.

[0025] The embodiment of the present application implements a secure forwarding engine based on an open source project. By directly processing the first message through the secure forwarding engine, the consumption of DPU resources can be greatly reduced. The access control policy and flow table offloading function are combined to reduce the configuration complexity and simplify the processing logic of the flow table.

[0026] Optionally, the security forwarding engine is associated with an access control policy and a table unloading function, including:

[0027] The firewall IPFW in the security forwarding engine performs table matching on the first message;

[0028] When matching the access control policy table item configured by the user, the firewall extracts flow information according to the access control policy table item configured by the user; or,

[0029] When no access control policy entry configured by the user is matched, the firewall extracts flow information according to the default rule. Optionally, after extracting the flow information, the firewall creates a session entry;

[0030] The firewall generates a first flow table according to the session table entry and the first rule, and sends the generated first flow table to the hardware driver.

[0031] Optionally, after receiving the first flow table, the hardware driver converts the first flow table into a second flow table corresponding to the first processor, and writes the second flow table into a device including the hardware driver.

[0032] Optionally, the firewall sends the first message to an external physical port through a PMD-driven data plane development kit DPDK according to the access control policy.

[0033] Optionally, the user virtual machine sends the first message based on the DPU, including:

[0034] The first message is sent to a first processor, and the first processor is used to judge the first message;

[0035] If the first message comes from the DPU, the first message is sent to the physical port.

[0036] In a third aspect, an embodiment of the present application provides a secure forwarding engine implementation device, including:

[0037] A receiving module, used for the DPU to receive a first message with a destination address being a user virtual machine;

[0038] An implementation module, used for the DPU to implement a secure forwarding engine based on an open source project; the secure forwarding engine is used to obtain access control policies and flow table unloading functions;

[0039] A forwarding module is used to forward the first message according to the access control policy and the flow table offloading function.

[0040] Optionally, the security forwarding engine implementation device is used to implement the first aspect and any optional implementation method of the first aspect.

[0041] In a fourth aspect, an embodiment of the present application provides a secure forwarding engine implementation device, including:

[0042] A sending module, used for the DPU to receive a first message with a destination address being a user virtual machine;

[0043] An implementation module, used for the DPU to implement a secure forwarding engine based on an open source project; the secure forwarding engine is used to obtain access control policies and flow table unloading functions;

[0044] A forwarding module is used to forward the first message according to the access control policy and the flow table offloading function.

[0045] Optionally, the security forwarding engine implementation device is used to implement the second aspect and any optional implementation method of the second aspect.

[0046] In a fifth aspect, an embodiment of the present application further provides an electronic device, the electronic device comprising:

[0047] at least one processor;

[0048] and a memory communicatively coupled to the at least one processor;

[0049] Among them, the memory stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor to enable the electronic device to execute a method corresponding to any optional embodiment in the first aspect of the embodiment of the present application or execute a method corresponding to any optional embodiment in the second aspect of the embodiment of the present application.

[0050] In the sixth aspect, the embodiments of the present application also provide a computer-readable storage medium, which stores computer execution instructions. When the computer execution instructions are executed by a processor, they are used to implement a method corresponding to any optional embodiment in the first aspect of the embodiments of the present application or to execute a method corresponding to any optional embodiment in the second aspect of the embodiments of the present application.

[0051] In the seventh aspect, the embodiments of the present application also provide a computer program product, which program product includes computer execution instructions, which, when executed by a processor, are used to implement a method corresponding to any optional embodiment in the first aspect of the embodiments of the present application or to execute a method corresponding to any optional embodiment in the second aspect of the embodiments of the present application.

[0052] The security forwarding engine implementation method, device, equipment and medium provided in the embodiments of the present application implement the security forwarding engine based on an open source project. The first message is directly processed by the security forwarding engine, which can greatly reduce the consumption of DPU resources. The access control policy and flow table offloading function are combined to reduce the configuration complexity and simplify the processing logic of the flow table. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0054] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0055] Figure 1 An architecture diagram of a secure forwarding engine implementation method provided in an embodiment of the present application;

[0056] Figure 2 A flow chart of a method for implementing a secure forwarding engine provided in an embodiment of the present application;

[0057] Figure 3 A flowchart of another method for implementing a secure forwarding engine provided in an embodiment of the present application;

[0058] Figure 4 A flow chart of a method for implementing a secure forwarding engine provided in an embodiment of the present application;

[0059] Figure 5 A flowchart of another method for implementing a secure forwarding engine provided in an embodiment of the present application;

[0060] Figure 6 A device diagram of a method for implementing a secure forwarding engine provided in an embodiment of the present application;

[0061] Figure 7 A diagram of another method for implementing a secure forwarding engine provided in an embodiment of the present application;

[0062] Figure 8A diagram of an electronic device for implementing a security forwarding engine method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0063] When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments are only examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the appended claims.

[0064] The following specific embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments. The following will describe the embodiments of the present application in conjunction with the accompanying drawings.

[0065] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0066] With the continuous development of business informatization, the network security boundary is becoming increasingly blurred. Traditional hardware firewalls deployed at the network boundary cannot effectively protect the east-west traffic in the cloud. Faced with the increasing east-west traffic, the traditional OVS (Open vSwitch, open source virtual switch) security group and kernel firewall combination solution can no longer meet user needs in terms of performance and security functions. In the long-term development of OVS, there are many manufacturers who have tried to expand security functions in OVS. In addition to expanding access control and connection tracking based on security groups, higher-level security functions need to rely on other open source tools or kernel implementations. This implementation method has a lot of functional redundancy and consumes a lot of DPU (Data Processing Unit) resources, making it impossible to deploy and run lightweight.

[0067] The existing firewall uninstallation technology solutions mainly include:

[0068] (1) Security function configuration is completely based on the access control and connection tracking of OVS security groups, but the supported functions are few. When configuring connection monitoring through OVS flow tables, multiple commands need to be combined to take effect, which makes the configuration complicated.

[0069] (2) Based on the joint implementation of P4-OVS and VPP (Vector Packet Processing), security business processing is performed by deploying VPP in a virtual machine. This deployment method consumes a lot of DPU hardware resources. Both P4-OVS and VPP have comprehensive forwarding capabilities. The joint deployment of the two has the problem of functional redundancy and resource consumption.

[0070] Based on the problems existing in the above existing technical architecture, such as Figure 1 As shown, the embodiment of the present application proposes an architecture for implementing a secure forwarding engine method, which replaces traditional heavier open source projects such as OVS and VPP with a lightweight secure forwarding engine VFUS developed based on the open source project f-stack, which can greatly reduce the consumption of DPU resources.

[0071] The VFUS protocol stack directly processes the messages to the DPU and various protocol messages, avoiding the problem in the OVS solution that the kernel needs to process the messages to the DPU, and reducing the consumption of the SOC CPU during the processing of the messages to the DPU.

[0072] Combining the access control policy with the flow table offloading function greatly reduces the configuration complexity and simplifies the processing logic of the flow table.

[0073] The combination of the user-mode protocol stack and the security forwarding engine greatly reduces the difficulty and development cycle of adaptation of various security modules.

[0074] For example, in Figure 1 There are two message forwarding paths, one for Figure 2 The slow path corresponding to the embodiment of Figure 3 The fast path corresponding to the embodiment of the invention. When forwarding a message for the first time, the slow path is selected for forwarding, and after the first time, the fast path is selected for forwarding. Figure 1 In the figure, the dotted arrow direction represents the processing flow corresponding to the slow path forwarding, and the arrow direction represents the processing flow corresponding to the fast path forwarding.

[0075] For example, in Figure 1 In the development process, the user-mode protocol stack is combined with the security forwarding engine, which can greatly reduce the difficulty and development cycle of various security module adaptation.

[0076] Figure 2A secure forwarding engine method provided in an embodiment of the present application can be understood as follows: Figure 2 The method shown is based on Figure 1 The architecture is implemented. Figure 2 The corresponding method is not the only method in the embodiment of the present application. Figure 1 The architecture can also implement other methods, which are not limited in the embodiments of the present application.

[0077] Figure 2 The corresponding method comprises the following steps:

[0078] S201. The DPU receives a first message whose destination address is a user virtual machine.

[0079] Optionally, the DPU receives a first message whose destination address is a user virtual machine, including: the first processor (NP) sends the first message to a security forwarding engine when the second flow table is not matched; and the data plane development kit DPDK driven by the PMD running in the security forwarding engine receives the first message.

[0080] It can be understood that the DPU receives the first message through its own physical port and hands the message to the NP for processing. The NP matches the flow table entry for the first message, and if the second flow table is not matched, the first message is sent to the security forwarding engine through the switch port (Uplink Port), wherein the security forwarding engine runs on the second processor SOC of the DPU. Optionally, the way in which the security forwarding engine receives the first message includes at least: receiving the first message through the data plane development kit DPDK driven by the PMD running thereon.

[0081] S202.DPU implements the security forwarding engine VFUS based on the open source project; wherein the security forwarding engine is associated with the access control policy and flow table offloading function.

[0082] Optionally, the security forwarding engine is associated with access control policies and flow table unloading functions, including: the firewall IPFW in the security forwarding engine matches the first message with table items; when a user-configured access control policy item is matched, the firewall extracts flow information according to the user-configured access control policy item; or, when a user-configured access control policy item is not matched, the firewall extracts flow information according to default rules.

[0083] It can be understood that the embodiment of the present application develops a lightweight security forwarding engine VFUS based on the open source project f-stack, and VFUS can directly process various types of messages. The flow table unloading method based on the combination of access control policy and flow information is simple to implement, including: when the user configures the access control policy table items in advance, IPFW extracts the flow information based on the configured access control policy table items, and when the user does not configure the access control policy table items in advance, IPFW extracts the flow information according to the default rules. It can be seen that according to the embodiment of the present application, the security forwarding engine is implemented based on the open source project, and the first message is directly processed by the security forwarding engine. The flow table unloading method based on the combination of access control policy and flow information greatly reduces the configuration complexity and simplifies the processing logic of the flow table.

[0084] Optionally, the firewall creates a session table entry after extracting the flow information.

[0085] Optionally, the firewall generates a first flow table according to the session table entry and the first rule, and sends the generated first flow table to a hardware driver. It can be understood that the hardware driver is a driver of the first processor NP.

[0086] Optionally, after receiving the first flow table, the hardware driver converts the first flow table into a second flow table corresponding to the first processor, and writes the second flow table into a device including the hardware driver.

[0087] It can be understood that during the forwarding process of the first message, after the first flow table is generated, the first flow table is converted into the second flow table by the first processor, and the second flow table is written into the first processor. When forwarding the second message, the flow table item matching can be performed directly on the first processor, which can greatly reduce the consumption of DPU resources, reduce the processing flow, and save processing costs.

[0088] Optionally, the firewall sends the first message to a virtual port through a data plane development kit DPDK driven by a PMD according to an access control policy. The virtual port is a virtual port of the VF.

[0089] S203. Forward the first message according to the access control policy and the flow table offloading function. That is, after the first message reaches the virtual port, it finally reaches the user virtual machine.

[0090] Figure 3 Another possible message forwarding method provided in the embodiment of the present application includes:

[0091] S301. The DPU receives a second message whose destination address is a user virtual machine.

[0092] The DPU receives the second message through its own physical port, and sends the second message to the first processor NP for processing.

[0093] S302. The first processor matches the second message with a flow table entry.

[0094] Exemplarily, the flow table entry here is the second flow table in the above step S202. After the second message matches the flow table entry, the second message is in a sendable state. The second message to be sent is sent to the specified user virtual machine through the bus standard (PCIe).

[0095] S303. Send the second message to the user virtual machine.

[0096] Exemplarily, the second message is sent to the user virtual machine through the virtual port.

[0097] Figure 4 A secure forwarding engine method provided in an embodiment of the present application can be understood as follows: Figure 4 The method shown is based on Figure 1 The architecture is implemented with Figure 2 The difference between the embodiments is that Figure 4 The corresponding is the message sending process, that is, in the figure, the solid arrow and the dotted arrow pointing to VF are in the same direction Figure 2 The corresponding methods are different. Figure 4 In the corresponding method, both the solid arrow and the dotted arrow point downward, that is, from the VF to the physical port. Figure 4 The corresponding methods are described in detail.

[0098] Figure 4 The corresponding method comprises the following steps:

[0099] S401. The user virtual machine sends a first message based on the DPU.

[0100] Exemplarily, the first message is sent to the first processor (NP) through the virtual port VF of the virtual machine. If the first processor does not match the second flow table, the first message is sent to the security forwarding engine; the data plane development kit DPDK driven by the PMD running in the security forwarding engine receives the first message.

[0101] It can be understood that the user virtual machine sends a first message to the NP through the VF. The NP matches the flow table entry for the first message. If the second flow table is not matched, the first message is sent to the security forwarding engine through the switch port (Uplink Port), wherein the security forwarding engine runs on the second processor SOC of the DPU. Optionally, the way in which the security forwarding engine receives the first message at least includes: receiving the first message through the data plane development kit DPDK driven by the PMD running thereon.

[0102] S402.DPU implements the security forwarding engine VFUS based on the open source project; wherein the security forwarding engine is associated with the access control policy and flow table offloading function.

[0103] Optionally, the security forwarding engine is associated with access control policies and flow table unloading functions, including: the firewall IPFW in the security forwarding engine matches the first message with table items; when a user-configured access control policy item is matched, the firewall extracts flow information according to the user-configured access control policy item; or, when a user-configured access control policy item is not matched, the firewall extracts flow information according to default rules.

[0104] It can be understood that the embodiment of the present application develops a lightweight security forwarding engine VFUS based on the open source project f-stack, and VFUS can directly process various types of messages. The flow table unloading method based on the combination of access control policy and flow information is simple to implement, including: when the user configures the access control policy table items in advance, IPFW extracts the flow information based on the configured access control policy table items, and when the user does not configure the access control policy table items in advance, IPFW extracts the flow information according to the default rules. It can be seen that according to the embodiment of the present application, the security forwarding engine is implemented based on the open source project, and the first message is directly processed by the security forwarding engine. The flow table unloading method based on the combination of access control policy and flow information greatly reduces the configuration complexity and simplifies the processing logic of the flow table.

[0105] Optionally, the firewall creates a session table entry after extracting the flow information.

[0106] Optionally, the firewall generates a first flow table according to the session table entry and the first rule, and sends the generated first flow table to a hardware driver. It can be understood that the hardware driver is a driver of the first processor NP.

[0107] Optionally, after receiving the first flow table, the hardware driver converts the first flow table into a second flow table corresponding to the first processor, and writes the second flow table into a device including the hardware driver.

[0108] It can be understood that during the forwarding process of the first message, after the first flow table is generated, the first flow table is converted into the second flow table by the first processor, and the second flow table is written into the first processor. When forwarding the second message, the flow table item matching can be performed directly on the first processor, which can greatly reduce the consumption of DPU resources, reduce the processing flow, and save processing costs.

[0109] Optionally, the firewall sends the first message to an external physical port through a data plane development kit DPDK driven by a PMD according to an access control policy. The physical port is a physical port on a DPU. The DPU includes a second processor SOC.

[0110] S403. Send a first message according to the access control policy and the flow table offloading function.

[0111] Exemplarily, the first message is sent to the first processor NP through the physical port (Physical Port) corresponding to the second processor SOC. The user virtual machine sends the first message based on the DPU, including: sending the first message to the first processor NP, and the first processor is used to judge the first message; if the first message comes from the second processor, sending the first message to the physical port.

[0112] Figure 5 Another possible message sending method provided in the embodiment of the present application includes:

[0113] S3501. The user virtual machine sends a second message.

[0114] Exemplarily, the second message is delivered to the first processor NP for processing through the virtual port.

[0115] S502: The first processor matches the second message with a flow table entry.

[0116] Exemplarily, the second message is processed according to the above flow behavior. The embodiment of the present application will not be described in detail here.

[0117] S503. Send the second message to the physical port.

[0118] Exemplarily, the physical port is a physical port of a DPU.

[0119] Figure 6 The security forwarding engine implementation device provided in the embodiment of the present application is used to implement the above Figure 2 or Figure 3 The method corresponding to the embodiment. The device comprises:

[0120] Receiving module 601, used for the DPU to receive a first message whose destination address is a user virtual machine;

[0121] Implementation module 602, used for the DPU to implement a secure forwarding engine based on an open source project; the secure forwarding engine is used to obtain access control policies and flow table unloading functions;

[0122] The forwarding module 603 is used to forward the first message according to the access control policy and the flow table offloading function.

[0123] Figure 6 The device shown can be used to implement the above Figure 2 or Figure 3 The implementation principles and technical effects of any corresponding method embodiment are similar, and the embodiments of the present application will not be repeated here.

[0124] Figure 7 Another security forwarding engine implementation device provided in the embodiment of the present application is used to implement the above Figure 4 or Figure 5 The method corresponding to the embodiment. The device comprises:

[0125] A sending module 701 is used for the user virtual machine to send a first message based on the DPU;

[0126] Implementation module 702, used for the DPU to implement a secure forwarding engine based on an open source project; the secure forwarding engine is used to obtain access control policies and flow table unloading functions;

[0127] The forwarding module 703 is used to send the first message according to the access control policy and the flow table offloading function.

[0128] Figure 7 The device shown can be used to implement the above Figure 4 or Figure 5 The implementation principles and technical effects of any corresponding method embodiment are similar, and the embodiments of the present application will not be repeated here.

[0129] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 8 As shown, the electronic device 800 includes: a memory 810 and a processor 820 .

[0130] The memory 810 stores a computer program that can be executed by at least one processor 820. The computer program is executed by at least one processor 820 to enable the electronic device to implement the method provided in any of the above embodiments.

[0131] The memory 810 and the processor 820 may be connected via a bus 830 .

[0132] The relevant instructions can be understood by referring to the relevant descriptions and effects corresponding to the method embodiments, which will not be repeated here.

[0133] An embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and the computer program is executed by a processor to implement the following Figures 2 to 5 The method of any corresponding embodiment.

[0134] Among them, the computer-readable storage medium may be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like.

[0135] An embodiment of the present application provides a computer program product, which includes computer-executable instructions, which are used to implement the following when the computer-executable instructions are executed by a processor: Figures 2 to 5 The method of any corresponding embodiment.

[0136] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of modules is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0137] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the disclosure disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope of the present application is indicated by the claims.

[0138] It should be understood that the present application is not limited to the exact construction that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof.

Claims

1. A method for implementing a secure forwarding engine, characterized in that: include: The DPU receives a first message with a destination address of a user virtual machine, wherein the first message is a message with a destination address of a user virtual machine received by the DPU for the first time; The DPU implements a secure forwarding engine VFUS based on the open source project f-stack; the secure forwarding engine is associated with access control policies and flow table offloading functions; forwarding the first message according to the access control policy and the flow table offloading function; The security forwarding engine is associated with the access control policy and flow table offloading function, including: The firewall IPFW in the security forwarding engine performs table matching on the first message; When matching the access control policy table item configured by the user, the firewall extracts flow information according to the access control policy table item configured by the user; or, When no access control policy entry configured by the user is matched, the firewall extracts flow information according to the default rule; The DPU receives a second message whose destination address is the user virtual machine, wherein the second message is a message whose destination address is the user virtual machine and is not received for the first time by the DPU; The first processor matches the flow table entry on the second message; Send the second message to the user virtual machine.

2. The method according to claim 1, characterized in that After extracting the flow information, the firewall creates a session table entry; The firewall generates a first flow table according to the session table entry and the first rule, and sends the generated first flow table to the hardware driver.

3. The method according to claim 2, characterized in that After receiving the first flow table, the hardware driver converts the first flow table into a second flow table corresponding to the first processor, and writes the second flow table into the device including the hardware driver.

4. The method according to any one of claims 1 to 3, characterized in that: include: The firewall sends the first message to the virtual port through the PMD-driven data plane development kit DPDK according to the access control policy.

5. The method according to any one of claims 1 to 3, characterized in that: The DPU receives a first message whose destination address is a user virtual machine, including: The first processor sends the first message to the security forwarding engine when the second flow table is not matched; The data plane development kit DPDK driven by PMD running in the security forwarding engine receives the first message.

6. A secure forwarding engine implementation device, characterized in that: include: A receiving module, configured for the DPU to receive a first message with a destination address of a user virtual machine, wherein the first message is a message with a destination address of a user virtual machine received for the first time by the DPU; An implementation module, used for the DPU to implement a security forwarding engine VFUS based on the open source project f-stack; the security forwarding engine is used to obtain access control policies and flow table unloading functions; A forwarding module, configured to forward the first message according to the access control policy and the flow table offloading function; The implementation module is also used for the firewall IPFW in the security forwarding engine to match the first message with a table item; when matching the access control policy table item configured by the user, the firewall extracts the flow information according to the access control policy table item configured by the user; or when not matching the access control policy table item configured by the user, the firewall extracts the flow information according to the default rule; The forwarding module is also used to receive a second message whose destination address is the user virtual machine through the DPU, match the second message with a flow table entry through the first processor, and send the second message to the user virtual machine, wherein the second message is a message whose destination address is the user virtual machine and is not received for the first time by the DPU.

7. An electronic device, characterized in that: include: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the electronic device to perform the method as claimed in any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

9. A computer program product comprising computer executable instructions, characterized in that: When the computer-executable instructions are executed by a processor, they are used to implement the method according to any one of claims 1 to 5.

Images