Message control method, device and system

Abstract

The invention discloses a message management and control method, device and system, and belongs to the technical field of networks. The method comprises the following steps: a first device obtains a message, wherein the message comprises an identifier of an application deployed in a container; and the first device controls the message according to the identifier of the application. According to the invention, the message of the container is managed and controlled according to the identifier of the application deployed in the container, so that the difficulty of managing and controlling the message of the container is low.

Description

[0001] This application claims priority to a Chinese patent application filed on June 19, 2023, with application number 202310731435.2 and application name “A method and device for network management”, all contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of communication technology, and in particular to a message control method, device and system. Background Art

[0003] With the development of virtualization technology, applications can be deployed in containers, and resource isolation of different applications (applications, apps) can be achieved based on containers. The Internet Protocol (IP) address of the container will change dynamically due to the online, offline, and migration of the container. At present, the container's messages are usually controlled based on the IP address of the container carried by the container's message, but since the container's IP address changes dynamically, it is difficult to control the container's messages based on the container's IP address. Summary of the invention

[0004] The present application provides a message control method, device and system, which helps to reduce the difficulty of message control. The technical solution of the present application is as follows.

[0005] In a first aspect, a message control method is provided, the method comprising: a first device obtains a message, the message including an identifier of an application deployed in a container; the first device controls the message according to the identifier of the application. The message is a message of the container. For example, the message is a data message of the application deployed in the container, and the message includes data of the application.

[0006] The technical solution provided by the present application carries the identifier of the application deployed in the container in the container's message, and manages the container's message based on the identifier of the application deployed in the container. Since the identifier of the application deployed in the container will not change dynamically due to the online, offline, migration, etc. of the container, the technical solution provided by the present application is less difficult to manage the container's message.

[0007] Optionally, the message is an Internet Protocol version 6 (IPv6) message, the message includes an application-aware networking (APN) header, and the APN header includes an identifier of the application; or

[0008] The message is an Internet Protocol version 4 (IPv4) message or an IPv6 message, and the message includes a transmission control protocol (TCP) header, and the TCP header includes an identifier of the application.

[0009] Optionally, the message is an IPv6 message, the message includes an APN header, the APN header includes an APN identification (APN identification, APN ID) field, and the APN ID field includes the identification of the application; or the message is an IPv4 message or an IPv6 message, the message includes a TCP header, the TCP header includes an option field, and the option field includes the identification of the application.

[0010] Optionally, the first device controls the message according to the identifier of the application, including: the first device determines a control policy for the message according to the identifier of the application; the first device forwards or discards the message according to the control policy. The control policy is used to indicate whether to forward or discard the message, and the control policy may be a correspondence between the identifier of the application and a control operation, and the control operation includes forwarding or discarding.

[0011] Optionally, the first device is a device for deploying the container, and the first device obtaining the message includes: the first device obtaining the identifier of the application; the first device generating the message according to the identifier of the application. For example, the first device generates an IPv6 message, the IPv6 message includes an APN header, and the APN header includes the identifier of the application. For another example, the first device generates an IPv6 message, the IPv6 message includes a TCP header, and the TCP header includes the identifier of the application. For another example, the first device generates an IPv4 message, the IPv4 message includes a TCP header, and the TCP header includes the identifier of the application.

[0012] Optionally, the first device acquiring the identifier of the application includes: the first device acquiring a correspondence between the identifier of the container and the identifier of the application; and the first device acquiring the identifier of the application according to the identifier of the container and the correspondence.

[0013] Optionally, the first device obtains the correspondence between the identifier of the container and the identifier of the application, including: the first device receives the correspondence from the control device, and the correspondence is generated by the control device according to the identifier of the container and the identifier of the application. For example, the control device is a container management platform, and the identifier of the container and the identifier of the application are generated by the control device when the container goes online. The control device can send the correspondence to the first device through a representational state transfer (Restful) interface.

[0014] Optionally, the first device acquiring the correspondence between the identifier of the container and the identifier of the application includes: the first device generating the correspondence according to configuration information. The configuration information may be information statically configured in the first device, or information sent by the control device to the first device.

[0015] Optionally, the first device is a device in a network to which the device deploying the container is connected, and the first device acquiring the message includes: the first device receiving the message sent by the device deploying the container, wherein the message is generated by the device deploying the container.

[0016] In a second aspect, a message control device is provided, which includes modules for executing the method provided in the first aspect or any optional method of the first aspect. These modules can be implemented based on software, hardware, or a combination of software and hardware, and these modules can be arbitrarily combined or divided based on specific implementations.

[0017] In a third aspect, a message control device is provided, which includes a memory and a processor; the memory is used to store computer programs; the processor is used to execute the computer programs stored in the memory so that the message control device performs the method provided in the first aspect or any optional method of the first aspect.

[0018] In a fourth aspect, a message management and control device is provided, which includes a main control board and an interface board, and the main control board and the interface board are used to implement the method provided by the above-mentioned first aspect or any optional method of the first aspect.

[0019] In a fifth aspect, a message control system is provided, which includes a device for deploying a container and a device in a network to which the device for deploying the container is connected, and any of the devices in the network to which the device for deploying the container is connected includes the message control device provided in the second aspect or the third aspect above.

[0020] In a sixth aspect, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed, the method provided in the first aspect or any optional manner of the first aspect is implemented.

[0021] In a seventh aspect, a computer program product is provided, which includes a program or code, and when the program or code is executed, it implements the method provided in the first aspect or any optional manner of the first aspect.

[0022] In an eighth aspect, a chip is provided, which includes a programmable logic circuit and / or program instructions, and when the chip is running, it is used to implement the method provided in the first aspect or any optional manner of the first aspect.

[0023] The technical effects of the second to eighth aspects mentioned above can refer to the technical effects of the first aspect and will not be elaborated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a schematic diagram of an application scenario provided by an embodiment of the present application;

[0025] Figure 2 is a schematic diagram of a device for deploying containers provided in an embodiment of the present application;

[0026] Figure 3 This is a flow chart of a message control method provided by an embodiment of the present application;

[0027] Figure 4 is a schematic diagram of an APN header provided in an embodiment of the present application;

[0028] Figure 5 is a schematic diagram of a TCP option field provided in an embodiment of the present application;

[0029] Figure 6 It is a schematic diagram of a message control device provided in an embodiment of the present application;

[0030] Figure 7 It is a schematic diagram of another message control device provided in an embodiment of the present application;

[0031] Figure 8 It is a schematic diagram of another message control device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] The following will further describe the implementation of the present application in detail with reference to the accompanying drawings. First, the application scenario of the present application is introduced.

[0033] The application scenario of the present application provides a communication system, which includes a network and a device connected to the network. The network is used to provide a message forwarding service for the device connected to the network, so that different devices connected to the network can communicate.

[0034] The network is a network domain or includes at least two network domains. The network includes a metropolitan area network, a wide area network, a campus network, the Internet, a private network, a data center network (DCN), etc. The network includes multiple network devices, which include forwarding devices and may also include security devices. The forwarding devices are used for message forwarding, and the security devices are used to ensure the security of the network. For example, the forwarding devices are switches or routers, and the security devices are firewalls.

[0035] Among them, the devices accessing the network include a host, a server, etc. An application may be deployed in the host, and the server may provide services corresponding to the application to the host. For example, a video application is deployed in the host, and the server may provide services corresponding to the video application (i.e., video services) to the host. For another example, an audio application is deployed in the host, and the server may provide services corresponding to the audio application (i.e., audio services) to the host. Optionally, the network devices (e.g., forwarding devices) in the network include access devices, and the host, server, etc. are connected to the access devices in the network to access the network. The access device may be a leaf device, for example, the access device may be a leaf switch. It should be noted that the host described in the embodiment of the present application may be a terminal such as a mobile phone, a tablet computer, a laptop computer, a desktop computer, a television, a vehicle-mounted terminal, a personal digital assistant (PDA), etc., and the server may be a server, or a server cluster consisting of several servers, or a cloud computing service center, which is not limited in the embodiment of the present application.

[0036] Optionally, at least one device (such as a host) connected to the network is deployed with a container, an application is deployed in each container, and an application is deployed in one or more containers, so that different applications in the same device can be isolated through containers. A container is a computing unit (or virtual computer) that can run independently based on virtualization technology. The container has its own computing resources, memory resources and file system. In some embodiments, the container is also called a point of deployment (POD) or a deployment unit.

[0037] In an optional embodiment, the communication system further includes a control device, which is used to manage and control the container, for example, the control device is used to control the online, offline, migration, etc. of the container. Among them, the control device controlling a certain container to go online on a certain device may be that the control device deploys or creates the certain container in the certain device. The control device controlling a certain container to go offline from a certain device may be that the control device destroys the certain container in the certain device. The control device controlling a certain container to migrate from a certain device to another device includes that the control device controls the certain container to go offline from the certain device and controls the certain container to go online on the other device.

[0038] In an optional embodiment, the control device includes a container management platform, which controls the launch, offline, migration, etc. of the container. In one embodiment, the container management platform includes a container management component, which controls the launch, offline, migration, etc. of the container. In one example, the container management platform is k8s, and the container management component is k8smaster. K8s master is also called k8s management node, k8s management component, k8s management unit, k8s management module, etc. K8s is the abbreviation of Kubernetes. Kubernetes comes from Greek, meaning "helmsman" or "navigator". Kubernetes is an open source system for automatically deploying, scaling and managing containerized applications. Kubernetes aims to provide a "platform for automatically deploying, scaling and running application containers across host clusters."

[0039] In an optional embodiment, the control device is also used to generate a correspondence between the identifier of the container and the identifier of the application deployed in the container when the container is online, and send the correspondence to the device that deploys the container. When the device that deploys the container generates a message for the container, the message of the container carries the identifier of the application deployed in the container. The device that deploys the container or the device in the network to which the device that deploys the container is connected (e.g., a security device) controls the message of the container according to the identifier of the application deployed in the container carried in the message of the container. Among them, the device that deploys the container is also the device on which the container is online. For example, if a container is online on a certain device, then the certain device is the device that deploys the certain container. Optionally, the control device is also used to clear the correspondence between the identifier of the container and the identifier of the application deployed in the container when the container is offline. The control device is also used to send the correspondence between the identifier of the container and the identifier of the application deployed in the container to the other device after the container is migrated from one device to another. In one embodiment, the control device includes a container management component and an identification management component. The container management component is used to control the online, offline, migration, etc. of the container. The identification management component is used to generate a correspondence between the identification of the container and the identification of the application deployed in the container, and send the correspondence to the device where the container is deployed. In addition, the identification management component is used to clear the correspondence between the identification of the container and the identification of the application deployed in the container when the container is offline. The identification management component is used to send the correspondence between the identification of the container and the identification of the application deployed in the container to the device where the container is located after the container is migrated. Among them, the container management component is also called a container management node, a container management unit, a container management module, a container management plug-in, etc. The identification management component is also called an identification management node, an identification management unit, an identification management module, an identification management plug-in, etc., which is not limited in the embodiments of the present application.

[0040] Optionally, since the container managed by the control device may be deployed in multiple devices, the above correspondence generated by the control device (i.e., the correspondence between the identifier of the container and the identifier of the application deployed in the container) may also include the online position of the container, which is used to indicate on which device the container is online, for example, the online position is the identifier of the device on which the container is online (i.e., the device on which the container is deployed). The embodiment of the present application carries the online position of the container in the correspondence, so that the control device can send the correspondence to the device on which the container is deployed (i.e., the device on which the container is online) according to the online position of the container, and the embodiment of the present application does not limit this.

[0041] As an example, see Figure 1, which shows a schematic diagram of an application scenario provided by an embodiment of the present application, wherein the communication system provided by the application scenario includes a network 100, a control device 200, and a host 310, a host 320, and a server 330 accessing the network 100. The network 100 includes a forwarding device 110 for message forwarding and a security device 120 for ensuring the security of the network 100. It should be noted that, Figure 1 The devices included in the network 100 are shown only by way of example. In actual applications, the network 100 includes multiple forwarding devices, and the network 100 includes one or more security devices. For example, the network 100 includes multiple network domains, each network domain includes multiple forwarding devices, and there is a security device between any two network domains in the multiple network domains. The security device can be located in the network domain or outside the network domain. In one embodiment, the multiple network domains include an Internet Protocol (IP) network domain.

[0042] like Figure 1 As shown, containers C1-C2 are deployed in host 310, application A1 is deployed in container C1, and application A2 is deployed in container C2. Containers C3-C4 are deployed in host 320, application A1 is deployed in container C3, and application A3 is deployed in container C4. That is, application A1 is deployed in two containers, and these two containers are deployed in different hosts, and application A2 and application A3 are deployed in one container respectively. The control device 200 is connected to the host 310 and the host 320 respectively, and the control device 200 is used to control the online, offline, migration, etc. of containers C1-C4. Optionally, the control device 200 generates a correspondence between the identifier of the container and the identifier of the application deployed in the container when any container among containers C1 to C4 goes online, and sends the correspondence to the device where the container is deployed. When the device where the container is deployed generates a message for the container, the message carries the identifier of the application deployed in the container. The device where the container is deployed or a device in the network 100 (such as the security device 120) controls the message of the container according to the identifier of the application deployed in the message. Optionally, the control device 200 is also used to clear the correspondence between the identifier of the container and the identifier of the application deployed in the container when any container among containers C1 to C4 goes offline, and the control device 200 is also used to send the correspondence between the identifier of the container and the identifier of the application deployed in the container to the device where the migrated container is located after any container among containers C1 to C4 is migrated. Figure 1As shown, the control device 200 includes a container management component and an identification management component. The container management component is used to control the online, offline, migration, etc. of the container, and the identification management component is used to maintain the correspondence between the identification of the container and the identification of the application deployed in the container. For example, the identification management component is used to generate the correspondence between the identification of the container and the identification of the application deployed in the container when the container is online, the identification management component is used to clear the correspondence between the identification of the container and the identification of the application deployed in the container when the container is offline, and the identification management component is used to send the correspondence between the identification of the container and the identification of the application deployed in the container to the device where the container is located after migration.

[0043] In one example, the control device 200 controls the container C1 to go online in the host 310. When the container C1 goes online in the host 310, the control device 200 generates a correspondence between the identifier "C1" of the container C1 and the identifier "A1" of the application A1 deployed in the container C1 (for the convenience of description, the correspondence is referred to as the correspondence 1), and the control device 200 sends the correspondence 1 to the host 310. When the host 310 generates a message of the container C1 (for example, when the application A1 deployed in the container C1 needs to access the server 330, the host 310 generates a message of the container C1), the host 310 determines the identifier "A1" of the application A1 deployed in the container C1 according to the identifier "C1" of the container C1 and the correspondence 1, and the host 310 generates a message A of the container C1 according to the identifier "A1" of the application A1 deployed in the container C1, and the message A includes the identifier "A1" of the application A1 deployed in the container C1. In one embodiment, after the host 310 generates message A, the host 310 controls message A according to the identifier "A1" of application A1 included in message A. For example, the host 310 determines the control policy of message A according to the identifier "A1" of application A1 included in message A, and the host 310 controls message A according to the control policy of message A. In another embodiment, after the host 310 generates message A, it sends message A. After the security device 120 receives message A, the security device 120 controls message A according to the identifier "A1" of application A1 included in message A. For example, the security device 120 determines the control policy of message A according to the identifier "A1" of application A1 included in message A, and the security device 120 controls message A according to the control policy of message A.

[0044] In an optional embodiment, when container C1 goes online in the host 310, the control device 200 generates a correspondence 1' based on the identifier of the host 310, the identifier "C1" of the container C1, and the identifier "A1" of the application A1 deployed in the container C1. The correspondence 1' includes the identifier of the host 310 and the above-mentioned correspondence 1. The identifier of the host 310 in the correspondence 1' is used to indicate that the online location of the container C1 is the host 310. The control device 200 sends the correspondence 1 to the host 310 based on the online location (for example, sends the correspondence 1').

[0045] In an optional embodiment, the control device 200 further controls the container C1 to go offline from the host 310. When the container C1 goes offline from the host 310, the control device 200 can clear the corresponding relationship 1 stored in the control device 200 (for example, clear the corresponding relationship 1'). In addition, the control device 200 can also instruct the host 310 to send a clear corresponding relationship 1 stored in the host 310, which is not limited in the embodiment of the present application.

[0046] In an optional embodiment, the control device 200 further controls the migration of the container C1 from the host 310 to the host 320. After the migration of the container C1 from the host 310 to the host 320, the control device 200 sends the above correspondence 1 to the host 320. For example, after the migration of the container C1 from the host 310 to the host 320, the control device 200 updates the identifier of the host 310 included in the above correspondence 1' to the identifier of the host 320, so as to update the online position of the container C1 to the host 320, and the control device 200 sends the correspondence 1 to the host 320 according to the online position of the container C1 recorded in the updated correspondence 1' (for example, sends the updated correspondence 1'). Optionally, the control device 200 controls the migration of the container C1 from the host 310 to the host 320 based on an event trigger. For example, when the load on the host 310 is high, the control device 200 controls the container C1 to migrate from the host 310 to the host 320; or, when the host 310 fails, the control device 200 controls the container C1 to migrate from the host 310 to the host 320; or, the control device 200 controls the container C1 to migrate from the host 310 to the host 320 according to the user's migration request, which is not limited in the embodiments of the present application.

[0047] Here, the online, offline, migration, and message control of container C1 are taken as an example. The online, offline, migration, and message control of containers C2 to C4 can refer to the relevant description of container C1, which is not repeated here.

[0048] In an optional embodiment, after the device deploying the container obtains the correspondence between the identifier of the container and the identifier of the application deployed in the container, when the container needs to access the service corresponding to the application deployed in the container (for example, when the application deployed in the container needs to access the corresponding service), the device deploying the container obtains the identifier of the application based on the identifier of the container and the correspondence, and generates a message for the container based on the identifier of the application, the message of the container includes the identifier of the application, and after generating the message for the container, the device deploying the container sends the message for the container to the server providing the corresponding service. Figure 1 For example, for example, the server 330 is used to provide services corresponding to application A1 (for example, application A1 is a video application, and the server 330 is used to provide corresponding video services). After the host 310 obtains the correspondence between the identifier "C1" of the container C1 and the identifier "A1" of the application A1 deployed in the container C1, when the container C1 needs to access the service corresponding to the application A1, the host 310 determines the identifier "A1" of the application A1 deployed in the container C1 based on the identifier "C1" of the container C1 and the correspondence, and generates a message A of the container C1 based on the identifier "A1" of the application A1, and the message A includes the identifier "A1" of the application A1. Optionally, after the host 310 generates the message A of the container C1, the host 310 sends the message A to the server 330 through the network 100. During the transmission of the message A in the network 100, the forwarding device 110 in the network 100 forwards the message A, and the security device 120 in the network 100 manages and controls the message A. In one example, Figure 2 It is a schematic diagram of a device for deploying containers (for example, a host 310 for deploying container C1), the device for deploying containers includes a processing module 210 and a sending module 220, the processing module 210 is used to obtain the identification of the application according to the identification of the container and the corresponding relationship when the container needs to access the service corresponding to the application deployed in the container, and generate a message for the container according to the identification of the application, the sending module 220 is used to send the message of the container to the server providing the corresponding service, and the embodiment of the present application is not limited to this.

[0049] It should be noted that the identifier of the application described in the embodiment of the present application may be the name of the application or any identification information assigned to the application that can uniquely identify the application. Since the name of the application is usually long, carrying the name of the application in the message is likely to increase the message overhead. Therefore, the identifier of the application described in the embodiment of the present application may be identification information assigned to the application. The length of the identification information may be less than the length of the name of the application. Carrying the identification information in the message has little effect on the message overhead, and the identification information can be conveniently carried in the message. Optionally, the control device assigns an identifier to the application deployed in the container when the container is online. For example, the identification management component in the control device assigns an identifier to the application deployed in the container when the container is online. The embodiment of the present application does not limit this.

[0050] It should be noted that Figure 1 The communication system shown is for example only. In some embodiments, a container is also deployed in the server 330 to achieve isolation of different services. In addition, the communication system may also include other devices, for example, the communication system also includes a network controller for controlling the devices in the network 100. The network controller and the control device 200 are one device or two independent devices. The number of devices in the communication system and the connection relationship between the devices can be configured as needed, and the embodiments of the present application are not limited to this.

[0051] The container's message usually includes the container's IP address. For example, the source IP address of the container's message is the container's IP address. In the current message control scheme, the container's message is controlled based on the container's IP address carried in the container's message. For example, the container's message control strategy is determined based on the container's IP address carried in the container's message, and then the container's message is controlled based on the container's message control strategy. However, containers are highly dynamic and decentralized, and the container's IP address will change dynamically due to the container's online, offline, migration, etc., which makes the current message control scheme more difficult. For example, if the container's message is controlled based on the container's IP address, the control strategy needs to be frequently modified, resulting in greater control difficulty. Figure 1 For example, if the message of container C1 is controlled according to the IP address of container C1, if container C1 is migrated from host 310 to host 320, the IP address of container C1 will change, which requires modification of the control strategy of the message of container C1. The whole process is relatively complicated, resulting in greater difficulty in message control. In an embodiment of the present application, the message of the container carries the identifier of the application deployed in the container, and the message of the container is controlled according to the identifier of the application carried by the message of the container. Since the identifier of the application deployed in the container will not change dynamically due to the online, offline, migration, etc. of the container, the control difficulty is relatively small.

[0052] The above is an introduction to the application scenarios of the present application. The following is an introduction to the implementation example of the message control method of the present application.

[0053] Please refer to Figure 3 , which shows a flow chart of a message control method provided by an embodiment of the present application. The message control method is executed by a first device. The first device is a device for deploying containers or a device in a network to which the device for deploying containers is connected. The following is an example in which the first device is a device for deploying container C1 or a device in a network to which the device for deploying container C1 is connected (e.g., a security device). Figure 1 As shown, the first device may be the host 310 or the security device 120. Figure 3 As shown, the message control method includes the following steps S301 to S302.

[0054] S301. The first device obtains a message A, where the message A includes an identifier of an application A1 deployed in a container C1.

[0055] Among them, message A is a message of container C1, specifically, a message of application A1 deployed in container C1, and message A includes data of application A1. For example, the data of application A1 is in the payload of message A. In one example, application A1 is a video application, and the data of application A1 is video data. In another example, application A1 is an audio application, and the data of application A1 is audio data.

[0056] In an embodiment of the present application, message A is an Internet Protocol version 6 (IPv6) message or an Internet Protocol version 4 (IPv4) message. When message A is an IPv6 message, message A includes an application-aware networking (APN) header or a transmission control protocol (TCP) header, and the APN header or the TCP header includes an identification of application A1. When message A is an IPv4 message, message A includes a TCP header, and the TCP header includes an identification of application A1. The following describes a method in which message A carries the identification of application A1 in two embodiments.

[0057] First embodiment: Message A is an IPv6 message, and Message A includes an APN header, and the APN header includes an identifier of Application A.

[0058] Optionally, message A includes an IPv6 header and an IPv6 extension header, and the IPv6 extension header includes the APN header, which is also called an IPv6-based APN header, referred to as an APN6 header. The IPv6 extension header may be a hop by hop header (HBH) and a destination options header (DOH), which is not limited in the embodiments of the present application. Optionally, the APN header includes an APN identification (APN identification, APN ID) field, and the APN ID field includes an identification of application A. For example, the APN ID field includes an application group identification (APP-Group-ID) subfield, a user group identification (USER-Group-ID) subfield, and a reserved subfield, and the identification of application A is included in at least one of the APP-Group-ID subfield, the USER-Group-ID subfield, and the reserved subfield.

[0059] For an example, see Figure 4, which shows a schematic diagram of an APN header provided by an embodiment of the present application. The APN header includes the following fields: APN ID type, flag, APN parameter (parameters) type, APN ID, intent and APN parameters. The length of the APN ID type field and the length of the flag field are both 8 bits, the length of the APN parameter type field is 16 bits, the length of the APN ID field is 32 bits, 64 bits or 128 bits, and the length of the intent field is 32 bits. The intent field and the APN parameter field are both optional fields. The APN ID field is used to carry the APN ID, and the length of the APN ID is 32 bits, 64 bits or 128 bits. The APN ID type field is used to indicate the length of the APN ID carried by the APN ID field. For example, when the value of the APN ID type field is a first value (e.g., type I), the APN ID type field is used to indicate that the length of the APN ID carried by the APN ID field is 32 bits, when the value of the APN ID type field is a second value (e.g., type II), the APN ID type field is used to indicate that the length of the APN ID carried by the APN ID field is 64 bits, and when the value of the APN ID type field is a third value (e.g., type III), the APN ID type field is used to indicate that the length of the APN ID carried by the APN ID field is 128 bits. The flag field is currently reserved and may be defined in future versions. The intent field indicates a set of service requirements of the service on the network. The APN parameter field is used to carry APN parameters, and the APN parameter type field is used to indicate which APN parameters the APN parameter field carries. For example, the APN parameter type field indicates which APN parameters the APN parameter field carries in the form of a bit map. For example, among the 16 bits arranged from low to high in the APN parameter type field, the first bit corresponds to the bandwidth requirement, the second bit corresponds to the delay requirement, the third bit corresponds to the jitter requirement, and the fourth bit corresponds to the packet loss rate requirement; when the first bit is set (set to 1), the APN parameter type field indicates that the APN parameter field carries a bandwidth requirement parameter; when the second bit is set, the APN parameter type field indicates that the APN parameter field carries a delay requirement parameter; when the third bit is set, the APN parameter type field indicates that the APN parameter field carries a jitter requirement parameter; when the fourth bit is set, the APN parameter type field indicates that the APN parameter field carries a packet loss rate requirement parameter. The embodiments of the present application may be used in Figure 4 The APN ID field in the APN header shown carries the identifier of application A.

[0060] This article only describes the structure of the APN header by way of example. For a detailed description of the APN header, please refer to the Internet Engineering Task Force (IETF) document "draft-li-apn-header", which will not be repeated here. Among them, the APN technology carries APN information in the APN header of the message, so that after the message enters the network, the network can perceive the APN service and its needs based on the APN information carried in the APN header of the message, thereby providing refined network resource allocation, transmission path scheduling and service level agreement (service-level agreement, SLA) quality assurance for the APN service. Among them, the APN information includes but is not limited to APN ID and APN parameters. In the embodiment of the present application, the APN header of the message of the container carries the identifier of the application deployed in the container, so that while the network perceives the APN service and its needs, it can control the message of the container based on the identifier of the application.

[0061] Second embodiment: Message A is an IPv4 message or an IPv6 message, and Message A includes a TCP header, and the TCP header includes an identifier of Application A. Optionally, the TCP header includes an option field, and the option field includes the identifier of Application A.

[0062] For ease of description, the option field included in the TCP header is called the TCP option field. Figure 5 , which shows a schematic diagram of a TCP option field provided in an embodiment of the present application. The TCP option field includes the following subfields: category (kind), length and information (info). The category subfield is also called the type subfield, and the information subfield is also called the data subfield. The length of the category subfield and the length of the length subfield are both 1 byte, and the length of the information subfield is n bytes, where n is a positive integer. The category subfield is used to indicate the type of the TCP option field, the length subfield is used to indicate the length of the TCP option field (that is, the sum of the lengths of the category subfield, the length subfield and the information subfield), and the information subfield is used to carry specific information. In an embodiment of the present application, it can be Figure 5 The information subfield in the TCP option field shown carries the identification of application A.

[0063] In the embodiment of the present application, the first device may be a device (such as a host) where the container C1 is deployed, or a device in a network to which the device where the container C1 is deployed is connected. The following describes the implementation of the first device obtaining the message A in two embodiments according to the difference of the first device.

[0064] First embodiment: the first device is a device (such as a host) on which the container C1 is deployed, and the first device generates a message A.

[0065] Optionally, the first device obtains the identifier of the application A1 deployed in the container C1, and the first device generates the message A according to the identifier of the application A1. In one embodiment, the first device generates an IPv6 message according to the identifier of the application A1, and the IPv6 message includes the following: Figure 4 The APN header shown in FIG. 1 carries the identifier of application A in the APN ID field of the APN header. In another embodiment, the first device generates an IPv4 message according to the identifier of application A1. The IPv4 message includes a TCP header. The TCP header includes the following: Figure 5 The option field shown in FIG. 1 carries the identifier of application A. In another embodiment, the first device generates an IPv6 message according to the identifier of application A1. The IPv6 message includes a TCP header. The TCP header includes: Figure 5 The option field shown carries the identifier of application A. In an embodiment of the present application, the first device can obtain the identifier of application A1 deployed in container C1 when container C1 needs to access the service corresponding to application A1, and generate message A according to the identifier of application A1. In one example, when the first device receives an access request triggered by a user based on application A1 deployed in container C1, the first device determines that container C1 needs to access the service corresponding to application A1. In another example, when the first device receives an access request corresponding to application A1 deployed in container C1 sent by other devices, the first device determines that container C1 needs to access the service corresponding to application A1. The first device may also determine that container C1 needs to access the service corresponding to application A1 in other ways, which is not limited in the embodiment of the present application.

[0066] In an optional embodiment, the first device obtains the identifier of the application A1 deployed in the container C1 according to the identifier of the container C1 and the first correspondence, and then the first device generates the message A according to the identifier of the application A1. For example, the first device searches for the first correspondence according to the identifier of the container C1, and the first device determines the application identifier corresponding to the identifier of the container C1 in the first correspondence as the identifier of the application A1 deployed in the container C1. The first correspondence is a correspondence between the identifier of the container C1 and the identifier of the application A1 deployed in the container C1. In one example, the first correspondence is shown in Table 1 below, and the first device searches for the first correspondence according to the identifier "C1" of the container C1 to determine the identifier "A1" of the application A1 deployed in the container C1, and the first device generates the message A according to the identifier "A1" of the application A1.

[0067] Table 1

[0068] Container identification Application ID C1 A1

[0069] Optionally, the first device is a device for deploying container C1, and the first device includes a root network system (root NS), and the Root NS obtains the identifier of application A1 according to the identifier of container C1 and the first corresponding relationship, and then generates message A according to the identifier of application A1.

[0070] Optionally, before the first device generates message A, the first device obtains the first correspondence. In an embodiment of the present application, the first correspondence is generated by the control device according to the identifier of container C1 and the identifier of application A1 deployed in container C1, or it can be generated by the first device according to configuration information. In one embodiment, the first correspondence is generated by the control device according to the identifier of container C1 and the identifier of application A1 deployed in container C1. After generating the first correspondence, the control device sends the first correspondence to the first device, and the first device receives the first correspondence from the control device; for example, the Root NS in the first device receives the first correspondence from the control device and stores the first correspondence. Optionally, when container C1 is online on the first device, the control device generates the first correspondence according to the identifier of container C1 and the identifier of application A1 deployed in container C1, and sends the first correspondence to the first device, and the first device receives the first correspondence. In another embodiment, the first correspondence is generated by the first device according to configuration information, the configuration information includes an identifier of the container C1 and an identifier of the application A1 deployed in the container C1, and the first device generates the first correspondence according to the identifier of the container C1 and the identifier of the application A1 deployed in the container C1 included in the configuration information. The configuration information may be sent by the control device to the first device, or may be statically configured in the first device.

[0071] Second embodiment: the first device is a device (eg, a security device) in a network to which a device (eg, a host) on which the container C1 is deployed is connected, and the first device receives a message A sent by the device (eg, a host) on which the container C1 is deployed.

[0072] In the case where the first device is a device in the network to which the device deploying container C1 is connected, the first device is connected to the device of container C1, and after the device deploying container C1 generates message A, it sends message A to the network to which the device deploying container C1 is connected. For example, the device deploying container C1 sends message A to a server providing a service corresponding to application A1 through the network, and the first device is a device in the network, and the first device receives message A. The implementation process of the device deploying container C1 generating message A can refer to the first embodiment above, and will not be repeated here.

[0073] S302. The first device controls message A according to the identifier of application A1.

[0074] In an optional embodiment, the first device determines the control policy X1 of the message A according to the identifier of the application A1 included in the message A, and the first device forwards or discards the message A according to the control policy X1. The control policy X1 can be a correspondence between the identifier of the application A1 and the control operation, and the control operation includes forwarding or discarding. In one example, the forwarding operation is a permit operation, and the discard operation is a deny operation.

[0075] In one embodiment, the control strategy X1 is shown in Table 2 below. The control strategy X1 is a correspondence between the identifier "A1" of the application A1 and the control operation "allow". The control operation X1 is used to indicate that a message (e.g., message A) including the identifier of the application A1 is allowed. The first device forwards message A according to the control operation X1. For example, the first device forwards message A by querying a route according to the destination address of message A. For example, the first device determines an egress port of message A by querying a route according to the destination address of message A, and the first device forwards message A through the egress port.

[0076] Table 2

[0077] Application ID Control operations A1 permit

[0078] In another embodiment, the control strategy X1 is shown in Table 3 below, where the control strategy X1 is the correspondence between the identifier "A1" of application A1 and the control operation "reject", and the control operation X1 is used to indicate the rejection of a message (for example, message A) including the identifier of application A1, and the first device discards message A according to the control operation X1.

[0079] Table 3

[0080] Application ID Control operations A1 deny

[0081] In an embodiment of the present application, the control policy X1 is pre-configured in the first device. In one embodiment, the first device is a device in which the container C1 is deployed, and the control policy X1 is configured by the control device in the first device, and the first device obtains the configured control policy X1. In another embodiment, the first device is a device in a network to which the device in which the container C1 is deployed is connected, and the control policy X1 is configured by the controller of the network in the first device, and the first device obtains the control policy X1 configured by the controller. Optionally, the control policy X1 can also be statically configured by the user in the first device, and the first device obtains the control policy X1 configured by the user, which is not limited in the embodiment of the present application.

[0082] In summary, the technical solution provided by the embodiment of the present application is that the message of the container includes the identifier of the application deployed in the container, and the first device controls the message of the container according to the identifier of the application included in the message of the container. Since the identifier of the application deployed in the container will not change dynamically due to the online, offline, migration, etc. of the container, the control of the message of the container is relatively easy. For example, the first device is a device in the network to which the device deploying the container is connected. The embodiment of the present application controls the message of the container according to the identifier of the application included in the message of the container, so that the device in the network to which the device deploying the container is connected does not perceive the dynamic changes of the online, offline, migration, etc. of the container.

[0083] The above is an introduction to the method embodiment of the present application. The following is an introduction to the device embodiment of the present application. The device of the present application can be used to execute the method of the present application. For details not disclosed in the device embodiment of the present application, please refer to the method embodiment.

[0084] Please refer to Figure 6 , which shows a schematic diagram of a message control device 600 provided in an embodiment of the present application. The message control device 600 is applied to Figure 3 The first device in the illustrated embodiment, for example, the message control device 600 is a first device or a functional component in the first device. The first device may be Figure 1 The host 310 or security device 120 in the packet control device 600 is used to execute Figure 3 The message control method provided in the embodiment shown. Figure 6 As shown, the message control device 600 includes an acquisition module 610 and a control module 620 .

[0085] The acquisition module 610 is used to acquire a message, where the message includes an identifier of an application deployed in the container.

[0086] The control module 620 is used to control the message according to the identification of the application.

[0087] For the functional implementation of the acquisition module 610, please refer to the description in S301. For the functional implementation of the control module 620, please refer to the description in S302.

[0088] Optionally, the message is an IPv6 message, the message includes an APN header, and the APN header includes an identifier of the application; or the message is an IPv4 message or an IPv6 message, the message includes a TCP header, and the TCP header includes the identifier of the application.

[0089] Optionally, the control module 620 is used to: determine a control policy for the message according to the identifier of the application; and forward or discard the message according to the control policy.

[0090] Optionally, the first device is a device on which the container is deployed, and the acquisition module 610 is configured to: acquire an identifier of the application; and generate the message according to the identifier of the application.

[0091] Optionally, the acquisition module 610 is used to: acquire a correspondence between the identifier of the container and the identifier of the application; and acquire the identifier of the application according to the identifier of the container and the correspondence.

[0092] Optionally, the acquisition module 610 is used to receive the corresponding relationship from the control device, where the corresponding relationship is generated by the control device according to the identifier of the container and the identifier of the application.

[0093] Optionally, the acquisition module 610 is configured to generate the corresponding relationship according to configuration information. The configuration information may be information statically configured in the first device, or information sent by the control device to the first device.

[0094] Optionally, the first device is a device in a network to which the device deploying the container is connected, and the acquisition module 610 is configured to receive the message sent by the device deploying the container, wherein the message is a message generated by the device deploying the container.

[0095] To sum up, in the technical solution provided by the embodiment of the present application, the message of the container includes the identifier of the application deployed in the container, and the first device manages and controls the message of the container according to the identifier of the application included in the message of the container. Since the identifier of the application deployed in the container will not change dynamically due to the online, offline, migration, etc. of the container, the control of the message of the container is relatively easy.

[0096] It should be understood that the message control device provided in the embodiment of the present application can also be implemented with an application-specific integrated circuit (ASIC) or a programmable logic device (PLD), and the above-mentioned PLD can be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof. The message control method provided in the above-mentioned method embodiment can also be implemented by software. When the message control method provided in the above-mentioned method embodiment is implemented by software, each module in the message control device can also be a software module.

[0097] An embodiment of the present application provides a message control device, which includes a memory and a processor; the memory is used to store computer programs; the processor is used to execute the computer programs stored in the memory so that the message control device performs all or part of the steps of the message control method provided in the above method embodiment.

[0098] As an example, see Figure 7 , which shows a schematic diagram of another message control device 700 provided in an embodiment of the present application. The message control device 700 is applied to Figure 3 The first device in the illustrated embodiment, for example, the message control device 700 is a first device or a partial component in the first device. The first device may be Figure 1 The host 310 or security device 120 in FIG. Figure 7 As shown, the message control device 700 includes a main control board 710, an interface board 730 and an interface board 740. In the case of multiple interface boards, a switching network board ( Figure 7 The switching network board is used to complete data exchange between the interface boards (the interface board is also called a line card or a service board).

[0099] The main control board 710 is used to complete functions such as system management, equipment maintenance, and protocol processing. The interface board 730 and the interface board 740 are used to provide various business interfaces (for example, POS interface, GE interface, ATM interface, etc.) and realize message forwarding. There are mainly three types of functional units on the main control board 710: system management control unit, system clock unit, and system maintenance unit. The main control board 710, the interface board 730, and the interface board 740 are connected to the system backplane through the system bus to achieve intercommunication. The interface board 730 includes one or more processors 731. The processor 731 is used to control and manage the interface board 730 and communicate with the central processing unit 712 on the main control board 710. The memory 732 on the interface board 730 is used to store the correspondence between the container identifier and the application identifier described in the above embodiment. As Figure 7 As shown, the main control board 710 may include a memory 714. The memory 714 on the main control board 710 may also be used to store the corresponding relationship between the identifier of the container and the identifier of the application described in the above embodiment, and the embodiment of the present application does not limit this. The interface board 730 includes one or more network interfaces 733 for receiving and sending messages, and the processor 731 may process the messages received by the network interface 733. The specific implementation process will not be repeated here one by one.

[0100] It is understandable that Figure 7 As shown, this embodiment includes multiple interface boards and adopts a distributed forwarding mechanism. Under this mechanism, the operation on the interface board 740 is basically similar to the operation on the interface board 730, and for the sake of brevity, it will not be repeated. In addition, it can be understood that Figure 7 The processor 731 in the interface board 730 and / or the processor 741 in the interface board 740 may be dedicated hardware or chips, such as a network processor or a dedicated integrated circuit, to implement the above functions. This implementation is what is commonly referred to as a forwarding plane using dedicated hardware or chip processing. In another embodiment, the processor 731 in the interface board 730 and / or the processor 741 in the interface board 740 may also be a general-purpose processor, such as a general-purpose central processing unit (CPU) to implement the above-described functions.

[0101] In addition, it should be pointed out that there may be one or more main control boards, and when there are multiple boards, they may include a main main control board and a standby main control board. There may be one or more interface boards. The stronger the data processing capability of the device, the more interface boards are provided. In the case of multiple interface boards, the multiple interface boards can communicate with each other through one or more switching network boards, and when there are multiple boards, they can jointly realize load sharing and redundant backup. In a centralized forwarding architecture, the device may not need a switching network board, and the interface board is responsible for the processing function of the service data of the entire system. In a distributed forwarding architecture, the device includes multiple interface boards, and data exchange between multiple interface boards can be realized through the switching network board, providing large-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of the device with a distributed architecture are greater than those of the nodes with a centralized architecture. Which architecture to adopt depends on the networking deployment scenario, and no limitation is made here.

[0102] In an optional embodiment, the memory 732 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), a disk or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 732 may be independent and connected to the processor 731 via a communication bus. The memory 732 may also be integrated with the processor 731. The memory 732 is used to store program code and is controlled and executed by the processor 731 to execute some or all steps of the message control method provided in the above embodiment. The processor 731 is used to execute the program code stored in the memory 732. The program code may include one or more software modules. The one or more software modules may be the above-mentioned Figure 6 Functional modules provided in the illustrated embodiment. The memory 714 may also be used to store program codes, and the central processor 712 controls execution to execute part or all of the steps of the message control method provided in the above embodiment.

[0103] In an optional embodiment, the network interface 733 uses a device such as a transceiver for communicating with other devices or networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0104] As another example, see Figure 8 , which shows a schematic diagram of another message control device 800 provided in an embodiment of the present application. The message control device 800 is applied to Figure 3 The first device in the illustrated embodiment, for example, the message control device 800 is a first device or a partial component in the first device. The first device may be Figure 1 The host 310 or security device 120 in the packet control device 800 is used to execute Figure 3 The message control method provided in the embodiment shown. Figure 8, the message control device 800 includes a processor 802, a memory 804, a communication interface 806 and a bus 808, and the processor 802, the memory 804 and the communication interface 806 are communicatively connected via the bus 808. The processor 802, the memory 804 and the communication interface 806 may also be connected in a connection manner other than the bus 808, and the embodiment of the present application does not limit the connection manner of the processor 802, the memory 804 and the communication interface 806.

[0105] The memory 804 is used to store the computer program 8042. The memory 804 is various types of storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), programmable ROM (PROM), erasable PROM (EPROM), electrically erasable PROM (EEPROM), flash memory, optical storage, and registers.

[0106] The processor 802 may be a general-purpose processor, which is a processor that performs specific steps and / or operations by reading and executing a computer program stored in a memory (e.g., memory 804). The general-purpose processor may use a computer program stored in a memory (e.g., memory 804) in the process of performing the above steps and / or operations. The stored computer program is, for example, executed to implement the related functions of the aforementioned acquisition module 610 and the control module 620. The general-purpose processor may be a CPU. The processor 802 may also be a dedicated processor, which is a processor specially designed to perform specific steps and / or operations. The dedicated processor may be an ASIC, FPGA, network processor (NP), etc. The processor 802 may also be a combination of multiple processors, such as a multi-core processor. The processor 802 includes at least one circuit to perform all or part of the steps of the message control method provided in the above embodiment.

[0107] The communication interface 806 includes an input / output (I / O) interface, a physical interface, and a logical interface, etc., which are used to interconnect the devices inside the message control device 800, and an interface for interconnecting the message control device 800 with other devices (such as network equipment, host, server, etc.). The physical interface can be a gigabit Ethernet interface (GE), which is used to interconnect the message control device 800 with other devices, and the logical interface is an interface inside the message control device 800, which is used to interconnect the devices inside the message control device 800. It is easy to understand that the communication interface 806 is used for the message control device 800 to communicate with other devices, for example, the communication interface 806 is used for sending and receiving information, messages, etc. between the message control device 800 and other devices.

[0108] The bus 808 is any type of communication bus for interconnecting the processor 802 , the memory 804 , and the communication interface 806 , such as a system bus.

[0109] The above devices may be arranged on independent chips, or at least partially or completely on the same chip. Whether to arrange each device independently on different chips or to integrate them on one or more chips often depends on the needs of product design. The embodiments of the present application do not limit the specific implementation form of the above devices.

[0110] Figure 8 The message control device 800 shown is merely exemplary. During implementation, the message control device 800 may also include other components, which are not listed one by one in this article. Figure 8 The message control device 800 shown performs operations related to message control by executing all or part of the steps of the message control method provided by the above method embodiment.

[0111] The embodiment of the present application provides a message control system, including a device for deploying a container and a device (such as a security device) in a network to which the device for deploying the container is connected. Any of the devices in the network to which the device for deploying the container is connected includes Figures 6 to 8 Any of the message control devices shown. Alternatively, the device deploying the container is as follows Figure 2 As shown in the example, the message control system is as follows Figure 1 The communication system shown.

[0112] An embodiment of the present application provides a computer-readable storage medium, which stores a computer program. When the computer program is executed (for example, by a device on which a container is deployed, a device in a network to which the device deploying the container is connected, a message control device, a processor, etc.), all or part of the steps of the message control method provided in the above method embodiment are implemented.

[0113] An embodiment of the present application provides a computer program product, which includes a program or code. When the program or code is executed (for example, by a device on which a container is deployed, a device in a network to which the device deploying the container is connected, a message control device, a processor, etc.), all or part of the steps of the message control method provided in the above method embodiment are implemented.

[0114] An embodiment of the present application provides a chip, which includes a programmable logic circuit and / or program instructions, and when the chip is running, it is used to implement all or part of the steps of the message control method provided in the above method embodiment.

[0115] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product, and the computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server, a data center, etc. that contains one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium, or a semiconductor medium (e.g., a solid-state hard disk), etc.

[0116] The term "at least one" in this application refers to one or more, and "plurality" refers to two or more. In this application, unless otherwise specified, the symbol " / " generally means or, for example, A / B can mean A or B. The term "and / or" in this application is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, for the convenience of clear description, in this application, the words "first", "second", "third" and the like are used to distinguish between identical or similar items with substantially the same functions and effects. Those skilled in the art can understand that the words "first", "second", "third" and the like do not limit the quantity and execution order.

[0117] The different types of embodiments such as the method embodiments and device embodiments provided in the embodiments of the present application can refer to each other, and the embodiments of the present application are not limited thereto. The sequence of operations of the method embodiments provided in the embodiments of the present application can be appropriately adjusted, and the operations can also be increased or decreased in response to the situation. Any technician familiar with the technical field can easily think of the changed methods within the technical scope disclosed in the present application, and they should be included in the protection scope of the present application, so they will not be repeated.

[0118] In the embodiments of the present application, it should be understood that the disclosed devices and the like can be implemented by other configuration methods. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, for example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0119] The modules described as separate components may or may not be physically separated, and the components described as modules may or may not be physical modules, and may be located in one place or distributed on multiple network nodes. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0120] The above is only an exemplary embodiment of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A message control method, characterized in that: The method comprises: The first device obtains a message, where the message includes an identifier of an application deployed in the container; The first device controls the message according to the identifier of the application.

2. The method according to claim 1, characterized in that The message is an Internet Protocol version 6 IPv6 message, the message includes an application-aware network APN header, and the APN header includes an identifier of the application; or The message is an Internet Protocol version 4 IPv4 message or an IPv6 message, and the message includes a Transmission Control Protocol TCP header, and the TCP header includes an identifier of the application.

3. The method according to claim 1 or 2, characterized in that: The first device controlling the message according to the identifier of the application includes: The first device determines a control policy for the message according to the identifier of the application; The first device forwards or discards the message according to the management and control policy.

4. The method according to any one of claims 1 to 3, characterized in that: The first device is a device for deploying the container, and the first device obtaining the message includes: The first device obtains an identification of the application; The first device generates the message according to the identifier of the application.

5. The method according to claim 4, characterized in that The first device obtaining the identifier of the application includes: The first device obtains a correspondence between an identifier of the container and an identifier of the application; The first device obtains the identifier of the application according to the identifier of the container and the corresponding relationship.

6. The method according to claim 5, characterized in that The first device acquiring the correspondence between the identifier of the container and the identifier of the application includes: The first device receives the corresponding relationship from a control device, where the corresponding relationship is generated by the control device according to the identifier of the container and the identifier of the application.

7. The method according to any one of claims 1 to 3, characterized in that: The first device is a device in a network to which a device deploying the container is connected, and the first device acquiring the message includes: The first device receives the message sent by the device where the container is deployed.

8. A message control device, characterized in that: Applied to a first device, the apparatus comprises: An acquisition module, used to acquire a message, wherein the message includes an identifier of an application deployed in the container; A control module is used to control the message according to the identification of the application.

9. The device according to claim 8, characterized in that The message is an Internet Protocol version 6 IPv6 message, the message includes an application-aware network APN header, and the APN header includes an identifier of the application; or The message is an Internet Protocol version 4 IPv4 message or an IPv6 message, and the message includes a Transmission Control Protocol TCP header, and the TCP header includes an identifier of the application.

10. The device according to claim 8 or 9, characterized in that The control module is used to: Determining a control strategy for the message according to the identifier of the application; The message is forwarded or discarded according to the control policy.

11. The device according to any one of claims 8 to 10, characterized in that The first device is a device for deploying the container, and the acquisition module is used to: Obtaining an identification of the application; The message is generated according to the identifier of the application.

12. The device according to claim 11, characterized in that The acquisition module is used to: Obtaining a correspondence between the identifier of the container and the identifier of the application; The identification of the application is obtained according to the identification of the container and the corresponding relationship.

13. The device according to claim 12, characterized in that The acquisition module is used to receive the corresponding relationship from a control device, where the corresponding relationship is generated by the control device according to the identifier of the container and the identifier of the application.

14. The device according to any one of claims 8 to 10, characterized in that The first device is a device in a network to which the device deploying the container is connected, and the acquisition module is used to receive the message sent by the device deploying the container.

15. A message control device, characterized in that: including memory and processor; The memory is used to store computer programs; The processor is used to execute the computer program stored in the memory so that the message control device executes the method according to any one of claims 1 to 7.

16. A message control system, characterized in that: The message control system includes: a device for deploying a container and a device in a network to which the device for deploying the container is connected, and any one of the devices for deploying the container and the devices in the network to which the device for deploying the container is connected includes the apparatus as described in any one of claims 8 to 15.

17. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 is implemented.

18. A computer program product, characterized in that The computer program product comprises a program or a code, and when the program or the code is executed, the method according to any one of claims 1 to 7 is implemented.

Images