Message processing method and device and setting method and device

Abstract

The invention provides a message processing method and device and a setting method and device. Under the condition that the virtual switch obtains the message sent by the virtual machine, partial network function processing logics in a series of network function processing logics built in the virtual switch are used for processing the message sent by the virtual machine, so that the number of the network function processing logics used when the message sent by the virtual machine is processed is reduced, namely, the number of the network function processing logics used when the message sent by the virtual machine is processed is reduced. The message sent by the virtual machine can be processed by using less network function processing logic, so that the time can be saved, and the forwarding efficiency of the virtual switch to the message sent by the virtual machine is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method and device for processing a message, and a setting method and device. Background Art

[0002] With the rapid development of cloud computing and virtualization technology, the scale of cloud computing production environment is getting larger and larger. The development of virtualization technology has led to the emergence of virtual machines. More and more virtual machines are gradually deployed in cloud computing production environments. Virtual machines refer to complete computer systems that are simulated by software, have complete hardware system functions, and run in a completely isolated environment. Virtual machines can be deployed on physical machines to support virtualization functions. Physical machines can also run virtual switches. In virtualization technology, a virtual switch is a software that can simulate a physical switch that routes packets between virtual machines. Virtual switches can be used to forward messages sent by virtual machines. For example, the sending and receiving of messages by virtual machines can be realized by virtual switches based on forwarding rules.

[0003] However, the inventors have discovered that the efficiency of the virtual switch in forwarding messages sent by the virtual machines is low. Summary of the invention

[0004] The present application shows a method and device for message processing, and a setting method and device.

[0005] In the first aspect, the present application shows a method for processing a message, which is applied to a virtual switch, including: receiving a message to be forwarded sent by a virtual machine; extracting an identity of the virtual machine in the message to be forwarded; based on the identity, calling a target network function processing logic allowed for processing the message to be forwarded sent by the virtual machine among multiple network function processing logics built into the virtual switch for message processing; processing the message to be forwarded based on the target network function processing logic; and forwarding the message to be forwarded after being processed based on the target network function processing logic.

[0006] In the second aspect, the present application shows a setting method, which is applied to a virtual switch, including: receiving a permission request submitted by a tenant of a virtual machine, the permission request carrying the identity of the virtual machine and the logical identifier of the target network function processing logic, the permission request is used to request that the target network function processing logic be set as the network function processing logic allowed for processing messages sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic; according to the identity of the virtual machine in the permission request, searching a logical identifier list maintained for the virtual machine; the logical identifier list includes at least one logical identifier, and the logical identifiers in the logical identifier list include: the logical identifier of the network function processing logic allowed for processing messages sent to the virtual machine; the logical identifier of the target network function processing logic is stored in the logical identifier list.

[0007] In the third aspect, the present application shows a setting method, which is applied to a virtual switch, including: receiving a prohibition request submitted by a tenant of a virtual machine, the prohibition request carrying the identity of the virtual machine and the logical identifier of the target network function processing logic, the prohibition request being used to request that the target network function processing logic be set as a network function processing logic prohibited from being used for processing messages sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic; according to the identity of the virtual machine in the prohibition request, searching a logical identifier list maintained for the virtual machine; the logical identifier list includes at least one logical identifier, and the logical identifiers in the logical identifier list include: the logical identifier of the network function processing logic allowed to be used for processing messages sent to the virtual machine; deleting the logical identifier of the target network function processing logic in the logical identifier list.

[0008] In a fourth aspect, the present application illustrates a setting method, comprising: displaying a setting page for a virtual machine, the setting page comprising at least: a setting control, and a logical identifier of multiple network function processing logics built into the virtual switch for message processing; a communication connection between the virtual switch and the virtual machine; receiving an allow operation based on the setting control input, the allow operation being used to indicate setting the target network function processing logic as the network function processing logic allowed for message processing sent to the virtual machine; generating a allow request based on the allow operation, the allow request carrying the identity of the virtual machine and the logical identifier of the target network function processing logic, the allow request being used to request setting the target network function processing logic as the network function processing logic allowed for message processing sent to the virtual machine based on the identity of the virtual machine and the logical identifier of the target network function processing logic; sending a allow request to the virtual switch so that the virtual switch sets the target network function processing logic as the network function processing logic allowed for message processing sent to the virtual machine based on the identity of the virtual machine and the logical identifier of the target network function processing logic in the allow request.

[0009] In a fifth aspect, the present application illustrates a setting method, comprising: displaying a setting page for a virtual machine, the setting page comprising at least: a setting control, and a logical identifier of multiple network function processing logics built into the virtual switch for message processing; a communication connection between the virtual switch and the virtual machine; receiving a prohibition operation based on the setting control input, the prohibition operation being used to indicate setting the target network function processing logic as a network function processing logic prohibited from being used for message processing sent to the virtual machine; generating a prohibition request according to the prohibition operation, the prohibition request carrying the identity of the virtual machine and the logical identifier of the target network function processing logic, the prohibition request being used to request setting the target network function processing logic as a network function processing logic prohibited from being used for message processing sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic; sending a prohibition request to the virtual switch, so that the virtual switch sets the target network function processing logic as a network function processing logic prohibited from being used for message processing sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic in the prohibition request.

[0010] In a sixth aspect, the present application shows a device for processing messages, which is applied to a virtual switch, comprising: a first receiving module, used to receive a message to be forwarded sent by a virtual machine; an extraction module, used to extract the identity of the virtual machine in the message to be forwarded; a calling module, used to call, according to the identity, a target network function processing logic allowed to be used for processing the message to be forwarded sent by the virtual machine from a plurality of network function processing logics built into the virtual switch for message processing; a processing module, used to process the message to be forwarded based on the target network function processing logic; and a forwarding module, used to forward the message to be forwarded after being processed based on the target network function processing logic.

[0011] In the seventh aspect, the present application shows a setting device, which is applied to a virtual switch, including: a second receiving module, used to receive a permission request submitted by a tenant of a virtual machine, the permission request carries the identity of the virtual machine and the logical identifier of the target network function processing logic, and the permission request is used to request that the target network function processing logic be set as the network function processing logic allowed to be used for processing messages sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic; a first search module, used to search for a logical identifier list maintained for the virtual machine according to the identity of the virtual machine in the permission request; the logical identifier list includes at least one logical identifier, and the logical identifiers in the logical identifier list include: the logical identifier of the network function processing logic allowed to be used for processing messages sent to the virtual machine; a second storage module, used to store the logical identifier of the target network function processing logic in the logical identifier list.

[0012] In an eighth aspect, the present application shows a setting device, which is applied to a virtual switch, comprising: a third receiving module, used to receive a prohibition request submitted by a tenant of a virtual machine, the prohibition request carries the identity of the virtual machine and the logical identifier of the target network function processing logic, and the prohibition request is used to request that the target network function processing logic be set as a network function processing logic prohibited from being used for processing messages sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic; a second search module, used to search for a logical identifier list maintained for the virtual machine according to the identity of the virtual machine in the prohibition request; the logical identifier list includes at least one logical identifier, and the logical identifiers in the logical identifier list include: the logical identifier of the network function processing logic allowed to be used for processing messages sent to the virtual machine; a third storage module, used to delete the logical identifier of the target network function processing logic from the logical identifier list.

[0013] In the ninth aspect, the present application shows a setting device, comprising: a first display module, used to display a setting page for a virtual machine, the setting page at least including: a setting control, and a logical identifier of multiple network function processing logics built into the virtual switch for message processing; a communication connection between the virtual switch and the virtual machine; a fourth receiving module, used to receive an allow operation based on the setting control input, the allow operation is used to indicate setting the target network function processing logic as the network function processing logic allowed for message processing sent to the virtual machine; a third generating module, used to generate a permission request according to the permission operation, the permission request carries the identity of the virtual machine and the logical identifier of the target network function processing logic, the permission request is used to request setting the target network function processing logic as the network function processing logic allowed for message processing sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic; a first sending module, used to send a permission request to the virtual switch, so that the virtual switch sets the target network function processing logic as the network function processing logic allowed for message processing sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic in the permission request.

[0014] In the tenth aspect, the present application shows a setting device, including: a second display module, used to display a setting page for a virtual machine, the setting page including at least: a setting control, and a logical identifier of multiple network function processing logics built into the virtual switch for message processing; a communication connection between the virtual switch and the virtual machine; a fifth receiving module, used to receive a prohibition operation based on the setting control input, the prohibition operation is used to indicate setting the target network function processing logic as a network function processing logic prohibited from being used for message processing sent to the virtual machine; a fourth generating module, used to generate a prohibition request according to the prohibition operation, the prohibition request carries the identity of the virtual machine and the logical identifier of the target network function processing logic, the prohibition request is used to request to set the target network function processing logic as a network function processing logic prohibited from being used for message processing sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic; a second sending module, used to send a prohibition request to the virtual switch, so that the virtual switch sets the target network function processing logic as a network function processing logic prohibited from being used for message processing sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic in the prohibition request.

[0015] In an eleventh aspect, the present application shows an electronic device, the electronic device comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to execute the method shown in any of the aforementioned aspects.

[0016] In a twelfth aspect, the present application illustrates a non-temporary computer-readable storage medium, which, when instructions in the storage medium are executed by a processor of an electronic device, enables the electronic device to execute a method as shown in any of the aforementioned aspects.

[0017] In a thirteenth aspect, the present application illustrates a computer program product. When instructions in the computer program product are executed by a processor of an electronic device, the electronic device is enabled to perform a method as shown in any of the aforementioned aspects.

[0018] The present application includes the following advantages: through the present application, when the virtual switch obtains the message sent by the virtual machine, part of the network function processing logic in a series of network function processing logics built into the virtual switch is used to process the message sent by the virtual machine, so as to reduce the number of network function processing logics used when processing the message sent by the virtual machine, that is, less network function processing logic can be used to process the message sent by the virtual machine, thereby saving time and improving the efficiency of the virtual switch forwarding the message sent by the virtual machine. For example, the message sent by the virtual machine is not processed by non-essential network function processing logic, but only the network function processing logic other than the network function processing logic in a series of network function processing logics is used to process the message sent by the virtual machine, so that the time spent in the process of "using non-essential network function processing logic to process the message sent by the virtual machine" can be saved, so that time can be saved without affecting the normal operation of the virtual machine (such as normal transmission of messages or normal provision of services, etc.), thereby improving the efficiency of the virtual switch forwarding the message sent by the virtual machine. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a schematic diagram of a system architecture of the present application.

[0020] Figure 2 It is a flow chart of the steps of a method for processing a message in the present application.

[0021] Figure 3 This is a schematic diagram of a forwarding flow table of the present application.

[0022] Figure 4 This is a schematic diagram of a forwarding flow table of the present application.

[0023] Figure 5 This is a schematic diagram of a forwarding flow table of the present application.

[0024] Figure 6 This is a schematic diagram of a forwarding flow table of the present application.

[0025] Figure 7 This is a schematic diagram of a forwarding flow table of the present application.

[0026] Figure 8 This is a schematic diagram of a forwarding flow table of the present application.

[0027] Fig. 9 It is a step flow chart of a setting method of the present application.

[0028] Fig.10 It is a step flow chart of a setting method of the present application.

[0029] Fig.11 This is a structural block diagram of a device for processing messages in the present application.

[0030] Fig.12 It is a structural block diagram of a setting device of the present application.

[0031] Fig.13 It is a structural block diagram of a setting device of the present application.

[0032] Fig.14 It is a structural block diagram of a setting device of the present application.

[0033] Fig.15 It is a structural block diagram of a setting device of the present application.

[0034] Fig.16 It is a structural block diagram of a device of the present application. DETAILED DESCRIPTION

[0035] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0036] Before introducing the solution of this application, the technical terms that may be involved in this application are first explained.

[0037] Virtual Machine: refers to a complete computer system that is simulated by software and has complete hardware system functions and runs in a completely isolated environment. Any work that can be done in a physical computer can be done in a virtual machine. When creating a virtual machine in a computer, part of the hard disk and memory capacity of the physical machine needs to be used as the hard disk and memory capacity of the virtual machine. Each virtual machine has an independent hard disk and operating system, and can be operated like a physical machine.

[0038] Virtual switch (vSwitch): A switch running on a physical machine that is responsible for forwarding traffic to virtual machines in a virtualized scenario and simulated by software. It is also responsible for forwarding traffic received by the physical machine to the corresponding virtual machine.

[0039] A Virtual Private Cloud (VPC) is a user-defined private network. Different VPCs are logically isolated at the second layer. Users can create and manage cloud product instances in their own VPCs.

[0040] Jumbo Frame is a manufacturer-standard extra-long frame format, specially designed for Gigabit Ethernet. The maximum frame length of Ethernet standard is 1518 bytes, while the length of Jumbo Frame varies from manufacturer to manufacturer, ranging from 9000 bytes to 64000 bytes. The use of Jumbo Frame can give full play to the performance of Gigabit Ethernet and improve the data transmission efficiency by 50% to 100%. Jumbo Frame is generally used more in the storage environment of internal network.

[0041] Elastic Network Interfaces (ENI) are virtual network interfaces in a private network (VPC) and are used to connect virtual machines to the private network (VPC).

[0042] Session: It consists of a 5-tuple of information in both the forward and reverse directions of a data flow and some state information. It is usually used for some stateful services, such as stateful security groups, SLB (Server Load Balancer) and other services. The 5-tuple information may include: source port, destination port, source IP (Internet Protocol) address, destination IP address and communication protocol number.

[0043] Flow Cache: To achieve fast message forwarding, the virtual switch uses key fields in the message (such as five-tuple information) as the matching domain (match), plus the corresponding forwarding action to form the flow cache.

[0044] In order to improve the efficiency of forwarding messages sent by virtual machines by virtual switches, the inventors attempted to analyze the reasons for the low efficiency of forwarding messages sent by virtual switches to virtual machines. For example, the inventors analyzed the logs of the virtual switches and found that after receiving the messages sent by the virtual machines, the virtual switches would use a series of network function logics to process the messages sent by the virtual machines in sequence, for example, including: QoS (Quality of Service) verification, security group verification, route lookup, jumbo, attack verification, ACL (Access Control List) verification, establishment of five-tuple session and IP-Mac (Internet Protocol-Media Access Control, IP address and Mac address) verification, etc., and then forward the messages processed based on a series of network function processing logics.

[0045] Since the virtual switch uses a lot of network function processing logics to process the messages sent by the virtual machine, and each network function processing logic is often used serially to process the messages sent by the virtual machine in turn, the inventor has counted the time it takes for the virtual switch to serially use each network function processing logic to sequentially process the messages sent by the virtual machine, and found that the time it takes for the virtual switch to serially use each network function processing logic to sequentially process the messages sent by the virtual machine is often very long. Therefore, it can be inferred that the long time it takes for the virtual switch to serially use each network function processing logic to sequentially process the messages sent by the virtual machine is at least one reason for the low efficiency of the virtual switch in forwarding messages sent by the virtual machine.

[0046] In view of this, in order to improve the efficiency of the virtual switch in forwarding messages sent by the virtual machine, the inventor has come up with an idea of ​​reducing the time consumed by the virtual switch in processing messages sent by the virtual machine using the network function processing logic.

[0047] However, the inventors have found that: for any network function processing logic, the time it takes for the virtual switch to process the message sent by the virtual machine using the network function processing logic is fixed, that is, the time it takes for the virtual switch to process the message sent by the virtual machine using the network function processing logic is often impossible to reduce. The same is true for each other network function processing logic.

[0048] Thus, in order to reduce the time spent by the virtual switch using the network function processing logic to process the message sent by the virtual machine, the inventor analyzed the process of the virtual switch serially using each network function processing logic to process the message sent by the virtual machine in turn, and found that: the functions of each network function processing logic used by the virtual switch when processing the message sent by the virtual machine are different. In addition, any virtual machine belongs to a tenant, and different tenants use their own virtual machines in different usage scenarios (for example, the services or applications involved in the data processed by their own virtual machines, etc.).

[0049] Then, after the inventors conducted statistical analysis on the usage scenarios of each tenant using their own virtual machine, they found that: in the usage scenarios of some tenants using their own virtual machines, part of the network function processing logic in a series of network function processing logics is not necessary. For example, in these usage scenarios, the tenant's virtual machine does not require the virtual switch to use this part of the network function processing logic to process the message sent by the tenant's virtual machine. However, in fact, the virtual switch treats the messages sent by each virtual machine equally, that is, the virtual switch will use this part of the network function processing logic to process the messages sent by each virtual machine, and the process of the virtual switch using this part of the network function processing logic to process the message sent by the virtual machine will take a long time.

[0050] Therefore, the inventor came up with an idea. Since this part of the network function processing logic is not necessary in the usage scenario where the tenant uses his own virtual machine, the virtual switch can process the messages sent by the tenant's virtual machine without using this part of the network function processing logic.

[0051] For example, when the virtual switch receives a message sent by a virtual machine, for the usage scenario in which the tenant uses his own virtual machine, the virtual switch can determine the non-essential network function processing logic for the virtual machine, and does not use the determined non-essential network function processing logic to process the message sent by the virtual machine, but only uses the network function processing logic other than the necessary network function processing logic in a series of network function processing logics to process the message sent by the virtual machine. In this way, the time consumed in the process of "using non-essential network function processing logic to process the message sent by the virtual machine" can be saved, thereby saving time without affecting the normal operation of the virtual machine (such as normal transmission of messages or normal provision of services, etc.), thereby improving the efficiency of the virtual switch in forwarding messages sent by the virtual machine.

[0052] For example, one of the network function processing logics in a series of network function processing logics includes: security group verification. Security group verification is for security control. Assume that a tenant rents multiple virtual machines, which form the tenant's private network (VPC), and equips the VPC with a virtual switch. In order to prevent traffic outside the VPC from attacking the VPC and thus avoid security risks to the VPC, the virtual switch performs security group verification on the messages sent by the virtual machines in the VPC.

[0053] However, if the destination of the message sent by the virtual machine in the VPC is another virtual machine in the same VPC, that is, two different virtual machines in the same VPC transmit messages to each other through the virtual switch, then although the virtual switch is required to forward the messages transmitted between the virtual machines in the VPC, the messages transmitted between the virtual machines in the VPC will not flow out of the VPC, which is equivalent to the internal communication of the VPC. In the internal communication scenario of the VPC, there is no entrance for traffic outside the VPC, so traffic outside the VPC is not involved, and there will be no attack on the VPC by traffic outside the VPC. In this way, there is no need to prevent attacks on the VPC by traffic outside the VPC. In this way, in the internal communication scenario of the VPC, the virtual switch can perform security group verification on the messages sent by the virtual machine, thereby saving the time consumed by the security group verification process, and thus improving the efficiency of the virtual switch in forwarding messages sent by the virtual machine.

[0054] Specifically, see Figure 1 , which shows a schematic diagram of a system architecture of the present application, the system architecture at least includes: a physical machine, the physical machine has a physical network card, the physical machine can receive external messages or send messages to the outside through the physical network card. The physical machine also runs a virtual switch, and the virtual switch can communicate with the physical network card. The physical machine also runs at least one virtual machine, each of which is equipped with a virtual network card, and the virtual machine can communicate with the virtual switch through its own virtual network card.

[0055] Thus, if a virtual machine sends a message to an external device outside a physical machine (which may be a physical machine or a virtual machine), the transmission link of the message may include: virtual machine-virtual network card-virtual switch-physical network card-external device.

[0056] Alternatively, if an external device outside the physical machine (which can be a physical machine or a virtual machine) sends a message to the virtual machine, the transmission link of the message may include: external device-physical network card-virtual switch-virtual network card-virtual machine.

[0057] Secondly, see Figure 2 , which shows a method for processing a message of the present application, the method is applied to Figure 1In the virtual switch shown, the method includes:

[0058] In step S101, a message to be forwarded sent by a virtual machine is received.

[0059] The virtual machine may be one of at least one virtual machine that is communicatively connected to the virtual switch, etc.

[0060] In step S102, the identity of the virtual machine is extracted from the message to be forwarded.

[0061] In one embodiment of the present application, the identity of the virtual machine may include the IP address of the virtual machine, etc. For example, the message to be forwarded may include the source IP address, the destination IP address, the source port number, the destination port number, and the communication protocol number, etc. The source IP address is the IP address of the virtual machine, so the source IP address in the message to be forwarded can be extracted and used as the identity of the virtual machine. Different virtual machines have different IP addresses, so different virtual machines have different identities. Alternatively, in another embodiment of the present application, the message to be forwarded is sent by the virtual machine to the virtual switch based on the virtual network card of the virtual machine. The virtual network cards of different virtual machines are different, and the network card identifiers of different virtual network cards are different. The network card identifier of the virtual network card may include the MAC (Media Access Control) address of the virtual network card, etc. In a scenario where a virtual machine sends a message to be forwarded to a virtual switch based on the virtual network card of the virtual machine, the virtual machine or the virtual network card of the virtual machine will also add the network card identifier of the virtual network card of the virtual machine in the message to be forwarded. In this way, the message to be forwarded obtained by the virtual switch has the network card identifier of the virtual network card of the virtual machine. In this way, the virtual switch can extract the network card identifier of the virtual network card of the virtual machine from the message to be forwarded, and then obtain the identity of the virtual machine based on the network card identifier of the virtual network card of the virtual machine, for example, using the network card identifier of the virtual network card of the virtual machine as the identity of the virtual machine, etc.

[0062] In step S103, according to the identity of the virtual machine, among the multiple network function processing logics built into the virtual switch for processing messages, the target network function processing logic allowed for processing the message to be forwarded sent by the virtual machine is called.

[0063] The virtual switch has a lot of built-in network function processing logic for message processing, such as QoS verification, security group verification, route lookup, jumbo, attack verification, ACL verification, establishment of five-tuple session and IP-Mac verification.

[0064] In the present application, the multiple virtual machines connected to the virtual switch do not belong to the same tenant, that is, the tenants to which the multiple virtual machines connected to the virtual switch belong are not the same, and the functions of the various network function processing logics used by the virtual switch when processing the messages sent by the virtual machine are different. In addition, any virtual machine belongs to a tenant, and the usage scenarios of different tenants using their respective virtual machines (such as the services or applications involved in the data processed by their respective virtual machines, etc.) are also different. In this case, some tenants may not need the virtual switch to use the various network function processing logics built into the virtual switch to process their messages in sequence, but only use part of the network function processing logics built into the virtual switch to process their messages, so as to reduce the number of network function processing logics used when processing their messages, that is, fewer network function processing logics can be used to process the messages sent by the virtual machine, thereby saving time and improving the efficiency of the virtual switch in forwarding messages sent by the virtual machine.

[0065] For example, in one embodiment of the present application, the virtual switch can maintain a logical identification list for the virtual machine, and the logical identification list is used to store the logical identification of the network function processing logic allowed to be used for processing the message sent by the virtual machine. Different network function processing logics have different logical identifications, and the logical identification of the network function processing logic may include the name or number of the network function processing logic.

[0066] Among them, the tenant of the virtual machine can set the network function processing logic allowed for processing the message sent by the virtual machine according to the actual situation, so that the logical identifier of the network function processing logic allowed for processing the message sent by the virtual machine can be stored in the logical identifier list, and then when the virtual switch receives the message to be forwarded sent by the virtual machine, it can use the network function processing logic corresponding to the logical identifier stored in the logical identifier list to process the message to be forwarded.

[0067] For example, assuming that the tenant of the virtual machine needs to set the target network function processing logic (the target network function processing logic is at least one of the multiple network function processing logics built into the virtual switch for processing packets) as the network function processing logic allowed for processing packets sent by the virtual machine, the tenant can submit a permission request to the virtual switch through the settings page (the specific submission method can be found in the following example). Fig. 9 The embodiment shown in the figure is not described in detail here), allowing the request to carry the identity of the virtual machine and the logical identifier of the target network function processing logic, and allowing the request to be used to request to set the target network function processing logic as the network function processing logic allowed for processing the message sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic.

[0068] The virtual switch can receive a permission request submitted by a tenant of a virtual machine, and search the logical identifier list maintained for the virtual machine based on the identity of the virtual machine in the permission request (wherein the virtual switch may maintain logical identifier lists for different virtual machines at the same time. In this case, it is necessary to lock the logical identifier list maintained for the virtual machine based on the identity of the virtual machine in the permission request), and then store the logical identifier of the target network function processing logic in the logical identifier list to set the target network function processing logic as the network function processing logic allowed to be used for processing packets sent to the virtual machine.

[0069] Through this method, the tenants of the virtual machines can be supported to increase the network function processing logic allowed by the virtual switch for processing messages sent by the virtual machines according to actual needs. That is, the tenants of the virtual machines can flexibly enable the network function processing logic allowed by the virtual switch for processing messages sent by the virtual machines, so that the tenants of the virtual machines can flexibly set the network function processing logic allowed by the virtual switch for processing messages sent by the virtual machines to meet the actual and real-time needs of the tenants.

[0070] Alternatively, the tenant of the virtual machine may no longer need to set the target network function processing logic as the network function processing logic allowed for message processing sent by the virtual machine (the virtual machine no longer needs to use the target network function processing logic to process messages subsequently sent by the virtual machine), that is, it is necessary to set the target network function processing logic as the network function processing logic prohibited for message processing sent by the virtual machine, so that the logical identifier of the target network function processing logic can be deleted from the logical identifier list. In turn, when the virtual switch receives a message to be forwarded by the virtual machine, it does not use the network function processing logic corresponding to the logical identifier deleted from the logical identifier list to process the forwarded message (for example, the target network function processing logic is not used to process the forwarded message).

[0071] For example, assuming that the tenant of the virtual machine no longer needs to set the target network function processing logic as the network function processing logic allowed for processing the message sent by the virtual machine, the tenant can submit a prohibition request to the virtual switch through the settings page (the specific submission method can be found in the following example). Fig.10 The embodiment shown in the figure is not described in detail here), and the request is prohibited to carry the identity of the virtual machine and the logical identifier of the target network function processing logic. The request is prohibited to set the target network function processing logic as a network function processing logic prohibited from being used for processing messages sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic.

[0072] The virtual switch can receive a prohibition request submitted by a tenant of a virtual machine, and search the logical identifier list maintained for the virtual machine based on the identity of the virtual machine in the prohibition request (wherein the virtual switch may maintain logical identifier lists for different virtual machines at the same time. In this case, it is necessary to lock the logical identifier list maintained for the virtual machine based on the identity of the virtual machine in the prohibition request), and then delete the logical identifier of the target network function processing logic from the logical identifier list to set the target network function processing logic as a network function processing logic that is prohibited from being used for processing messages sent to the virtual machine.

[0073] Through this method, the tenants of the virtual machines can be supported to reduce the network function processing logic allowed to be used by the virtual switch for processing messages sent by the virtual machines according to actual needs. That is, the tenants of the virtual machines can flexibly disable the network function processing logic allowed to be used by the virtual switch for processing messages sent by the virtual machines, so that the tenants of the virtual machines can flexibly set the network function processing logic prohibited by the virtual switch for processing messages sent by the virtual machines to meet the actual and real-time needs of the tenants.

[0074] Accordingly, when determining the target network function processing logic allowed to be used for processing the message to be forwarded sent by the virtual machine among the multiple network function processing logics built into the virtual switch and used for processing the message according to the identity of the virtual machine, the logical identifier list maintained for the virtual machine can be searched according to the identity of the virtual machine, the logical identifier list includes at least one logical identifier, and the logical identifiers in the logical identifier list include: the logical identifier of the network function processing logic allowed to be used for processing the message sent by the virtual machine. Then, the target network function processing logic allowed to be used for processing the message to be forwarded sent by the virtual machine is called according to the logical identifier in the logical identifier list.

[0075] Alternatively, in another embodiment of the present application, after the virtual switch receives a permission request submitted by a tenant of a virtual machine, the corresponding table entry between the identity of the virtual machine carried in the permission request and the logical identifier of the target network function processing logic can be stored in the previously stored correspondence between the identity of the virtual machine and the logical identifier of the network function processing logic allowed to be used for message processing sent to the virtual machine. Alternatively, after the virtual switch receives a prohibition request submitted by a tenant of the virtual machine, the corresponding table entry between the identity of the virtual machine carried in the prohibition request and the logical identifier of the target network function processing logic can be deleted in the previously stored correspondence between the identity of the virtual machine and the logical identifier of the network function processing logic allowed to be used for message processing sent to the virtual machine.

[0076] In this way, when determining the target network function processing logic allowed to be used for processing the to-be-forwarded message sent by the virtual machine among the multiple network function processing logics built into the virtual switch for processing the message based on the identity of the virtual machine, the logical identifier corresponding to the identity of the target virtual machine can be searched in the correspondence between the identity of the virtual machine and the logical identifier of the network function processing logic allowed to be used for processing the message sent to the virtual machine, which is stored in advance; and the target network function processing logic allowed to be used for processing the to-be-forwarded message sent to the virtual machine is called according to the found logical identifier.

[0077] In step S104, the message to be forwarded is processed based on the target network function processing logic.

[0078] In one embodiment of the present application, when there is one target network function processing logic, the one target network function processing logic can be used to process the forwarded message. Alternatively, in another embodiment of the present application, when there are more than two target network function processing logics, the forwarded message can be processed sequentially (for example, serial processing, etc.) according to the sequence between the more than two target network function processing logics (the sequence between the multiple network function processing logics built into the virtual switch for message processing is set in advance, so that the sequence between the more than two target network function processing logics can be directly obtained).

[0079] In step S105, the message to be forwarded is forwarded after being processed based on the target network function processing logic.

[0080] Through the present application, when the virtual switch obtains a message sent by a virtual machine, part of the network function processing logic in a series of network function processing logics built into the virtual switch is used to process the message sent by the virtual machine, so as to reduce the number of network function processing logics used when processing the message sent by the virtual machine, that is, less network function processing logic can be used to process the message sent by the virtual machine, thereby saving time and improving the efficiency of the virtual switch in forwarding the message sent by the virtual machine. For example, the message sent by the virtual machine is not processed by non-essential network function processing logic, but only the network function processing logic other than the necessary network function processing logic in a series of network function processing logic is used to process the message sent by the virtual machine. In this way, the time spent in the process of "using non-essential network function processing logic to process the message sent by the virtual machine" can be saved, so that time can be saved without affecting the normal operation of the virtual machine (such as normal transmission of messages or normal provision of services, etc.), thereby improving the efficiency of the virtual switch in forwarding the message sent by the virtual machine.

[0081] In another embodiment of the present application, the virtual switch may adopt a design concept of separation of fast and slow paths, and the path for forwarding messages by the virtual switch may include a slow path (slowpath) and a fast path (fastpath).

[0082] The slow path includes the aforementioned virtual switch built-in multiple network function processing logics for message processing, and the fast path includes flow table entries generated according to the slow path. The flow table entries are located in the forwarding flow table, and the flow table entries include matching information (match) and action information (action).

[0083] In order to improve the efficiency of the subsequent virtual switch forwarding the message sent again by this virtual machine, in another embodiment, a fast path for the virtual machine can be generated, for example, extracting five-tuple information from the message to be forwarded sent by the virtual machine, the five-tuple information includes: source IP address (such as the IP address of the virtual machine, etc.), destination IP address, source port number, destination port number and communication protocol number. Then generate matching information including the five-tuple information, and generate action information corresponding to the target network function processing logic, then generate flow table items according to the matching information and action information, and store the generated flow table items in the forwarding flow table. Among them, the forwarding flow table can be located in the virtual switch.

[0084] Afterwards, when another message sent by the virtual machine is received again, the information in the other message for matching in the forwarding flow table can be extracted, for example, at least the source IP address in the other message is extracted as the information for matching in the forwarding flow table. In addition, in addition to extracting the source IP address in the other message, other information in the other message (such as the destination address, etc.) can also be extracted as the information for matching in the forwarding flow table. Then, the corresponding matching information is matched in the forwarding flow table according to the information for matching in the forwarding flow table, and another message is processed according to the action information corresponding to the matched matching information. Among them, the matching information (match) in the flow table item includes five-tuple information, and the five-tuple information has more content, which will occupy more storage resources.

[0085] The inventor discovered that the reason why the matching information includes the five-tuple information is that: the virtual switch previously used a series of network function processing logics by default to process the messages sent by the virtual machine in sequence, so that the messages sent by the virtual machine are defaulted to be stateful messages, that is, the message state needs to be maintained, and a series of network function processing logics include security group verification. In order to be able to perform security group verification, it is often necessary to establish five-tuple information to use the five-tuple information to perform security group verification (for example, a two-way session is generated based on the five-tuple information to perform security control through the session). On the other hand, since the messages sent by the virtual machine are stateful messages by default, that is, the message state needs to be maintained, the five-tuple information must also be used in the match information in the flow table item in the fast path. Therefore, in the scenario where the virtual switch previously used a series of network function processing logics by default to process the messages sent by the virtual machine in sequence, the matching information (match) in the flow table item must include the five-tuple information, so that storage resources cannot be saved.

[0086] For example, suppose the source IP address of the virtual machine is 10.0.0.1, and the destinations of multiple messages forwarded by the virtual machine to the virtual switch are the same destination, for example, the destination IP address is 10.0.0.2, and the source IP address in multiple messages is 10.0.0.1. Since multiple messages involve different services or applications, the source port in some messages is "1001", the destination port is "2001", and the communication protocol number is "6"; the source port in other messages is "1002", the destination port is "2002", and the communication protocol number is "6"; the source port in some other messages is "1003", the destination port is "2003", and the communication protocol number is "6"; the source port in some other messages is "1004", the destination port is "2004", and the communication protocol number is "17"; 4 flow table entries are established, and the matching information (match) in the 4 flow table entries is all five-tuple information, for details, please refer to Figure 3 In addition, the action information (action) in these flow table entries may be the same.

[0087] However, the inventors have also discovered that the solution of the present application is not that the virtual switch uses a series of network function processing logics by default to process the messages sent by the virtual machine in sequence, but uses the "target network function processing logic (part of the network function processing logic in a series of network function processing logics) allowed to be used for processing the messages sent by the virtual machine" in a series of network function processing logics to process the messages sent by the virtual machine, and the target network function processing logic may not include security group verification. For example, a virtual machine is interacting with other virtual machines in the VPC where it is located, that is, it is equivalent to the internal communication of the VPC. In the internal communication scenario of the VPC, there is no entrance for traffic outside the VPC, so it does not involve traffic outside the VPC, and then there will be no attack on the VPC by traffic outside the VPC. In this way, it is not necessary to prevent the attack on the VPC by traffic outside the VPC. In this way, in the internal communication scenario of the VPC, the state can be maintained. In this way, the virtual switch can not perform security group verification on the messages sent by the virtual machine. That is, when the target network function processing logic does not include security group verification, it is often not necessary to maintain the status of the message, and thus there is no strong dependence on the five-tuple information, that is, it is not necessary to establish the five-tuple information for security group verification.

[0088] On the other hand, since the state of the message may not be maintained, that is, the message sent by the virtual machine may be considered not to be a stateful message, in order to save storage resources, the inventor has come up with an idea of ​​reducing the content of the match information (match) in a flow table item as much as possible, for example, the match information (match) in the flow table item in the fast path may not use the five-tuple information. Instead, four-tuple information, three-tuple information, or two-tuple information including less content than the five-tuple information may be used.

[0089] The four-tuple information may include: source IP address (such as the IP address of the virtual machine), destination IP address, source port number, and destination port number. Alternatively, the four-tuple information may include: source IP address (such as the IP address of the virtual machine), destination IP address, source port number, and communication protocol number. Alternatively, the four-tuple information may include: The four-tuple information may include: source IP address (such as the IP address of the virtual machine), destination IP address, destination port number, and communication protocol number. Figure 3For example, assume that the four-tuple information includes: source IP address (such as the IP address of the virtual machine, etc.), destination IP address, source port number and destination port number. The source IP address of the virtual machine is 10.0.0.1. The destination of multiple messages forwarded by the virtual machine to the virtual switch is the same destination. The destination IP address is 10.0.0.2, and the source IP address in multiple messages is 10.0.0.1. Because multiple messages involve different services or applications, the communication protocol number in some messages is "6"; the communication protocol number in other messages is "6"; the communication protocol number in some other messages is "6"; the communication protocol number in some other messages is "17"; 4 flow table entries are established, and the matching information (match) in the 4 flow table entries is all four-tuple information. For details, please refer to Figure 4 In addition, the action information (action) in these flow table entries may be the same.

[0090] In addition, the triplet information may include: source IP address (such as the IP address of the virtual machine), destination IP address, and communication protocol number. Alternatively, the triplet information may include: source IP address (such as the IP address of the virtual machine), destination IP address, and source port number. Alternatively, the triplet information may include: source IP address (such as the IP address of the virtual machine), destination IP address, and destination port number. Figure 3 For example, assume that the triplet information includes: source IP address (such as the IP address of the virtual machine, etc.), destination IP address and communication protocol number, the source IP address of the virtual machine is 10.0.0.1, the destination of multiple messages forwarded by the virtual machine to the virtual switch is the same destination, the destination IP address is 10.0.0.2, and the source IP address in multiple messages is 10.0.0.1. Since multiple messages involve different services or applications, the source port in some messages is "1001" and the destination port is "2001"; the source port in other messages is "1002" and the destination port is "2002"; the source port in some other messages is "1003" and the destination port is "2003"; the source port in some other messages is "1004" and the destination port is "2004"; 4 flow table entries are established, and the matching information (match) in the 4 flow table entries is all triplet information. For details, please refer to Figure 5 In addition, the action information (action) in these flow table entries may be the same.

[0091] Secondly, the binary information may include: source IP address (such as the IP address of the virtual machine, etc.) and destination IP address. Figure 3For example, assume that the tuple information includes: source IP address (such as the IP address of the virtual machine) and destination IP address. The source IP address of the virtual machine is 10.0.0.1. The destination of multiple messages forwarded by the virtual machine to the virtual switch is the same destination. The destination IP address is 10.0.0.2, and the source IP address of multiple messages is 10.0.0.1. There are 4 flow table entries established, and the matching information (match) in the 4 flow table entries is all tuple information. For details, please refer to Figure 6 In addition, the action information (action) in these flow table entries may be the same.

[0092] In this application, the source IP address (such as the IP address of the virtual machine, etc.) and the destination IP address are often used in the matching information (match). As for the source port number, destination port number and communication protocol number, they will be used in some scenarios and not in others.

[0093] Specifically, matching information including binary information, triple information or quadruple information may be generated. Also, action information corresponding to the target network function processing logic may be generated, and then a flow table entry may be generated according to the generated matching information and action information. The generated flow table entry is stored in the forwarding flow table.

[0094] In this embodiment, the matching information (match) in the flow table item in the forwarding flow table includes four-tuple information, three-tuple information or two-tuple information, rather than five-tuple information. The content included in the four-tuple information, three-tuple information or two-tuple information is less than the content included in the five-tuple information. In this way, storage space can be saved.

[0095] On the other hand, when the matching information (match) uses quintuple information, different messages sent by the same virtual machine may involve different services or applications, so that the quintuple information of different messages sent by the same virtual machine is often different. For example, although the source IP addresses in the quintuple information of different messages sent by the same virtual machine may be the same, and even the destination IP addresses may be the same (for example, the destinations of these messages are the same destination, etc.), different messages may involve different services or applications, and different services or applications often use different port numbers, and even different services or applications often use different communication protocols, resulting in different communication protocol numbers, which leads to the quintuple information of these messages often being different.

[0096] Since the five-tuple information of these messages is different, it is necessary to establish flow table entries for the five-tuple information of each of these messages (to avoid omission). For example, the matching information in the flow table entry needs to include five-tuple information, and matching information needs to be generated for different five-tuple information of these messages, and then different flow table entries are generated (the matching information in different flow table entries is different), and different flow table entries need to be stored in the forwarding flow table respectively. However, this may result in a large number of flow table entries for the same virtual machine in the forwarding flow table, which will occupy more storage resources, and the process of establishing flow table entries requires a certain amount of system resources. In the above situation, since there are many different five-tuple information, flow table entries need to be established for each different five-tuple information, which will result in a large number of flow table entries that need to be established, thereby occupying more system resources. And, in the case where a certain established flow table entry is no longer needed in the future, it is necessary to delete the flow table entry that is no longer needed in the forwarding flow table, but the process of deleting the flow table entry requires system resources. System resources may include CPU (Central Processing Unit, central processing unit) and memory.

[0097] In the present application, when using binary information, triple information or quadruple information instead of quintuple information, the content of the match information in the flow table entry can be simplified, for example, simplified to at least include the source IP address and the destination IP address in the quintuple information. Different messages sent by the same virtual machine may involve different services or applications, which may make the quintuple information recorded in different messages sent by the same virtual machine not completely the same, but the binary information, triple information or quadruple information recorded in different messages sent by the same virtual machine may be the same.

[0098] In the forwarding flow table, flow table entries with the same matching information (match) may not be repeatedly established, so that storage resources can be saved. Since the content included in the binary information, triple information or quadruple information is less than the content included in the quintuple information, in this way, when the number of different messages sent by the same virtual machine is the same, the possibility that the binary information of the message is the same is greater than the possibility that the quintuple information of the message is the same, the possibility that the triple information of the message is the same is greater than the possibility that the quintuple information of the message is the same, and the possibility that the quadruple information of the message is the same is greater than the possibility that the quintuple information of the message is the same.

[0099] The number of deduplicated two-tuple information in the two-tuple information of each message is often smaller than the number of deduplicated five-tuple information in the five-tuple information of each message, the number of deduplicated three-tuple information in the three-tuple information of each message is often smaller than the number of deduplicated five-tuple information in the five-tuple information of each message, and the number of deduplicated four-tuple information in the four-tuple information of each message is often smaller than the number of deduplicated five-tuple information in the five-tuple information of each message.

[0100] The present application can establish matching information according to each binary information after deduplication, or can establish matching information according to each triple information after deduplication, or can establish matching information according to each quadruple information after deduplication, but does not need to establish matching information according to each quintuple information after repetition. In this way, the flow table entries for the same virtual machine in the forwarding flow table can be reduced, thereby saving storage resources.

[0101] Specifically, before generating matching information including binary information, triple information or quadruple information, it can also be determined whether there are duplicate flow table items in the forwarding flow table, and the matching information (match) in the duplicate flow table items includes the binary information, triple information or quadruple information mentioned above. In the case that there are no duplicate flow table items in the forwarding flow table, matching information including binary information, triple information or quadruple information is generated again. Alternatively, in the case that there are duplicate flow table items in the forwarding flow table, matching information including at least binary information, triple information or quadruple information may not be generated, so as to avoid repeatedly storing flow table items including the same matching information (match) in the forwarding flow table, reduce the number of flow table items in the forwarding flow table, and thus save storage space.

[0102] Among them, when generating matching information including four-tuple information, triplet information or binary information, it can be determined whether the message to be forwarded sent by the virtual machine is coupled with the communication protocol; for example, determine the service type or application type involved in the message to be forwarded sent by the virtual machine; when the service type or application type involved in the message to be forwarded sent by the virtual machine is located in the preset type list, determine that the message to be forwarded sent by the virtual machine is coupled with the communication protocol; or, when the service type or application type involved in the message to be forwarded sent by the virtual machine is not located in the preset type list, determine that the message to be forwarded sent by the virtual machine is not coupled with the communication protocol; wherein the preset type list is used to store the service type or application type involved in the message coupled with the communication protocol.

[0103] In the case where the message to be forwarded sent by the virtual machine is not coupled with the communication protocol, matching information including four-tuple information, three-tuple information or two-tuple information is generated, and the four-tuple information, three-tuple information or two-tuple information does not include the communication protocol number; for example, matching information including two-tuple information is generated, and the two-tuple information includes the source IP address and the target IP address in the message to be forwarded. Alternatively, matching information including three-tuple information is generated, and the three-tuple information includes the source IP address and the target IP address in the message to be forwarded, and also includes the source port number, the target port number or the communication protocol number in the message to be forwarded. Alternatively, matching information including four-tuple information is generated, and the four-tuple information includes the source IP address and the target IP address in the message to be forwarded, and also includes two of the source port number, the target port number and the communication protocol number in the message to be forwarded.

[0104] Alternatively, in the case where the message to be forwarded sent by the virtual machine is coupled with a communication protocol, matching information including four-tuple information or three-tuple information is generated, and the four-tuple information or three-tuple information includes a communication protocol number. For example, matching information including a three-tuple is generated, and the three-tuple information includes the source IP address, the target IP address, and the communication protocol number in the message to be forwarded. Matching information including a four-tuple is generated, and the four-tuple information includes the source IP address, the target IP address, and the communication protocol number in the message to be forwarded, and also includes the source port number or the target port number in the message to be forwarded.

[0105] For example, Figure 3 For example, assume that the match information (match) includes triple information, which is the source IP address (such as the IP address of the virtual machine), the destination IP address and the communication protocol number. The source IP address of the virtual machine is 10.0.0.1. The destination of multiple messages forwarded by the virtual machine to the virtual switch is the same destination, the destination IP address is 10.0.0.2, and the source IP address of multiple messages is 10.0.0.1. Two flow table entries are established, and the match information (match) in the two flow table entries is triple information. For details, please refer to Figure 7 In addition, the action information (action) in these flow table entries may be the same.

[0106] For example, Figure 3 For example, assume that the match information (match) includes two-tuple information, the two-tuple information is the source IP address (such as the IP address of the virtual machine, etc.) and the destination IP address, the source IP address of the virtual machine is 10.0.0.1, the destination of multiple messages forwarded by the virtual machine to the virtual switch is the same destination, the destination IP address is 10.0.0.2, and the source IP address of multiple messages is 10.0.0.1. There is one flow table entry established, and the match information (match) in one flow table entry is all two-tuple information. For details, please refer to Figure 8 shown.

[0107] In addition, the aforementioned embodiment describes the support for the tenant of the virtual machine to update the network function processing logic allowed for the message processing sent by the virtual machine. After the tenant of the virtual machine updates the network function processing logic allowed for the message processing sent by the virtual machine, the network function processing logic actually used for the message processing sent by the virtual machine in the slow path is different from the network function processing logic corresponding to the action information (action) of the message processing sent by the virtual machine in the flow table item. In the case where the virtual switch receives other messages sent by the virtual machine, if the fast path is used to process other messages, a flow table item will be matched, and the other messages will be processed according to the network function processing logic corresponding to the action information (action) in the flow table item. However, since the user has updated the network function processing logic allowed for the message processing sent by the virtual machine, it is actually necessary for the virtual switch to use the updated network function processing logic to process the message sent by the virtual machine. However, the virtual switch does not actually use the updated network function processing logic to process the message sent by the virtual machine, which may cause processing errors, etc.

[0108] Therefore, in order to avoid the above situation, in another embodiment of the present application, when the network function processing logic allowed for processing the message sent by the virtual machine changes, the flow table entry corresponding to the virtual machine can be deleted in the forwarding flow table. The flow table entry corresponding to the virtual machine may include: a flow table entry with the IP address of the virtual machine as the source IP address, etc.

[0109] Alternatively, in order to avoid the above situation, in another embodiment of the present application, when the logical identifier of the target network function processing logic is deleted from the logical identifier list maintained for the virtual machine, the flow table entry corresponding to the virtual machine can be deleted in the forwarding flow table. The flow table entry corresponding to the virtual machine may include: a flow table entry with the IP address of the virtual machine as the source IP address, etc.

[0110] In this way, when the virtual switch receives other messages sent by the virtual machine, the flow table entry corresponding to the virtual machine cannot be matched in the forwarding flow table, and the fast path cannot be used to process other messages. In this way, the slow path will be used to process other messages. The network function processing logic actually used to process other messages using the slow path is the updated network function processing logic, thereby avoiding processing errors, etc. Afterwards, in the case where the target network function processing logic does not include security group verification, matching information including four-tuple information, three-tuple information or two-tuple information is generated; and action information corresponding to the updated network function processing logic is generated; a flow table entry is generated based on the generated matching information and action information; and the generated flow table entry is stored in the forwarding flow table.

[0111] In addition, to support tenants to set the network function processing logic allowed by the virtual switch for processing messages sent by the tenant's virtual machine, see Fig. 9 , shows a setting method of the present application, which is applied to electronic devices that can be directly controlled by tenants, and the electronic devices may include laptops, desktop computers, mobile phones, tablet computers or PDAs (Personal Digital Assistants), etc. Among them, the method includes:

[0112] In step S201, a setting page for a virtual machine is displayed, the setting page at least including: setting controls, and logic identifiers of multiple network function processing logics built into the virtual switch for processing packets. The virtual switch is connected to the virtual machine in communication.

[0113] In the present application, when the tenant needs to set the network function processing logic allowed by the virtual switch to process the messages sent by the tenant's virtual machine, the tenant can control the electronic device to display the main page of the virtual machine. For example, the tenant is a tenant who rents a virtual machine. For the tenant, the tenant can use the electronic device to enter the login page provided by the server (the server can be a device that manages each virtual machine and the virtual switch, etc.). The tenant can enter the tenant's account and password in the login page provided by the server to log in to the server, and then jump to the main page of the tenant's virtual machine. Then, the setting page for the virtual machine can be entered from the main page of the virtual machine. The setting page for the virtual machine has the IP address of the virtual switch (the virtual switch used to forward the messages of the tenant's virtual machine) that is connected to the tenant's virtual machine for communication. The setting page can also include at least: setting controls, and logical identifiers of multiple network function processing logics built into the virtual switch for message processing.

[0114] Tenants can obtain the network function processing logic that the virtual switch can use when processing messages sent by virtual machines based on the logical identifiers of multiple network function processing logics. Tenants can set the network function processing logic allowed for the virtual switch to process messages sent by the tenant's virtual machines based on the setting controls.

[0115] In step S202, a permission operation based on a setting control input is received, where the permission operation is used to indicate setting the target network function processing logic as the network function processing logic allowed for processing messages sent by the virtual machine.

[0116] In one embodiment, there may be multiple setting controls, and each logical identifier of the network function processing logic for message processing may correspond to a setting control respectively. The setting control may include an allow button and a disable button.

[0117] For any one of the multiple network function processing logics built into the virtual switch for processing messages, if the tenant needs to set the network function processing logic as the network function processing logic allowed by the virtual switch for processing messages sent by the tenant's virtual machine, the tenant can click the allow button in the setting control corresponding to the logic identifier of the network function processing logic. The same is true for each of the other network function processing logics built into the virtual switch for processing messages.

[0118] Among them, the network function processing logic corresponding to the logical identifier corresponding to the setting control whose allow button is clicked can be regarded as the target network function processing logic, and the tenant's click operation of the allow button in the setting control corresponding to the logical identifier of the target network function processing logic can be regarded as an allow operation based on the setting control input.

[0119] In step S203, an allow request is generated according to the allow operation, the allow request carries the identity of the virtual machine and the logical identifier of the target network function processing logic, and the allow request is used to request that the target network function processing logic be set as the network function processing logic allowed for processing messages sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic.

[0120] For any one of the multiple network function processing logics built into the virtual switch for processing messages, the setting control corresponding to the logical identifier of the network function processing logic has the logical identifier of the network function processing logic. In this way, if the allow button in the setting control corresponding to the logical identifier of the network function processing logic is clicked (the network function processing logic is the target network function processing logic), the electronic device can obtain the logical identifier of the network function processing logic in the setting control corresponding to the logical identifier of the network function processing logic. The same is true for each of the other network function processing logics built into the virtual switch for processing messages.

[0121] In addition, the setting page for the virtual machine is entered from the main page of the virtual machine. The main page of the virtual machine has the identity of the virtual machine. The setting page for the virtual machine may also have the identity of the virtual machine. In this way, the electronic device can obtain the identity of the virtual machine in the setting page for the virtual machine.

[0122] In this way, the electronic device can obtain the identity of the virtual machine and the logical identifier of the target network function processing logic. The electronic device can know based on the received permission operation based on the setting control input: the tenant needs to set the target network function processing logic to the network function processing logic allowed for processing messages sent to the virtual machine. In this way, the electronic device can generate a permission request and then execute step S204.

[0123] The identity of the virtual machine may include the IP address of the virtual machine, etc.

[0124] In step S204, a permission request is sent to the virtual switch so that the virtual switch sets the target network function processing logic as the network function processing logic allowed for processing messages sent by the virtual machine according to the identity of the virtual machine in the permission request and the logic identifier of the target network function processing logic.

[0125] The electronic device can communicate with the server through the setting page for the virtual machine, and the server can communicate with the physical machine where the virtual switch is located. In this way, the electronic device can send a permission request to the virtual switch via the server and the physical machine so that the virtual switch can obtain the permission request.

[0126] In one embodiment, the virtual switch can search for a logical identifier list maintained for the virtual machine based on the identity of the virtual machine in the permission request (wherein the virtual switch may maintain logical identifier lists for different virtual machines at the same time. In this case, it is necessary to lock the logical identifier list maintained for the virtual machine based on the identity of the virtual machine in the permission request), and then store the logical identifier of the target network function processing logic in the logical identifier list to set the target network function processing logic as the network function processing logic allowed to be used for processing messages sent to the virtual machine.

[0127] Or, in another embodiment, the virtual switch may store a correspondence table entry between the identity of the virtual machine allowed to be carried in the request and the logical identifier of the target network function processing logic in a pre-stored correspondence between the identity of the virtual machine and the logical identifier of the network function processing logic allowed to be used for processing messages sent to the virtual machine.

[0128] Through this application, it is possible to support tenants of virtual machines to flexibly set the network function processing logic allowed by the virtual switch for processing messages sent by the virtual machine according to actual needs, so that tenants of virtual machines can flexibly set the network function processing logic allowed by the virtual switch for processing messages sent by the virtual machine to meet the actual needs and real-time needs of tenants. In addition, the network function processing logic allowed by the virtual switch for processing messages sent by the tenant's virtual machine can be set through the setting page accessible to the tenant, which can improve the convenience of setting.

[0129] In addition, to support tenants to set the network function processing logic that is prohibited for the virtual switch to process the messages sent by the tenant's virtual machine, see Fig.10 , shows a setting method of the present application, which is applied to electronic devices that can be directly controlled by tenants, and the electronic devices may include laptops, desktop computers, mobile phones, tablet computers or PDAs, etc. Among them, the method includes:

[0130] In step S301, a setting page for the virtual machine is displayed, which at least includes: setting controls and logical identifiers of multiple network function processing logics for message processing built into the virtual switch connected to the virtual machine, and a communication connection between the virtual switch and the virtual machine.

[0131] In the present application, when the tenant needs to set up the network function processing logic that is prohibited for use by the virtual switch for processing messages sent by the tenant's virtual machine, the tenant can control the electronic device to display the main page of the virtual machine. For example, the tenant is a tenant who rents a virtual machine. For the tenant, the tenant can use the electronic device to enter the login page provided by the server (the server can be a device that manages each virtual machine and virtual switch, etc.). The tenant can enter the tenant's account and password in the login page provided by the server to log in to the server, and then jump to the main page of the tenant's virtual machine. Then, the tenant can enter the setting page for the virtual machine from the main page of the virtual machine. The setting page for the virtual machine has the IP address of the virtual switch (the virtual switch used to forward the messages of the tenant's virtual machine) that is connected to the tenant's virtual machine for communication. The setting page can also include at least: setting controls, and logical identifiers of multiple network function processing logics built into the virtual switch for message processing.

[0132] Tenants can obtain the network function processing logic that can be used by the virtual switch when processing messages sent by the virtual machine based on the logical identifiers of multiple network function processing logics. Tenants can set the network function processing logic that the virtual switch prohibits from using when processing messages sent by the tenant's virtual machine based on the setting controls.

[0133] In step S302, a prohibition operation based on a setting control input is received, where the prohibition operation is used to indicate setting a target network function processing logic as a network function processing logic prohibited from being used for message processing sent by a virtual machine.

[0134] In one embodiment, there may be multiple setting controls, and each logical identifier of each network function processing logic for message processing may correspond to a setting control, and the setting control may include a disable button and a disable button.

[0135] For any one of the multiple network function processing logics built into the virtual switch for message processing, if the tenant needs to set the network function processing logic as a network function processing logic prohibited from being used by the virtual switch for message processing sent by the tenant's virtual machine, the tenant can click the prohibition button in the setting control corresponding to the logic identifier of the network function processing logic. The same is true for each of the other network function processing logics built into the virtual switch for message processing.

[0136] Among them, the network function processing logic corresponding to the logical identifier of the setting control whose prohibit button is clicked can be regarded as the target network function processing logic, and the tenant's click operation of the prohibit button in the setting control corresponding to the logical identifier of the target network function processing logic can be regarded as a prohibition operation based on the setting control input.

[0137] In step S303, a prohibition request is generated according to the prohibition operation, the prohibition request carries the identity of the virtual machine and the logical identifier of the target network function processing logic, and the prohibition request is used to request that the target network function processing logic be set as a network function processing logic that is prohibited from being used for processing messages sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic.

[0138] For any one of the multiple network function processing logics built into the virtual switch for processing messages, the setting control corresponding to the logical identifier of the network function processing logic has the logical identifier of the network function processing logic. In this way, if the prohibition button in the setting control corresponding to the logical identifier of the network function processing logic is clicked (the network function processing logic is the target network function processing logic), the electronic device can obtain the logical identifier of the network function processing logic in the setting control corresponding to the logical identifier of the network function processing logic. The same is true for each of the other network function processing logics built into the virtual switch for processing messages.

[0139] In addition, the setting page for the virtual machine is entered from the main page of the virtual machine. The main page of the virtual machine has the identity of the virtual machine. The setting page for the virtual machine may also have the identity of the virtual machine. In this way, the electronic device can obtain the identity of the virtual machine in the setting page for the virtual machine.

[0140] In this way, the electronic device can obtain the identity of the virtual machine and the logical identifier of the target network function processing logic. The electronic device can learn from the received prohibition operation based on the setting control input that the tenant needs to set the target network function processing logic to a network function processing logic that is prohibited from being used for processing messages sent to the virtual machine. In this way, the electronic device can generate a prohibition request and then execute step S204.

[0141] The identity of the virtual machine may include the IP address of the virtual machine, etc.

[0142] In step S304, a prohibition request is sent to the virtual switch, so that the virtual switch sets the target network function processing logic to be a network function processing logic prohibited from being used for message processing sent by the virtual machine according to the identity of the virtual machine in the prohibition request and the logic identifier of the target network function processing logic.

[0143] The electronic device can communicate with the server through the setting page for the virtual machine, and the server can communicate with the physical machine where the virtual switch is located. In this way, the electronic device can send a prohibition request to the virtual switch via the server and the physical machine so that the virtual switch can receive the prohibition request.

[0144] In one embodiment, the virtual switch can search the logical identification list maintained for the virtual machine based on the identity of the virtual machine in the prohibition request (the virtual switch may maintain logical identification lists for different virtual machines at the same time. In this case, it is necessary to lock the logical identification list maintained for the virtual machine based on the identity of the virtual machine in the prohibition request), and then store the logical identification of the target network function processing logic in the logical identification list to set the target network function processing logic as the network function processing logic that is prohibited from being used for processing messages sent to the virtual machine.

[0145] Or, in another embodiment, the virtual switch may store a correspondence table entry between the identity of the virtual machine carried in the prohibited request and the logical identifier of the target network function processing logic in a pre-stored correspondence between the identity of the virtual machine and the logical identifier of the network function processing logic prohibited from being used for processing messages sent to the virtual machine.

[0146] Through this application, it is possible to support tenants of virtual machines to flexibly set the network function processing logic prohibited by the virtual switch for message processing sent by the virtual machine according to actual needs, so as to facilitate tenants of virtual machines to flexibly set the network function processing logic prohibited by the virtual switch for message processing sent by the virtual machine to meet the actual needs and real-time needs of tenants. In addition, the network function processing logic prohibited by the virtual switch for message processing sent by the tenant's virtual machine can be set through the setting page accessible to the tenant, which can improve the convenience of setting.

[0147] It should be noted that, for the method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions involved are not necessarily required by the present application.

[0148] Reference Fig.11 , showing a structural block diagram of a device for processing a message of the present application, which is applied to a virtual switch, and the device includes: a first receiving module 11, used to receive a message to be forwarded sent by a virtual machine; an extraction module 12, used to extract the identity of the virtual machine in the message to be forwarded; a calling module 13, used to call, according to the identity, a target network function processing logic allowed to be used for processing the message to be forwarded sent by the virtual machine from a plurality of network function processing logics built into the virtual switch for message processing; a processing module 14, used to process the message to be forwarded based on the target network function processing logic; a forwarding module 15, used to forward the message to be forwarded processed based on the target network function processing logic.

[0149] The calling module includes: a searching unit, used to search a logical identifier list maintained for the virtual machine according to the identity identifier of the virtual machine, the logical identifier list including at least one logical identifier, and the logical identifiers in the logical identifier list include: a logical identifier of a network function processing logic allowed to be used for processing messages sent by the virtual machine; and a calling unit, used to call a target network function processing logic allowed to be used for processing messages to be forwarded sent by the virtual machine according to the logical identifier in the logical identifier list.

[0150] The device also includes: a first generation module, which is used to generate matching information including four-tuple information, three-tuple information or two-tuple information when the target network function processing logic does not include security group verification; and generate action information corresponding to the target network function processing logic; a second generation module, which is used to generate flow table entries based on the generated matching information and action information; and a first storage module, which is used to store the generated flow table entries in the forwarding flow table.

[0151] The device also includes: a determination module, which is used to determine whether there is a duplicate flow table entry in the forwarding flow table before generating matching information including binary information, triplet information or quadruple information, and the matching information in the duplicate flow table entry includes the binary information, the triplet information or the quadruple information; a first generation module, which is also used to generate matching information including binary information, triplet information or quadruple information when there is no duplicate flow table entry in the forwarding flow table.

[0152] The device also includes: a first deletion module, which is used to delete the flow table entry corresponding to the virtual machine in the forwarding flow table when the network function processing logic allowed to be used for processing the message sent by the virtual machine changes.

[0153] The device also includes: a second deletion module, which is used to delete the flow table entry corresponding to the virtual machine in the forwarding flow table when the logical identifier of the target network function processing logic is deleted from the logical identifier list maintained for the virtual machine.

[0154] The first generation module includes: a determination unit, used to determine whether the message to be forwarded sent by the virtual machine is coupled with a communication protocol; a first generation unit, used to generate matching information including four-tuple information, three-tuple information or two-tuple information when the message to be forwarded sent by the virtual machine is not coupled with a communication protocol, and the four-tuple information, three-tuple information or two-tuple information does not include a communication protocol number; or, a second generation unit, used to generate matching information including four-tuple information or three-tuple information when the message to be forwarded sent by the virtual machine is coupled with a communication protocol, and the four-tuple information or three-tuple information includes a communication protocol number.

[0155] The determination unit includes: a first determination subunit, which is used to determine the service type or application type involved in the message to be forwarded sent by the virtual machine; a second determination subunit, which is used to determine that the message to be forwarded sent by the virtual machine is coupled to the communication protocol when the service type or application type involved in the message to be forwarded sent by the virtual machine is located in a preset type list; or, a third determination subunit, which is used to determine that the message to be forwarded sent by the virtual machine is not coupled to the communication protocol when the service type or application type involved in the message to be forwarded sent by the virtual machine is not located in the preset type list; wherein the preset type list is used to store the service type or application type involved in the message coupled with the communication protocol.

[0156] The message to be forwarded is sent by the virtual machine to the virtual switch based on the virtual network card of the virtual machine; the extraction module includes: an extraction unit, used to extract the network card identifier of the virtual network card from the message to be forwarded; and an acquisition unit, used to acquire the identity identifier of the virtual machine according to the network card identifier of the virtual network card.

[0157] Through the present application, when the virtual switch obtains a message sent by a virtual machine, part of the network function processing logic in a series of network function processing logics built into the virtual switch is used to process the message sent by the virtual machine, so as to reduce the number of network function processing logics used when processing the message sent by the virtual machine, that is, less network function processing logic can be used to process the message sent by the virtual machine, thereby saving time and improving the efficiency of the virtual switch in forwarding the message sent by the virtual machine. For example, the message sent by the virtual machine is not processed by non-essential network function processing logic, but only the network function processing logic other than the necessary network function processing logic in a series of network function processing logic is used to process the message sent by the virtual machine. In this way, the time spent in the process of "using non-essential network function processing logic to process the message sent by the virtual machine" can be saved, so that time can be saved without affecting the normal operation of the virtual machine (such as normal transmission of messages or normal provision of services, etc.), thereby improving the efficiency of the virtual switch in forwarding the message sent by the virtual machine.

[0158] Reference Fig.12 , showing a structural block diagram of a setting device of the present application, applied to a virtual switch, the device comprising: a second receiving module 21, used to receive a permission request submitted by a tenant of a virtual machine, the permission request carries the identity of the virtual machine and the logical identifier of the target network function processing logic, the permission request is used to request to set the target network function processing logic as the network function processing logic allowed for processing messages sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic; a first search module 22, used to search for a logical identifier list maintained for the virtual machine according to the identity of the virtual machine in the permission request; the logical identifier list includes at least one logical identifier, and the logical identifiers in the logical identifier list include: the logical identifier of the network function processing logic allowed for processing messages sent to the virtual machine; a second storage module 23, used to store the logical identifier of the target network function processing logic in the logical identifier list.

[0159] Through this application, it is possible to support tenants of virtual machines to flexibly set the network function processing logic allowed by the virtual switch for processing messages sent by the virtual machine according to actual needs, so that tenants of virtual machines can flexibly set the network function processing logic allowed by the virtual switch for processing messages sent by the virtual machine to meet the actual needs and real-time needs of tenants. In addition, the network function processing logic allowed by the virtual switch for processing messages sent by the tenant's virtual machine can be set through the setting page accessible to the tenant, which can improve the convenience of setting.

[0160] Reference Fig.13, showing a structural block diagram of a setting device of the present application, applied to a virtual switch, the device comprising: a third receiving module 31, used to receive a prohibition request submitted by a tenant of a virtual machine, the prohibition request carries the identity of the virtual machine and the logical identifier of the target network function processing logic, the prohibition request is used to request to set the target network function processing logic as a network function processing logic prohibited from being used for processing messages sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic; a second search module 32, used to search for a logical identifier list maintained for the virtual machine according to the identity of the virtual machine in the prohibition request; the logical identifier list includes at least one logical identifier, and the logical identifiers in the logical identifier list include: the logical identifier of the network function processing logic allowed to be used for processing messages sent to the virtual machine; a third storage module 33, used to delete the logical identifier of the target network function processing logic in the logical identifier list.

[0161] Through this application, it is possible to support tenants of virtual machines to flexibly set the network function processing logic prohibited by the virtual switch for message processing sent by the virtual machine according to actual needs, so as to facilitate tenants of virtual machines to flexibly set the network function processing logic prohibited by the virtual switch for message processing sent by the virtual machine to meet the actual needs and real-time needs of tenants. In addition, the network function processing logic prohibited by the virtual switch for message processing sent by the tenant's virtual machine can be set through the setting page accessible to the tenant, which can improve the convenience of setting.

[0162] Reference Fig.14, shows a structural block diagram of a setting device of the present application, the device comprising: a first display module 41, used to display a setting page for a virtual machine, the setting page at least comprising: a setting control, and a logical identifier of a plurality of network function processing logics built into a virtual switch for message processing; a communication connection between the virtual switch and the virtual machine; a fourth receiving module 42, used to receive an allow operation based on the setting control input, the allow operation is used to indicate setting the target network function processing logic as the network function processing logic allowed for message processing sent by the virtual machine; a third generating module 43, used to generate a permission request according to the permission operation, the permission request carries the identity of the virtual machine and the logical identifier of the target network function processing logic, the permission request is used to request setting the target network function processing logic as the network function processing logic allowed for message processing sent by the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic; a first sending module 44, used to send a permission request to the virtual switch, so that the virtual switch sets the target network function processing logic as the network function processing logic allowed for message processing sent by the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic in the permission request.

[0163] Through this application, it is possible to support tenants of virtual machines to flexibly set the network function processing logic allowed by the virtual switch for processing messages sent by the virtual machine according to actual needs, so that tenants of virtual machines can flexibly set the network function processing logic allowed by the virtual switch for processing messages sent by the virtual machine to meet the actual needs and real-time needs of tenants. In addition, the network function processing logic allowed by the virtual switch for processing messages sent by the tenant's virtual machine can be set through the setting page accessible to the tenant, which can improve the convenience of setting.

[0164] Reference Fig.15, shows a structural block diagram of a setting device of the present application, the device comprising: a second display module 51, used to display a setting page for a virtual machine, the setting page at least comprising: a setting control, and a logical identifier of a plurality of network function processing logics built into a virtual switch for message processing; a communication connection between the virtual switch and the virtual machine; a fifth receiving module 52, used to receive a prohibition operation based on a setting control input, the prohibition operation is used to indicate setting a target network function processing logic as a network function processing logic prohibited from being used for message processing sent to the virtual machine; a fourth generating module 53, used to generate a prohibition request according to the prohibition operation, the prohibition request carries the identity of the virtual machine and the logical identifier of the target network function processing logic, the prohibition request is used to request setting the target network function processing logic as a network function processing logic prohibited from being used for message processing sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic; a second sending module 54, used to send a prohibition request to the virtual switch, so that the virtual switch sets the target network function processing logic as a network function processing logic prohibited from being used for message processing sent to the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic in the prohibition request.

[0165] Through this application, it is possible to support tenants of virtual machines to flexibly set the network function processing logic prohibited by the virtual switch for message processing sent by the virtual machine according to actual needs, so as to facilitate tenants of virtual machines to flexibly set the network function processing logic prohibited by the virtual switch for message processing sent by the virtual machine to meet the actual needs and real-time needs of tenants. In addition, the network function processing logic prohibited by the virtual switch for message processing sent by the tenant's virtual machine can be set through the setting page accessible to the tenant, which can improve the convenience of setting.

[0166] The embodiment of the present application also provides a non-volatile readable storage medium, which stores one or more modules (programs). When the one or more modules are applied to a device, the device can execute instructions (instructions) of each method step in the embodiment of the present application.

[0167] The present application embodiment provides one or more machine-readable media on which instructions are stored, and when executed by one or more processors, the electronic device executes one or more methods in the above embodiments. In the present application embodiment, the electronic device includes a server, a gateway, a sub-device, etc., and the sub-device is an Internet of Things device or other device.

[0168] The embodiments of the present disclosure may be implemented as an apparatus configured as desired using any appropriate hardware, firmware, software, or any combination thereof, and the apparatus may include electronic devices such as servers (clusters), terminal devices such as IoT devices, and the like.

[0169] Fig.16 An exemplary device 1300 that can be used to implement various embodiments of the present application is schematically shown. For one embodiment, Fig.16 An exemplary apparatus 1300 is shown having one or more processors 1302, a control module (chip set) 1304 coupled to at least one of the (one or more) processors 1302, a memory 1306 coupled to the control module 1304, a non-volatile memory (NVM) / storage device 1308 coupled to the control module 1304, one or more input / output devices 1310 coupled to the control module 1304, and a network interface 1312 coupled to the control module 1304.

[0170] The processor 1302 may include one or more single-core or multi-core processors, and the processor 1302 may include any combination of general-purpose processors or special-purpose processors (e.g., graphics processors, application processors, baseband processors, etc.). In some embodiments, the device 1300 can be used as a server device such as a gateway in the embodiments of the present application. In some embodiments, the device 1300 may include one or more computer-readable media (e.g., memory 1306 or NVM / storage device 1308) having instructions 1314 and one or more processors 1302 configured to execute instructions 1314 in combination with the one or more computer-readable media to implement a module to perform the actions in the present disclosure.

[0171] For one embodiment, the control module 1304 may include any suitable interface controller to provide any suitable interface to at least one of the processor(s) 1302 and / or any suitable device or component in communication with the control module 1304. The control module 1304 may include a memory controller module to provide an interface to the memory 1306. The memory controller module may be a hardware module, a software module, and / or a firmware module.

[0172] The memory 1306 may be used, for example, to load and store data and / or instructions 1314 for the device 1300. For one embodiment, the memory 1306 may include any suitable volatile memory, such as a suitable DRAM. In some embodiments, the memory 1306 may include a double data rate quad synchronous dynamic random access memory (DDR4 SDRAM).

[0173] For one embodiment, the control module 1304 may include one or more input / output controllers to provide interfaces to the NVM / storage device 1308 and (one or more) input / output devices 1310. For example, the NVM / storage device 1308 may be used to store data and / or instructions 1314. The NVM / storage device 1308 may include any suitable non-volatile memory (e.g., flash memory) and / or may include any suitable (one or more) non-volatile storage devices (e.g., one or more hard disk drives (HDDs), one or more compact disk (CD) drives, and / or one or more digital versatile disk (DVD) drives). The NVM / storage device 1308 may include storage resources that are physically part of the device on which the apparatus 1300 is installed, or it may be accessible to the device without being part of the device. For example, the NVM / storage device 1308 may be accessed via (one or more) input / output devices 1310 over a network. (One or more) input / output devices 1310 may provide an interface for the apparatus 1300 to communicate with any other appropriate device, and the input / output device 1310 may include a communication component, a pinyin component, a sensor component, etc. The network interface 1312 may provide an interface for the apparatus 1300 to communicate through one or more networks, and the apparatus 1300 may wirelessly communicate with one or more components of a wireless network according to any of one or more wireless network standards and / or protocols, for example, access a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G, 5G, etc., or a combination thereof for wireless communication. For one embodiment, at least one of the (one or more) processors 1302 may be packaged together with the logic of one or more controllers (e.g., a memory controller module) of the control module 1304. For one embodiment, at least one of the (one or more) processors 1302 may be packaged together with the logic of one or more controllers of the control module 1304 to form a system-in-package (SiP). For one embodiment, at least one of the (one or more) processors 1302 may be integrated with the logic of one or more controllers of the control module 1304 on the same die. For one embodiment, at least one of the processor(s) 1302 may be integrated on the same die with the logic of one or more controllers of the control module 1304 to form a system on a chip (SoC).

[0174] In various embodiments, the device 1300 may be, but is not limited to, a terminal device such as a server, a desktop computing device, or a mobile computing device (e.g., a laptop computing device, a handheld computing device, a tablet computer, a netbook, etc.). In various embodiments, the device 1300 may have more or fewer components and / or a different architecture. For example, in some embodiments, the device 1300 includes one or more cameras, a keyboard, a liquid crystal display (LCD) screen (including a touch screen display), a non-volatile memory port, multiple antennas, a graphics chip, an application-specific integrated circuit (ASIC), and a speaker.

[0175] An embodiment of the present application provides an electronic device, comprising: one or more processors; and one or more machine-readable media having instructions stored thereon, which, when executed by the one or more processors, enable the electronic device to perform one or more methods in the present application.

[0176] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0177] Each embodiment in this specification is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referenced to each other. The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, and the combination of the processes and / or boxes in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable information processing terminal device to produce a machine, so that the instructions executed by the processor of the computer or other programmable information processing terminal device generate instructions for implementing the steps in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable information processing terminal device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable information processing terminal device, so that a series of operation steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable terminal device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps of the functions specified in a box or multiple boxes. Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they know the basic creative concept. Therefore, the attached claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0178] Finally, it should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements. The above describes in detail a method and device for processing a message and a setting method and device provided by the present application. The present application is explained in detail using specific examples in this article. The description of the above embodiments is only used to help understand the method and its core idea of ​​the present application; at the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation and scope of application. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for processing a message, characterized in that: Applied to a virtual switch, the method comprises: Receive the message to be forwarded sent by the virtual machine; Extracting the identity of the virtual machine from the message to be forwarded; According to the identity identifier, in a plurality of network function processing logics built into the virtual switch and used for processing messages, calling a target network function processing logic allowed to be used for processing the message to be forwarded sent by the virtual machine; Process the forwarded message based on the target network function processing logic; Forwards the message to be forwarded after being processed by the target network function processing logic.

2. The method according to claim 1, characterized in that The calling, according to the identity identifier, of a plurality of network function processing logics built into the virtual switch and used for processing messages, of a target network function processing logic allowed for processing the message to be forwarded sent by the virtual machine, comprises: According to the identity identifier of the virtual machine, searching a logical identifier list maintained for the virtual machine, the logical identifier list including at least one logical identifier, the logical identifiers in the logical identifier list including: a logical identifier of a network function processing logic allowed to be used for processing a message sent by the virtual machine; The target network function processing logic allowed for processing the message to be forwarded sent by the virtual machine is called according to the logical identifier in the logical identifier list.

3. The method according to claim 1, characterized in that The method further comprises: In the case where the target network function processing logic does not include security group verification, generating matching information including four-tuple information, three-tuple information or two-tuple information; and generating action information corresponding to the target network function processing logic; Generate a flow table entry according to the generated matching information and action information; The generated flow table entry is stored in the forwarding flow table.

4. The method according to claim 3, characterized in that The method further comprises: Before generating matching information including binary information, triple information or quadruple information, determining whether there is a duplicate flow table entry in the forwarding flow table, the matching information in the duplicate flow table entry including the binary information, triple information or quadruple information; When there is no duplicate flow table entry in the forwarding flow table, the step of generating matching information including binary information, triplet information or quadruple information is performed.

5. The method according to claim 3, characterized in that: The method further comprises: In the case where the network function processing logic allowed for processing the message sent by the virtual machine changes, the flow table entry corresponding to the virtual machine is deleted from the forwarding flow table.

6. The method according to claim 3, characterized in that The method further comprises: When the logical identifier of the target network function processing logic is deleted from the logical identifier list maintained for the virtual machine, the flow table entry corresponding to the virtual machine is deleted from the forwarding flow table.

7. The method according to claim 3, characterized in that The generating of matching information including four-tuple information, three-tuple information or two-tuple information includes: Determining whether the message to be forwarded sent by the virtual machine is coupled to a communication protocol; In the case where the message to be forwarded sent by the virtual machine is not coupled with a communication protocol, generating matching information including four-tuple information, three-tuple information or two-tuple information, wherein the four-tuple information, the three-tuple information or the two-tuple information does not include a communication protocol number; or, In the case where the message to be forwarded sent by the virtual machine is coupled with a communication protocol, matching information including four-tuple information or three-tuple information is generated, and the four-tuple information or the three-tuple information includes a communication protocol number.

8. The method according to claim 7, characterized in that The determining whether the message to be forwarded sent by the virtual machine is coupled to a communication protocol includes: Determine the service type or application type involved in the message to be forwarded sent by the virtual machine; In a case where the service type or application type involved in the message to be forwarded sent by the virtual machine is in a preset type list, determining a coupling communication protocol of the message to be forwarded sent by the virtual machine; or, When the service type or application type involved in the message to be forwarded sent by the virtual machine is not in the preset type list, determining that the message to be forwarded sent by the virtual machine is not coupled with a communication protocol; The preset type list is used to store the service types or application types involved in the messages of the coupled communication protocol.

9. The method according to claim 1, characterized in that: The message to be forwarded is sent by the virtual machine to the virtual switch based on the virtual network card of the virtual machine; The step of extracting the identity of the virtual machine from the message to be forwarded includes: Extracting the network card identifier of the virtual network card from the message to be forwarded; The identity identifier of the virtual machine is obtained according to the network card identifier of the virtual network card.

10. A setting method, characterized in that: Applied to a virtual switch, the method comprises: Receive a permission request submitted by a tenant of a virtual machine, where the permission request carries an identity identifier of the virtual machine and a logical identifier of a target network function processing logic, and the permission request is used to request that the target network function processing logic be set as a network function processing logic allowed for processing a message sent by the virtual machine according to the identity identifier of the virtual machine and the logical identifier of the target network function processing logic; According to the identity of the virtual machine in the permission request, searching a logical identifier list maintained for the virtual machine; the logical identifier list includes at least one logical identifier, and the logical identifiers in the logical identifier list include: a logical identifier of a network function processing logic allowed to be used for processing a message sent by the virtual machine; The logical identifier of the target network function processing logic is stored in the logical identifier list.

11. A setting method, characterized in that: Applied to a virtual switch, the method comprises: Receive a prohibition request submitted by a tenant of a virtual machine, where the prohibition request carries an identity identifier of the virtual machine and a logical identifier of a target network function processing logic, and the prohibition request is used to request that the target network function processing logic be set as a network function processing logic prohibited from being used for message processing sent by the virtual machine according to the identity identifier of the virtual machine and the logical identifier of the target network function processing logic; According to the identity of the virtual machine in the prohibition request, searching a logical identifier list maintained for the virtual machine; the logical identifier list includes at least one logical identifier, and the logical identifiers in the logical identifier list include: a logical identifier of a network function processing logic allowed to be used for processing a message sent by the virtual machine; Delete the logical identifier of the target network function processing logic from the logical identifier list.

12. A setting method, characterized in that: The method comprises: Displaying a setting page for the virtual machine, the setting page at least including: setting controls, and logic identifiers of multiple network function processing logics built into the virtual switch for processing packets; and a communication connection between the virtual switch and the virtual machine; receiving an allow operation based on a setting control input, where the allow operation is used to indicate setting a target network function processing logic as a network function processing logic allowed to be used for processing a message sent by the virtual machine; Generate a permission request according to the permission operation, the permission request carries the identity of the virtual machine and the logical identifier of the target network function processing logic, and the permission request is used to request to set the target network function processing logic as the network function processing logic allowed to be used for processing the message sent by the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic; Send an allow request to the virtual switch so that the virtual switch sets the target network function processing logic as the network function processing logic allowed for processing messages sent by the virtual machine according to the identity of the virtual machine in the allow request and the logic identifier of the target network function processing logic.

13. A setting method, characterized in that: The method comprises: Displaying a setting page for the virtual machine, the setting page at least including: setting controls, and logic identifiers of multiple network function processing logics built into the virtual switch for processing packets; and a communication connection between the virtual switch and the virtual machine; Receiving a prohibition operation based on a setting control input, where the prohibition operation is used to indicate setting a target network function processing logic to be a network function processing logic prohibited from being used for message processing sent by the virtual machine; Generate a prohibition request according to the prohibition operation, the prohibition request carries the identity of the virtual machine and the logical identifier of the target network function processing logic, and the prohibition request is used to request to set the target network function processing logic as a network function processing logic prohibited from being used for message processing sent by the virtual machine according to the identity of the virtual machine and the logical identifier of the target network function processing logic; A prohibition request is sent to the virtual switch so that the virtual switch sets the target network function processing logic to be a network function processing logic prohibited from being used for message processing sent by the virtual machine according to the identity of the virtual machine in the prohibition request and the logic identifier of the target network function processing logic.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 13 are implemented.

Images