Data processing method, device, equipment, storage medium and program product

Abstract

The present application discloses a data processing method, device, equipment, storage medium and program product. The method includes: receiving data to be processed, determining the target security group corresponding to the data to be processed from the security group information of the virtual switch; the security group information includes port information corresponding to different security groups, and rules corresponding to each security group, and the rules corresponding to the security group are used to indicate data processing rules between different security groups and data processing rules between ports corresponding to different security groups; generating target data based on the target security group and the data to be processed; the target data carries the data information of the data to be processed and the identifier of the target security group; filtering the target rules corresponding to the target data from the rules corresponding to the target security group according to the data information of the target data, and processing the target data according to the target rules. The use of this method can reduce the number of rules added when the rules are updated, reduce memory consumption, and avoid affecting the performance of the virtual switch.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a data processing method, apparatus, device, storage medium and program product. Background Art

[0002] A security group is a virtual firewall that manages network access for virtual machines in a cloud computing environment. It defines the rules for sending messages (egress) and receiving messages (ingress) by virtual machine network cards, and implements the data processing rules of the security group through the flow table function to ensure network security. Virtual machine network cards with the same network security requirements correspond to the same security group.

[0003] When taking security groups as units, if you need to add a rule from one security group to another security group, you need to add rules for each network card corresponding to the source security group and each network card corresponding to the destination security group, which will generate a large number of flow table rules, consume a lot of memory, and affect the performance of the virtual switch. Summary of the invention

[0004] In view of the above-mentioned defects or deficiencies in the prior art, it is desired to provide a data processing method, apparatus, device, storage medium and program product, which can only add rules from the source security group to each port of the destination security group when specifying rules from a certain security group (source security group) to another security group (destination security group), thereby effectively reducing the number of rules, reducing memory consumption, and avoiding affecting the performance of the virtual switch.

[0005] In a first aspect, the present application provides a data processing method, which is applied to a virtual switch. The method comprises:

[0006] Receive data to be processed, and determine a target security group corresponding to the data to be processed from security group information of the virtual switch; the security group information includes port information corresponding to different security groups and rules corresponding to each security group, and the rules corresponding to the security group are used to indicate data processing rules between different security groups and data processing rules between ports corresponding to different security groups;

[0007] Generate target data based on the target security group and the data to be processed; the target data carries data information of the data to be processed and an identifier of the target security group;

[0008] According to the data information of the target data, the target rules corresponding to the target data are filtered from the rules corresponding to the target security group, and the target data is processed according to the target rules.

[0009] In combination with the first aspect, in a possible implementation method, the port information includes address information of the port, and the target security group corresponding to the data to be processed is determined from the security group information of the virtual switch, including: parsing the data to be processed to determine the address parameters corresponding to the data to be processed; matching the address parameters of the data to be processed with the address information of the port corresponding to the virtual switch, and determining the target port corresponding to the data to be processed based on the matching results; determining the target security group corresponding to the data to be processed based on the security group corresponding to the target port.

[0010] In combination with the first aspect, in a possible implementation method, target rules corresponding to the target data are filtered from the rules corresponding to the target security group according to the data information of the target data, including: filtering the rules corresponding to the target security group from the security group information according to the identifier of the target security group to obtain multiple candidate rules; and determining the target rules corresponding to the target data from the multiple candidate rules according to the address information of the target data.

[0011] In combination with the first aspect, in a possible implementation method, the process of constructing security group information includes: creating multiple security group identifiers and establishing a correspondence between each security group identifier and the port information of the virtual machine; constructing security group information based on multiple security group identifiers, port information corresponding to each security group identifier, data processing rules corresponding to each security group identifier and data processing rules corresponding to each port.

[0012] In combination with the first aspect, in a possible implementation, the data processing method also includes: receiving an inter-group rule update instruction; the inter-group rule update instruction is used to indicate the update of data processing rules from the first security group to the second security group; generating data processing rules between each port of the first security group and the second security group according to the inter-group rule update instruction; the number of data processing rules is the same as the number of ports corresponding to the second security group; and updating the security group information according to the data processing rules between each port of the first security group and the second security group.

[0013] In combination with the first aspect, in a possible implementation, the address parameter type of the data to be processed includes the address parameter of the source device and the address parameter of the destination device, and the data processing method also includes: determining the address parameter type of the data to be processed that matches the target port, and determining the data type of the data to be processed based on the address parameter type; the data type includes outbound data and inbound data; filtering the rules corresponding to the data type from the security group information based on the data type of the data to be processed; and determining the target security group corresponding to the data to be processed from the rules corresponding to the data type of the data to be processed based on the security group corresponding to the target port.

[0014] In a second aspect, the present application also provides a data processing device. The device includes:

[0015] A determination module is used to receive the data to be processed and determine the target security group corresponding to the data to be processed from the security group information of the virtual switch; the security group information includes port information corresponding to different security groups and rules corresponding to each security group, and the rules corresponding to the security group are used to indicate data processing rules between different security groups and data processing rules between ports corresponding to different security groups;

[0016] A generation module, used to generate target data based on the target security group and the data to be processed; the target data carries data information of the data to be processed and an identifier of the target security group;

[0017] The processing module is used to filter the target rules corresponding to the target data from the rules corresponding to the target security group according to the data information of the target data, and process the target data according to the target rules.

[0018] In a third aspect, the present application further provides a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0019] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0020] In a fifth aspect, the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0021] The embodiments of the present application provide a data processing method, apparatus, device, storage medium and program product, which can set data processing rules (inter-group rules) between security groups in the security group information of the virtual switch, that is, to specify the rules from a certain security group (source security group) to another security group (destination security group). When adding rules, only the rules for each port from the source security group to the destination security group need to be added, which effectively reduces the number of rules, reduces memory consumption, and avoids affecting the performance of the virtual switch. Accordingly, under this rule setting method, after the virtual switch receives the data to be processed and determines the target security group corresponding to the data to be processed, it is necessary to add the identifier of the target security group to the data to be processed and generate the target data, so that the flow table of the virtual switch can determine the inter-group rules corresponding to the target data according to the identifier of the target security group, and then further determine the target rule corresponding to the target data from the inter-group rules according to the data information of the target data. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0023] Figure 1 is a flow chart of a data processing method in one embodiment;

[0024] Figure 2 is another flow chart of a data processing method in one embodiment;

[0025] Figure 3 is another flow chart of a data processing method in one embodiment;

[0026] Figure 4 is another flow chart of a data processing method in one embodiment;

[0027] Figure 5 A schematic diagram of an updating process of a security group in security group information in an embodiment;

[0028] Figure 6 is another flow chart of a data processing method in one embodiment;

[0029] Figure 7 A schematic diagram of an inter-group rule update process in security group information in an embodiment;

[0030] Figure 8 is another flow chart of a data processing method in one embodiment;

[0031] Fig. 9 A schematic diagram of data type matching in one embodiment;

[0032] Fig.10 An application environment diagram of a data processing method in an embodiment;

[0033] Fig.11 is a structural block diagram of a data processing device in one embodiment;

[0034] Fig.12 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0035] The present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It is also necessary to explain that, for ease of description, only the parts related to the invention are shown in the accompanying drawings.

[0036] It should be noted that, in the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments. In addition, the term "and / or" herein is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The terms "first" and "second" in the description and claims of the embodiments of the present application are used to distinguish different objects, rather than to describe a specific order of objects.

[0037] A security group is a virtual firewall that manages network access for virtual machines in a cloud computing environment. It defines the rules for sending messages (egress) and receiving messages (ingress) by virtual machine network cards, and implements the data processing rules of the security group through the flow table function to ensure network security. Virtual machine network cards with the same network security requirements correspond to the same security group.

[0038] When adding a rule from one security group to another security group, you need to add rules for each network card corresponding to the source security group and each network card corresponding to the destination security group, which will generate a large number of flow table rules, consume a lot of memory, and affect the performance of the virtual switch. For example, if there are m network cards that need to follow the data processing rules of security group A, and n network cards that need to follow the data processing rules of security group B, then when adding a data processing rule from security group A to security group B, you need to add rules for each network card included in security group A to each network card included in security group B, that is, add m*n data processing rules (i.e., flow table rules), and the amount of data is large.

[0039] At present, it is often achieved by planning the networking of the security group network card, that is, establishing a mapping relationship between the security group and the subnet (only adding the network cards of the same subnet to the same security group). In this way, the rules of the security group can be added through the network address of the corresponding subnet, and only the rules between the subnet and the network card of another security group are added, thereby effectively reducing the number of flow table rules. However, this method changes the network security control granularity of the security group from the network card to the subnet, and the network cards of different subnets cannot be added to the same security group, which affects the application scope of the security group function.

[0040] Based on the above problems, an embodiment of the present application provides a data processing method, which can only add rules from the source security group to each port of the destination security group when specifying rules from a certain security group (source security group) to another security group (destination security group), thereby effectively reducing the number of rules, reducing memory consumption, and avoiding affecting the performance of the virtual switch.

[0041] In one embodiment, a data processing method is provided, which is applied to a virtual switch running in a server or a server cluster. Figure 1 As shown, this embodiment includes the following steps:

[0042] Step 101: Receive data to be processed, and determine a target security group corresponding to the data to be processed from security group information of the virtual switch.

[0043] The security group information includes port information corresponding to different security groups and rules corresponding to each security group. The rules corresponding to the security group are used to indicate data processing rules between different security groups and data processing rules between ports corresponding to different security groups.

[0044] In the embodiment of the present application, a virtual switch may be first constructed based on user instructions, interfaces of the virtual switch may be configured, and a hook function may be set on each interface of the virtual switch.

[0045] As can be understood, the virtual switch is used to transmit data between virtual machines, or between a virtual machine and a physical machine, that is, to forward the data to be processed from the source device to the destination device. The security group information of the virtual switch specifies the data processing rules between the ports of different devices (i.e. the above-mentioned network cards).

[0046] Therefore, the security group information of the virtual switch includes multiple security groups, rules corresponding to each security group, and port information that follows the rules of the security group. The rules corresponding to the security group include data processing rules between each port corresponding to the security group and each port corresponding to other security groups, for example, data processing rules from port 1 of security group A to each port of security group B, data processing rules from port 1 of security group A to each port of security group C, ... data processing rules from port 2 of security group A to each port of security group B, data processing rules from port 2 of security group A to each port of security group C, etc.; and also include data processing rules between the security group and other security groups, for example, data processing rules from (all ports of) security group A to each port of security group B, data processing rules from (all ports of) security group A to each port of security group C, etc.

[0047] When the virtual switch receives data to be processed from a certain interface, the interface of the virtual switch intercepts the data to be processed through a hook function. Then the data to be processed is parsed, and the relevant parameters of the data to be processed obtained by parsing are matched in the security group information to determine the security group corresponding to the data to be processed, that is, the target security group. The rules in the target security group are the data processing rules that the data to be processed must follow when it flows in the virtual switch.

[0048] Step 102: Generate target data based on the target security group and the data to be processed.

[0049] In the embodiment of the present application, after the virtual switch parses the data to be processed, it adds the identifier of the target security group to the data to be processed to generate the target data. In this way, when the data to be processed needs to follow the data processing rules between security groups, the flow table can determine the data processing rules corresponding to the data to be processed based on the security group identifier carried by the target data. Therefore, the target data carries the data information of the data to be processed and the identifier of the target security group.

[0050] Step 103: Filter target rules corresponding to the target data from the rules corresponding to the target security group according to the data information of the target data, and process the target data according to the target rules.

[0051] In the embodiment of the present application, the virtual switch can filter out the rules corresponding to the target security group from the security group information according to the identifier of the target security group carried by the target data. The rules corresponding to the target security group include data processing rules from each port corresponding to the target security group to each port of other security groups, and / or data processing rules (inter-group rules) from the target security group to each port of other security groups.

[0052] Then, the target data is matched with the relevant parameters of the target security group's rules according to the data information of the target data, and the target rule corresponding to the target data in the target security group's rules is further determined. For example, the address information of the target data is matched with the address information of the port corresponding to each rule of the target security group, and the rule corresponding to the port matching the address information of the target data is the target rule.

[0053] In the method provided in the embodiment of the present application, data processing rules (inter-group rules) between security groups can be set in the security group information of the virtual switch, that is, rules for a certain security group (source security group) to another security group (destination security group) are specified. When adding rules, only the rules for each port from the source security group to the destination security group need to be added, which effectively reduces the number of rules, reduces memory consumption, and avoids affecting the performance of the virtual switch. Correspondingly, under this rule setting method, after the virtual switch receives the data to be processed and determines the target security group corresponding to the data to be processed, it is necessary to add the identifier of the target security group to the data to be processed and generate the target data, so that the flow table of the virtual switch can determine the inter-group rules corresponding to the target data according to the identifier of the target security group, and then further determine the target rule corresponding to the target data from the inter-group rules according to the data information of the target data.

[0054] The above-mentioned embodiment provides a solution for determining the target security group of the data to be processed. In another embodiment of the present application, the port information may be the address information of each port, and the target security group corresponding to the data to be processed may be determined according to the address information of the data to be processed and the address information of each port of each security group. This embodiment includes the following: Figure 2 Steps shown:

[0055] Step 201: parse the data to be processed and determine the address parameters corresponding to the data to be processed.

[0056] Step 202: Match the address parameters of the data to be processed with the address information of the port corresponding to the virtual switch, and determine the target port corresponding to the data to be processed according to the matching result.

[0057] Step 203: Determine the target security group corresponding to the data to be processed according to the security group corresponding to the target port.

[0058] In the embodiment of the present application, after receiving the data to be processed, the virtual switch parses the data packet protocol header of the data to be processed to determine the MAC address of the source device of the data to be processed, the MAC address of the destination device, the IP address, the protocol type and other parameters. The MAC address of the source device of the data to be processed and the MAC address of the destination device are selected as the address parameters of the data to be processed. Then, the address information of each port of multiple virtual machines or physical machines corresponding to the virtual switch is obtained from the memory.

[0059] The MAC address of the source device of the data to be processed and the address information of each port of multiple devices (virtual machines or physical machines) corresponding to the virtual switch are matched in turn, and the MAC address of the destination device of the data to be processed and the address information of each port of multiple devices corresponding to the virtual switch are matched to obtain a matching result.

[0060] The matching result may include that the MAC address of the source device of the data to be processed matches the address information of one of the ports, or the MAC address of the destination device of the data to be processed matches the address information of one of the ports, or there is no match between the address information of any port and the MAC address of the source device of the data to be processed and the MAC address of the destination device.

[0061] When the matching result indicates that the address information of one of the ports matches the MAC address of the source device or the MAC address of the destination device of the data to be processed, the port that matches the address information of the data to be processed is the target port. The security group corresponding to the target port in the security group information is the target security group of the data to be processed, indicating that the data to be processed needs to follow the rules of the target security group.

[0062] Accordingly, the solution of "generating target data based on the target security group and the data to be processed" can be to generate the target data based on the parsing result of the data to be processed and the identifier of the target security group. Specifically, the target data can be a data packet composed of data type parameters and meta type parameters, wherein the parsing result of the data packet protocol header of the data to be processed (MAC address of the source device, MAC address of the target device, IP address, protocol type and other parameters) constitutes the data type parameter; the intermediate result of the processing of the data to be processed in the virtual switch and the identifier of the target security group constitute the meta type parameter. Among them, the identifier of the target security group can occupy the sg_uuid field in the meta type parameter.

[0063] The method provided in the embodiment of the present application can determine the device port corresponding to the data to be processed by matching the address information, and the security group corresponding to the device port in the security group information is the target security group corresponding to the data to be processed. The target security group corresponding to the data to be processed can be determined accurately and quickly by matching the address.

[0064] The above-mentioned embodiment introduces a scheme for further filtering the target rules corresponding to the target data from the rules of the target security group. In another embodiment of the present application, the target rules can be further filtered by address information. This embodiment includes the following: Figure 3 Steps shown:

[0065] Step 301: Filter the rules corresponding to the target security group from the security group information according to the identifier of the target security group to obtain multiple candidate rules.

[0066] Step 302: Determine a target rule corresponding to the target data from multiple candidate rules according to the address information of the target data.

[0067] In the embodiment of the present application, after the target data is generated, the flow table function of the virtual switch can be jumped to. The flow table first filters the information of the target security group from the security group information of the virtual switch based on the identifier of the target security group carried by the target data. The information of the target security group includes the information of the port corresponding to the target security group and the rules corresponding to the target security group (i.e., candidate rules).

[0068] It can be understood that the rules corresponding to the target security group include the data processing rules (inter-group rules) from the target security group (source security group) to each port of another security group (destination security group), and / or the data processing rules from each port in the target security group to each port of another security group. That is, the rules of the target security group are the data processing rules that flow from the source security group and / or source port to the destination port.

[0069] Therefore, the address information of the destination device of the target data is matched with the address information of the destination port corresponding to each rule of the target security group to determine the target rule corresponding to the target data in the inter-group rule. That is, the rule in the inter-group rule where the address information of the destination port matches the address information of the destination device of the target data is the target rule.

[0070] The address information of the source device of the target data is matched with the address information of the source port corresponding to each rule of the target security group, and at the same time, the address information of the destination device of the target data is matched with the address information of the destination port corresponding to each rule of the target security group, and the target rule corresponding to the target data in the rule of the security group is determined. That is, the rule whose address information of the source port matches the address information of the source device of the target data and whose address information of the destination port matches the address information of the destination device of the target data is the target rule.

[0071] The method provided in the embodiment of the present application first filters out the rules of the target security group through the identifier of the target security group, and then determines the target rule corresponding to the target data in the rules corresponding to the target security group through the matching result of the address information of the target data and the address information of the port corresponding to the rule of the target security group. This target rule determination method can take into account the data processing rules between different ports and the data processing rules between different security groups, thereby ensuring the integrity and accuracy of the target rule.

[0072] The above-mentioned embodiment introduces a scheme for setting inter-group rules in security group information. In another embodiment of the present application, a construction process of security group information of a virtual switch is provided. This embodiment includes the following steps: Figure 4 Steps shown:

[0073] Step 401: Create multiple security group identifiers, and establish a corresponding relationship between each security group identifier and the port information of the virtual machine.

[0074] Step 402: Construct security group information based on multiple security group identifiers, port information corresponding to each security group identifier, data processing rules corresponding to each security group identifier, and data processing rules corresponding to each port.

[0075] In the embodiment of the present application, a plurality of security group identifiers are first created, and then a correspondence is established between the port information of the virtual machine that needs to follow the rules of the security group and the security group identifier.

[0076] The security group identifier is unique. One virtual machine port corresponds to one security group, and one security group can correspond to multiple virtual machine ports.

[0077] In one possible implementation, you can set a set container and set its value between 0 and 2. 32-1, and then use the value returned by the pop function as the security group identifier. When a created security group is deleted, the identifier of the deleted security group can be added back to the set container.

[0078] After the corresponding relationship between the security group and the port is established, if the port rules need to be updated, a new security group is created to correspond to the port. For example, when a port needs to apply the rules of multiple security groups, the original security group is retained, the corresponding relationship between the port and the original security group is deleted, the multiple security group rules are merged to generate a new security group, and the corresponding relationship between the port and the newly created security group is established.

[0079] like Figure 5 As shown in the figure, the virtual switch corresponds to four virtual machine ports vnet1, vnet2, vnet3, and vnet4, and two security groups (security group A and security group B) are used as an example to illustrate:

[0080] The identifier of security group A is 1, and the identifier of security group B is 2. The ports corresponding to security group A are vnet1 and vnet2, and the ports corresponding to security group B are vnet3 and vnet4.

[0081] When the port requires vnet1 to apply the rules of both security group A and security group B, retain security group A and security group B, and delete the corresponding relationship between vnet1 and security group A; merge the rules of security group A and security group B to generate security group C (and create security group C with the identifier 3), and establish the corresponding relationship between vnet1 and security group C (identifier 3).

[0082] In one possible implementation, different data processing rules may correspond to different priorities. When merging the rules of multiple security groups, the rules may be sorted from high to low by priority, and the sorted rules may also be expressed as the order in which the rules take effect. When the priorities are the same, the order in which the rules merged into the new security group later take effect may be set first.

[0083] In a possible implementation, the update of security group information may also be to add new inter-group rules. This embodiment includes the following: Figure 6 Steps shown:

[0084] Step 501: Receive an inter-group rule update instruction.

[0085] Step 502: Generate data processing rules between the ports of the first security group and the second security group according to the inter-group rule update instruction.

[0086] Step 503: Update the security group information according to the data processing rules between the ports of the first security group and the second security group.

[0087] The inter-group rule update instruction is used to instruct updating of data processing rules from the first security group to the second security group.

[0088] In an embodiment of the present application, when an inter-group rule update instruction is received, the instruction is parsed to determine a newly added data processing rule from the first security group to the second security group, indicating that all ports of the first security group to all ports of the second security group must follow the data processing rule.

[0089] Because in the actual data processing process, when the data to be processed needs to follow the rules of the first security group, the virtual machine will add the identifier of the first security group to the data to be processed. Therefore, when generating the data processing rules added to the security group information based on the inter-group rule update instruction, it is only necessary to add data processing rules for each port from the first security group to the second security group, that is, the number of generated data processing rules is the same as the number of ports corresponding to the second security group.

[0090] Add the generated data processing rules to the security group information to complete the update of the security group information. Figure 7 The code shown implements the addition of data processing rules in the flow table (security group information).

[0091] The method provided in the embodiment of the present application can construct security group information of the virtual switch based on the data processing rules between ports and the data processing rules between security groups, so that when the rules between groups are updated, it is only necessary to add the rules of each port from the source security group to the destination security group. The number of rules added is the number of ports of the destination security group, which effectively reduces the number of new rules, reduces memory consumption, and avoids affecting the performance of the virtual switch.

[0092] In one embodiment, in the process of determining the target rule of the data to be processed, the data type of the data to be processed can also be used as one of the screening criteria. This embodiment includes the following: Figure 8 Steps shown:

[0093] Step 601: Determine the address parameter type of the data to be processed that matches the target port, and determine the data type of the data to be processed according to the address parameter type.

[0094] Step 602: Filter rules corresponding to the data type from the security group information according to the data type of the data to be processed.

[0095] Step 603: Determine the target security group corresponding to the data to be processed from the rules corresponding to the data type of the data to be processed according to the security group corresponding to the target port.

[0096] The embodiment described above provides a scheme for matching the address parameters of the source device and the address parameters of the destination device included in the parsing result of the data packet protocol header of the data to be processed with the information of each port in the security group information. The obtained matching result includes that the address parameter (MAC address) of the source device of the data to be processed matches the address information of one of the ports, or the address parameter of the destination device of the data to be processed matches the address information of one of the ports, or the address information of no port matches the address parameter of the source device of the data to be processed and the address parameter of the destination device.

[0097] The address parameters of the source device and the destination device are the address parameter types. The data types include outgoing data and incoming data.

[0098] In the embodiment of the present application, the address parameter type that matches the target port in the address parameter of the data to be processed can be determined based on the matching result. When the address parameter type is the address parameter of the source device, the data to be processed is outbound data; when the address parameter type is the address parameter of the destination device, the data to be processed is inbound data.

[0099] The code to implement data type matching can be as follows Fig. 9 As shown, the non-security group network card data packet is the data to be processed that does not have a matching port.

[0100] Correspondingly, since the virtual switch has different processing methods for outgoing data and incoming data, the security group information corresponding to the virtual switch includes two types of rules: egress rules for the outgoing flow table and ingress rules for the ingress flow table.

[0101] Therefore, after the virtual switch determines the data type of the data to be processed and adds the identifier of the target security group corresponding to the target port to the data to be processed (i.e., generates the target data), the corresponding flow table function (egress flow table, ingress flow table) can be called based on the data type of the data to be processed. The corresponding flow table function processes the data to be processed according to the corresponding flow table rules, that is, the egress flow table egress processes the data to be processed (outbound data) based on the egress flow table egress rules in the security group information, and the ingress flow table ingress processes the data to be processed (inbound data) based on the ingress flow table ingress rules in the security group information.

[0102] Further, the flow table function filters out the rules corresponding to the target security group from the corresponding flow table rules based on the identifier of the target security group of the data to be processed. The subsequent scheme of further filtering the target rules from the rules corresponding to the target security group based on the address information of the data to be processed and the port information corresponding to the target security group is as described in the above embodiment and will not be repeated here.

[0103] It should be noted that, for the data to be processed that does not have a matching port in the security group information, it means that the processing of the data to be processed does not need to follow the data processing rules in the security group information. Therefore, the virtual switch processes the data to be processed in the normal mode.

[0104] The solution provided by the embodiment of the present application takes into account the different ways in which the virtual switch processes different types of data to be processed. The rules corresponding to the data type can be first filtered from the security group information based on the data type of the data to be processed, and then the rules of the target security group can be further filtered from the rules corresponding to the data type based on the identifier of the target security group. The embodiment of the present application gradually determines the rules corresponding to the data to be processed from the security group information through multiple rule screening criteria, which effectively improves the accuracy of rule determination and thus improves the accuracy of data processing.

[0105] The data processing method of the embodiment of the present application can also be applied to Fig.10 The virtual switch architecture shown in the figure includes a user side (user state) and a kernel module component (kernel state). A virtual switch service runs on the user side, which can receive and parse the user's relevant instructions through the listening socket and send them to the kernel module component through the netlink protocol. The kernel module components include a data path module, a port module, and a flow table module. The data path module can create a virtual switch based on user instructions; the port module can add and manage the ports of the virtual machine corresponding to the virtual switch, and add hook functions to each port; the flow table module can create and manage flow table rules (security group information) based on user instructions, and process the data to be processed based on the flow table rules.

[0106] It should be noted that although the operations of the method of the present invention are described in a particular order in the accompanying drawings, this does not require or imply that the operations must be performed in this particular order, or that all the operations shown must be performed to achieve the desired results. On the contrary, the steps depicted in the flow chart can be performed in a different order. Additionally or alternatively, some steps can be omitted, multiple steps can be combined into one step, and / or one step can be decomposed into multiple steps.

[0107] In one embodiment, Fig.11 As shown, a data processing device is provided, including: a determination module 701, a generation module 702 and a processing module 703, wherein:

[0108] The determination module 701 is used to receive the data to be processed, and determine the target security group corresponding to the data to be processed from the security group information of the virtual switch; the security group information includes port information corresponding to different security groups, and rules corresponding to each security group, and the rules corresponding to the security group are used to indicate data processing rules between different security groups and data processing rules between ports corresponding to different security groups;

[0109] A generating module 702 is used to generate target data based on the target security group and the data to be processed; the target data carries data information of the data to be processed and an identifier of the target security group;

[0110] The processing module 703 is used to filter the target rules corresponding to the target data from the rules corresponding to the target security group according to the data information of the target data, and process the target data according to the target rules.

[0111] In one embodiment, the port information includes the address information of the port, and the determination module 701 is specifically used to parse the data to be processed and determine the address parameters corresponding to the data to be processed; match the address parameters of the data to be processed with the address information of the port corresponding to the virtual switch, and determine the target port corresponding to the data to be processed according to the matching result; determine the target security group corresponding to the data to be processed according to the security group corresponding to the target port.

[0112] In one embodiment, the processing module 703 is specifically used to filter out rules corresponding to the target security group from the security group information according to the identifier of the target security group to obtain multiple candidate rules; and determine the target rule corresponding to the target data from the multiple candidate rules according to the address information of the target data.

[0113] In one embodiment, the data processing device also includes a construction module for creating multiple security group identifiers and establishing a correspondence between each security group identifier and the port information of the virtual machine; based on multiple security group identifiers, the port information corresponding to each security group identifier, the data processing rules corresponding to each security group identifier and the data processing rules corresponding to each port, the security group information is constructed.

[0114] In one embodiment, the data processing device also includes an update module for receiving an inter-group rule update instruction; the inter-group rule update instruction is used to instruct the update of data processing rules from the first security group to the second security group; data processing rules between each port of the first security group and the second security group are generated according to the inter-group rule update instruction; the number of data processing rules is the same as the number of ports corresponding to the second security group; and the security group information is updated according to the data processing rules between each port of the first security group and the second security group.

[0115] In one embodiment, the address parameter type of the data to be processed includes the address parameter of the source device and the address parameter of the destination device. The data processing device also includes a screening module for determining the address parameter type of the data to be processed that matches the target port, and determining the data type of the data to be processed according to the address parameter type; the data type includes outbound data and inbound data; according to the data type of the data to be processed, the rules corresponding to the data type are screened from the security group information; according to the security group corresponding to the target port, the target security group corresponding to the data to be processed is determined from the rules corresponding to the data type of the data to be processed.

[0116] It should be understood that the units or modules described in the data processing device are similar to those described in the reference Figure 1 The steps in the described method correspond to each other. Therefore, the operations and features described above for the method are also applicable to the data processing device and the units contained therein, and will not be repeated here. The data processing device can be pre-implemented in the browser or other security application of the electronic device, or loaded into the browser or its security application of the electronic device by downloading or the like. The corresponding units in the data processing device can cooperate with the units in the electronic device to implement the solution of the embodiment of the present application.

[0117] Reference below Fig.12 , which shows a schematic diagram of the structure of a computer system 800 of a terminal device or server suitable for implementing an embodiment of the present application.

[0118] like Fig.12 As shown, the computer system 800 includes a central processing unit (CPU) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage part 808 to a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the system 800 are also stored. The CPU 801, the ROM 802, and the RAM 803 are connected to each other through a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0119] The following components are connected to the I / O interface 805: an input section 806 including a keyboard, a mouse, etc.; an output section 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, a modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the I / O interface 805 as needed. A removable medium 811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 810 as needed, so that a computer program read therefrom is installed into the storage section 808 as needed.

[0120] In particular, according to the embodiments of the present disclosure, the above reference Figure 1 The described processes may be implemented as computer software programs. For example, embodiments of the present disclosure include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program comprising a computer program for executing Figure 1 In such an embodiment, the computer program may be downloaded and installed from a network via the communication section 809 and / or installed from the removable medium 811.

[0121] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium such as a computer-readable storage medium that can send, propagate or transmit a program for use by or in conjunction with an instruction execution system, device or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0122] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a different order from the order marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0123] The units or modules involved in the embodiments described in the present application may be implemented by software or hardware. The units or modules described may also be arranged in a processor. The names of these units or modules do not, in some cases, constitute limitations on the units or modules themselves.

[0124] As another aspect, the present application further provides a computer-readable storage medium, which may be included in the computer device described in the above embodiment, or may exist independently without being assembled into the computer device. The above computer-readable storage medium stores one or more programs, and when the above programs are used by one or more processors to execute the method described in the present application. For example, the various steps of the method shown in the figure can be executed.

[0125] The present application embodiment provides a computer program product, which includes instructions. When the instructions are executed, the method described in the present application embodiment is executed. For example, Figure 1 The individual steps of the method are shown.

[0126] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0127] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the inventive concept. For example, the above features are replaced with (but not limited to) technical features with similar functions disclosed in the present application.

Claims

1. A data processing method, characterized in that: Applied to a virtual switch, the method comprises: receiving data to be processed, and determining a target security group corresponding to the data to be processed from security group information of the virtual switch; the security group information includes port information corresponding to different security groups, and rules corresponding to each of the security groups, the rules corresponding to the security groups are used to indicate data processing rules between different security groups and data processing rules between ports corresponding to different security groups; the port information includes address information of the port; Generate target data based on the target security group and the data to be processed; the target data carries data information of the data to be processed and an identifier of the target security group; Filtering target rules corresponding to the target data from the rules corresponding to the target security group according to the data information of the target data, and processing the target data according to the target rules; The determining, from the security group information of the virtual switch, a target security group corresponding to the data to be processed includes: Parsing the data to be processed to determine address parameters corresponding to the data to be processed; Matching the address parameters of the data to be processed with the address information of the port corresponding to the virtual switch, and determining the target port corresponding to the data to be processed according to the matching result; Determine the target security group corresponding to the data to be processed according to the security group corresponding to the target port; The process of constructing the security group information includes: Create multiple security group identifiers, and establish a corresponding relationship between each of the security group identifiers and the port information of the virtual machine; The security group information is constructed based on the multiple security group identifiers, the port information corresponding to each of the security group identifiers, the data processing rules corresponding to each of the security group identifiers, and the data processing rules corresponding to each of the ports.

2. The method according to claim 1, characterized in that The step of filtering the target rules corresponding to the target data from the rules corresponding to the target security group according to the data information of the target data includes: Filtering rules corresponding to the target security group from the security group information according to the identifier of the target security group to obtain multiple candidate rules; A target rule corresponding to the target data is determined from the multiple candidate rules according to the address information of the target data.

3. The method according to claim 1, characterized in that The method further comprises: receiving an inter-group rule update instruction; the inter-group rule update instruction is used to instruct to update the data processing rules from the first security group to the second security group; Generate data processing rules between the first security group and the ports of the second security group according to the inter-group rule update instruction; the number of the data processing rules is the same as the number of ports corresponding to the second security group; The security group information is updated according to a data processing rule between the ports of the first security group and the second security group.

4. The method according to claim 1, characterized in that: The address parameter types of the data to be processed include source device address parameters and destination device address parameters, and the method further includes: Determine the address parameter type of the data to be processed that matches the target port, and determine the data type of the data to be processed according to the address parameter type; the data type includes outbound data and inbound data; Filtering rules corresponding to the data type from the security group information according to the data type of the data to be processed; The target security group corresponding to the data to be processed is determined from the rules corresponding to the data type of the data to be processed according to the security group corresponding to the target port.

5. A data processing device, characterized in that: The device comprises: A determination module, configured to receive data to be processed, and determine a target security group corresponding to the data to be processed from security group information of the virtual switch; the security group information includes port information corresponding to different security groups, and rules corresponding to each of the security groups, the rules corresponding to the security groups are used to indicate data processing rules between different security groups and data processing rules between ports corresponding to different security groups; the port information includes address information of the port; A generating module, configured to generate target data based on the target security group and the data to be processed; the target data carries data information of the data to be processed and an identifier of the target security group; a processing module, configured to filter a target rule corresponding to the target data from the rules corresponding to the target security group according to the data information of the target data, and process the target data according to the target rule; The determination module is specifically used to parse the data to be processed and determine the address parameters corresponding to the data to be processed; match the address parameters of the data to be processed with the address information of the port corresponding to the virtual switch, and determine the target port corresponding to the data to be processed according to the matching result; determine the target security group corresponding to the data to be processed according to the security group corresponding to the target port; A construction module is used to create multiple security group identifiers and establish a corresponding relationship between each of the security group identifiers and the port information of the virtual machine; based on the multiple security group identifiers, the port information corresponding to each of the security group identifiers, the data processing rules corresponding to each of the security group identifiers and the data processing rules corresponding to each of the ports, the security group information is constructed.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

8. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images