Data packet processing system, method and device

Abstract

The embodiments of the present specification provide a data packet processing system, method and device, wherein the data packet processing system includes a programmable logic module, a private cloud service gateway and a replication module, the programmable logic module receives an original data packet associated with a cloud computing service, and sends original description information corresponding to the original data packet to the private cloud service gateway; the private cloud service gateway updates the original description information to target description information according to a preset data detection strategy, and feeds back the target description information to the programmable logic module; the programmable logic module sends the original data packet and the target description information to the replication module; the replication module determines that the original data packet meets the detection conditions by detecting the target description information, and then constructs a mirror data packet corresponding to the original data packet, configures detection information for the mirror data packet, and submits the mirror data packet to the virtual server according to the detection information for detection of the mirror data packet.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of cloud computing technology, and more particularly to a data packet processing system, method, and device. Background Art

[0002] With the development of computer and Internet technology, cloud computing services are applied in more and more scenarios. In order to enable cloud computing services to provide stable cloud computing services to users, the service provider providing cloud computing services can use the traffic mirroring function to copy the normally processed data packets, so as to test the services with actual generated traffic without affecting the actual production environment, so as to find problems in advance, optimize cloud computing services and ensure the stability of services. In the prior art, the traffic mirroring function is mainly realized through splitting point selection, dual-path splitting and master-slave mode. Through splitting point selection, all data packets entering and leaving the service gateway can be mirrored and collected, and then the main optical path can be used to transmit data packets, and the bypass optical path can form a master-slave link to improve the high availability of the service. However, the implementation method requires setting the master-slave link mutual backup mode, which makes the resource utilization rate only half, and the construction cost is high; at the same time, when the public network traffic suddenly increases, the splitting device as a physical device cannot achieve rapid expansion, which leads to the intrusion detection being unable to handle the lost part of the traffic, and finally leads to the lack of traffic billing and the omission of security detection. Therefore, an effective solution is urgently needed to solve the above problems. Summary of the invention

[0003] In view of this, an embodiment of the present specification provides a data packet processing system. One or more embodiments of the present specification also relate to a data packet processing method, a data packet processing apparatus, a computing device, a computer-readable storage medium and a computer program product to solve the technical defects existing in the prior art.

[0004] According to a first aspect of an embodiment of this specification, a data packet processing system is provided, including a programmable logic module, a private cloud service gateway and a replication module, including:

[0005] The programmable logic module is used to receive an original data packet associated with a cloud computing service, and send original description information corresponding to the original data packet to the private cloud service gateway;

[0006] The private cloud service gateway is used to update the original description information into target description information according to a preset data detection strategy, and feed back the target description information to the programmable logic module;

[0007] The programmable logic module is used to send the original data packet and the target description information to the replication module;

[0008] The replication module is used to construct a mirror data packet corresponding to the original data packet when determining that the original data packet meets the detection conditions by detecting the target description information, configure detection information for the mirror data packet, and submit the mirror data packet to the virtual server according to the detection information for detecting the mirror data packet.

[0009] According to a second aspect of an embodiment of this specification, a method for processing a data packet is provided, including:

[0010] Determine an original data packet associated with a cloud computing service through a programmable logic module, and send original description information corresponding to the original data packet to a private cloud service gateway;

[0011] The original description information is updated using the data detection strategy preset by the private cloud service gateway to obtain the target description information;

[0012] The target description information is detected by a replication module, and when it is determined according to the detection result that the original data packet meets the detection condition, a mirror data packet corresponding to the original data packet is constructed;

[0013] Detection information is configured for the mirrored data packet, and the mirrored data packet is detected according to the detection information.

[0014] According to a third aspect of an embodiment of this specification, a data packet processing device is provided, including:

[0015] a determination unit configured to determine an original data packet associated with a cloud computing service through a programmable logic module, and send original description information corresponding to the original data packet to a private cloud service gateway;

[0016] An updating unit, configured to update the original description information using a data detection strategy preset by the private cloud service gateway to obtain target description information;

[0017] A construction unit is configured to detect the target description information through a replication module, and if it is determined according to the detection result that the original data packet meets the detection condition, construct a mirror data packet corresponding to the original data packet;

[0018] The detection unit is configured to configure detection information for the mirrored data packet and detect the mirrored data packet according to the detection information.

[0019] According to a fourth aspect of an embodiment of this specification, a computing device is provided, including:

[0020] Memory and processor;

[0021] The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the steps of the above-mentioned data packet processing method are implemented.

[0022] According to a fifth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned data packet processing method are implemented.

[0023] According to a sixth aspect of the embodiments of this specification, a computer program product is provided, including a computer program or instructions, which implement the steps of the above-mentioned data packet processing method when executed by a processor.

[0024] The data packet processing system provided in this embodiment can improve resource utilization while reducing costs, and can achieve the ability to quickly expand and contract to cope with the sudden increase in public network traffic and thus solve the problems of under-billing and security attack omissions. The data packet processing system can be composed of a programmable logic module, a private cloud service gateway and a replication module. For the original data packet associated with the cloud computing service, the programmable logic module can determine the original description information corresponding to the original data packet. After sending it to the private cloud service gateway, the private cloud service gateway can update the original description information to the target description information according to the preset data detection strategy, and feed back the target description information to the programmable logic module; at this time, the original data packet and the target description information are sent to the replication module through the programmable logic module; the target description information is carried only for the original data packet that needs to be mirrored, thereby achieving on-demand splitting, avoiding the problem of processing all data packets, and reducing the transmission of invalid traffic. After the replication module receives the original data packet and target description information, if it is determined by detecting the target description information that the original data packet meets the detection conditions, the replication module can then independently construct a mirror data packet corresponding to the original data packet, and configure detection information for the mirror data packet. On this basis, the mirror data packet is submitted to the virtual server according to the detection information for detection of the mirror data packet. The detection of the mirror data packet can be completed on the virtual server, thereby achieving the purpose of elastic expansion and contraction of the traffic mirroring function, which is not affected by objective factors of the physical device, thereby solving the bottleneck of insufficient performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 is a schematic diagram of a data packet processing system provided by an embodiment of the present specification;

[0026] Figure 2 It is a structural diagram of a data packet processing system provided by an embodiment of this specification;

[0027] Figure 3It is a schematic diagram of traffic mirroring processing in a data packet processing system provided by an embodiment of the present specification;

[0028] Figure 4 is a flow chart of a processing process of a data packet processing system provided by an embodiment of the present specification;

[0029] Figure 5 is a flow chart of a data packet processing method provided by an embodiment of this specification;

[0030] Figure 6 It is a structural schematic diagram of a data packet processing device provided by an embodiment of this specification;

[0031] Figure 7 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0032] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0033] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0034] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0035] In addition, it should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0036] First, the terms involved in one or more embodiments of this specification are explained.

[0037] FPGA (Field-Programmable Gate Array): Programmable logic module. FPGA is a product further developed on the basis of programmable devices such as programmable array logic and general array logic. It is a semi-custom circuit in the field of application-specific integrated circuits (ASICs).

[0038] Meta (metadata): Metadata refers to the metadata in the message. It is used to record relevant internal data information for message forwarding.

[0039] NIS (Network Intelligence Service): Network Intelligence Service is a cloud service that performs network health analysis, performance monitoring, diagnosis and repair, traffic analysis, and measurement simulation.

[0040] DDoS (Distributed Denial of Service): A distributed denial of service attack refers to the use of client / server technology to combine multiple computers as an attack platform to launch attacks on one or more targets, thereby multiplying the power of the denial of service attack.

[0041] Vxlan (Virtual Extensible LAN): Virtual Extensible LAN is a technology used to extend LAN segments in virtual networks. It uses Vxlan headers to encapsulate data packets in UDP packets to achieve virtual network interconnection between different physical networks. VNI (Virtual Network Identifier): In Vxlan, VNI is a unique identifier used to identify different virtual networks (or Vxlan networks) to achieve isolation and differentiation between different virtual networks.

[0042] XGW: In VPC (Virtual Private Cloud), XGW is the gateway device of VPC, which consists of a server cluster.

[0043] In this specification, a data packet processing system is provided. This specification also relates to a data packet processing method, a data packet processing apparatus, a computing device, a computer-readable storage medium and a computer program product, which are described in detail one by one in the following embodiments.

[0044] In practical applications, such as Figure 3 As shown in the schematic diagram, the working mode of mirrored traffic is as follows: Splitting point selection, select the interconnected optical fiber link between Switch and Core switch as the splitting point, so that all data packets entering and leaving the gateway can be mirrored. Dual-path splitting, set service-related splitting equipment at the splitting point, and split the original light carrying service data into three paths according to the ratio of 3:3:4. Among them, the main path light of 4 / 10 continues to transmit service data, and the other two 3 / 10 paths are used as bypass lights. In the active-standby mode, the 3 / 10 bypass lights are connected to TAP-SW1 (splitting device 1) and TAP-SW2 (splitting device 2). TAP-SW1 is the main link, and TAP-SW2 is the backup link. The two split links adopt the active-standby mode, and only one path works at the same time. Usually, the main link works, and the backup link is cold standby. When the main link is abnormal, it quickly switches to the backup link to work, and the main link stops working, thereby greatly improving the high availability of the service. However, this type of public cloud deployment will have a primary-backup link mutual backup mode, which will result in lower utilization and higher construction costs. There will also be risks such as billing omissions and attack omissions. Therefore, an effective solution is needed to solve the above problems.

[0045] See also Figure 1As shown in the schematic diagram, the data packet processing system provided by the present embodiment can improve resource utilization while reducing costs, and can achieve the ability of rapid expansion and contraction to cope with the sudden increase in public network traffic and thus solve the problems of under-billing and security attack omissions. The data packet processing system can be composed of a programmable logic module, a private cloud service gateway and a replication module. For the original data packet associated with the cloud computing service, the programmable logic module can determine the original description information corresponding to the original data packet. After sending it to the private cloud service gateway, the private cloud service gateway can update the original description information to the target description information according to the preset data detection strategy, and feed back the target description information to the programmable logic module; at this time, the original data packet and the target description information are sent to the replication module through the programmable logic module; the target description information is carried only for the original data packet that needs to be mirrored, thereby achieving on-demand splitting, avoiding the problem of processing all data packets, and reducing the transmission of invalid traffic. After the replication module receives the original data packet and target description information, if it is determined by detecting the target description information that the original data packet meets the detection conditions, the replication module can then independently construct a mirror data packet corresponding to the original data packet, and configure detection information for the mirror data packet. On this basis, the mirror data packet is submitted to the virtual server according to the detection information for detection of the mirror data packet. The detection of the mirror data packet can be completed on the virtual server, thereby achieving the purpose of elastic expansion and contraction of the traffic mirroring function, which is not affected by objective factors of the physical device, thereby solving the bottleneck of insufficient performance.

[0046] See also Figure 2 , Figure 2 A schematic diagram of the structure of a data packet processing system provided according to an embodiment of the present specification is shown. The data packet processing system 200 includes a programmable logic module 210, a private cloud service gateway 220 and a replication module 230, and is specifically implemented as follows:

[0047] The programmable logic module 210 is used to receive an original data packet associated with a cloud computing service, and send original description information corresponding to the original data packet to the private cloud service gateway;

[0048] The private cloud service gateway 220 is used to update the original description information into target description information according to a preset data detection strategy, and feed back the target description information to the programmable logic module;

[0049] The programmable logic module 210 is used to send the original data packet and the target description information to the replication module;

[0050] The replication module 230 is used to construct a mirror data packet corresponding to the original data packet when determining that the original data packet meets the detection conditions by detecting the target description information, configure detection information for the mirror data packet, and submit the mirror data packet to the virtual server according to the detection information for detecting the mirror data packet.

[0051] The data packet processing system provided in this embodiment is used to solve the problems of inability to elastically expand physical equipment, low traffic billing, and security attack omissions when implementing the traffic mirroring function by combining software and hardware. The data packets processed by the data packet processing system provided in this embodiment are data packets generated by using cloud computing services and need to be transmitted. The service type described in the data packet can be set according to actual needs, and this embodiment does not make any restrictions here.

[0052] Specifically, the programmable logic module specifically refers to FPGA hardware, and accordingly, the private cloud service gateway specifically refers to the gateway of the private cloud network corresponding to the user associated with the original data packet, which is used to process the public network traffic in and out of the private cloud network. Correspondingly, the replication module specifically refers to a virtual module for implementing the mirroring function, which can be configured in the data packet processing system or in the programmable logic module, and is used to implement mirror replication of the original data packet, so that by detecting the mirrored data packet, the original data packet can be detected, such as for traffic billing, distributed denial of service attacks, network health detection, etc.

[0053] Accordingly, cloud computing service specifically refers to a service that provides cloud network resources to tenants, which is used to enable tenants to deploy applications or services on the cloud to provide corresponding service functions to users. The cloud network resources used include but are not limited to virtual machines, databases, computing resources, etc., which are not limited in this embodiment. Accordingly, the original data packet specifically refers to the data packet that needs to be transmitted for the currently triggered service function. Accordingly, the original description information specifically refers to the data descriptor corresponding to the original data packet, which is used to record information related to the original data packet, including but not limited to the public network address corresponding to the original data packet, relevant information on whether mirroring is required, and relevant information on the data packet content.

[0054] Accordingly, the data detection strategy specifically refers to a strategy for detecting and updating the original description information corresponding to the original data packet. Through this strategy, the relevant information about the original data packet recorded in the original description information can be determined, and the information triggering the mirror traffic function in the original description information can be updated according to the mirror traffic function, such as updating the mirror flag bit, updating the network device index information, etc., to achieve the update result to obtain the target description information. Accordingly, the target description information is the description information obtained after the original information is updated according to the mirror traffic function. After sending this information and the data packet to the replication module, the mirror traffic function can be triggered to complete the detection operations such as traffic billing of the original data packet.

[0055] Accordingly, the detection condition specifically refers to the conditions for determining whether the original data packet needs to be mirrored after detecting the target description information and detecting the data packet. Accordingly, the mirrored data packet specifically refers to the data packet obtained after mirroring the original data packet. Accordingly, the detection information specifically refers to the information for selecting a virtual server for the mirrored data packet to complete the data packet detection through virtual resources, so as to realize the elastic expansion of virtual resources to achieve the mirrored traffic function without relying on physical devices, so that the traffic mirroring has the ability of cross-address disaster recovery.

[0056] Based on this, in order to improve resource utilization while reducing costs, and to achieve the ability to quickly expand and shrink in order to cope with sudden increases in public network traffic and thereby solve the problems of under-billing and missed security attacks, a data packet processing system can be composed of a programmable logic module, a private cloud service gateway, and a replication module. For the original data packet associated with the cloud computing service, the programmable logic module can determine the original description information corresponding to the original data packet. After sending it to the private cloud service gateway, the private cloud service gateway can update the original description information to the target description information according to a preset data detection strategy, and feed the target description information back to the programmable logic module.

[0057] Furthermore, the original data packet and target description information are sent to the replication module through the programmable logic module, so that only the original data packet that needs to be processed by traffic mirroring carries the target description information, thereby achieving on-demand splitting, avoiding the problem of processing all data packets, and reducing the transmission of invalid traffic.

[0058] Furthermore, after the replication module receives the original data packet and target description information, if it is determined by detecting the target description information that the original data packet meets the detection conditions, the replication module can then independently construct a mirror data packet corresponding to the original data packet, and configure detection information for the mirror data packet. On this basis, the mirror data packet is submitted to the virtual server in accordance with the detection information for detection of the mirror data packet. The detection of the mirror data packet can be completed on the virtual server, thereby achieving the purpose of elastic expansion and contraction of the traffic mirroring function, which is not affected by objective factors of the physical device, thereby solving the bottleneck of insufficient performance.

[0059] For example, after receiving the original data packet related to the cloud computing service, the FPGA device can determine the data descriptor corresponding to the original data packet, and then send the data descriptor to the private cloud network service gateway XGW corresponding to the user associated with the original data packet; after receiving the data descriptor corresponding to the original data packet, XGW determines that the original data packet meets the service billing and NIS service requirements, so the original data packet needs to be mirrored for subsequent processing. On this basis, XGW can update the data descriptor to record the relevant information that triggers the traffic mirroring of the original data packet in the updated data descriptor, and then the updated data descriptor can be fed back to the FPGA device.

[0060] Furthermore, after receiving the updated data descriptor, the FPGA device can send the updated data descriptor and the original data packet to the traffic mirroring module. The traffic mirroring module detects the updated data descriptor and determines that the original data packet needs to be mirrored. Therefore, the original data packet is first copied to obtain a mirrored data packet, and then the detection information is configured for the mirrored data packet to trigger the traffic mirroring function. At this time, the mirrored data packet can be sent to ECS1 according to the detection information, and service logic such as traffic billing, NIS, and DDOS detection can be performed on the mirrored data packet on ECS1. The original data packet can be submitted to the remote end for normal processing according to the service processing requirements.

[0061] In summary, the data packet processing system provided in this embodiment can mark the data packets that need to be mirrored according to the service characteristics through a combination of software and hardware, and pass the description information of the data packets to the hardware along the way, so as to efficiently complete the mirroring of the data packets through the hardware. At the same time, when the mirroring traffic function is implemented, based on the scalable transmission method of the virtual server, the physical limitations of the equipment are broken through, and the rapid expansion of public network billing, network detection and other processing is realized, so that cloud computing services can provide more stable and reliable services.

[0062] Furthermore, in order to achieve the purpose of combining software and hardware to break through the limitation of physical devices and expand rapidly, it is necessary to configure the mirror information for the programmable logic module. In this embodiment, the programmable logic module is also used to receive the mirror configuration information sent by the management module of the cloud computing service, determine the network device index information, virtual extensible local area network information, network address information and physical machine information according to the mirror configuration information, cache the network device index information, the virtual extensible local area network information, the network address information and the physical machine information, and perform the data packet detection task corresponding to the original data packet.

[0063] Specifically, the management module refers to a module that has management and configuration authority for the traffic mirroring function, which is under the responsibility of the service provider corresponding to the cloud computing service. Correspondingly, the mirroring configuration information refers to the information issued to the programmable logic module for realizing the traffic mirroring function, which includes network device index information, virtual extensible LAN information, network address information, and physical machine information. Among them, the network device index information is used to record the index value of the Bond-ENI used for traffic mirroring, the virtual extensible LAN information is used to record the identifier of the network in the VXLAN, the network address information is used to record the IP address of the physical network, and the physical machine information is used to record the physical machine address to which the virtual server belongs.

[0064] Based on this, in order to enable the programmable logic module, private cloud service gateway and replication module in the data packet processing system to realize the scalable traffic mirroring function, it is necessary to configure the mirroring information for the programmable logic module before data packet processing; in this process, the programmable logic module can first receive the mirroring configuration information issued by the management module of the cloud computing service, and at this time, the network device index information, virtual extensible LAN information, network address information and physical machine information can be parsed from the mirroring configuration information, and then the network device index information, virtual extensible LAN information, network address information and physical machine information can be cached, so that the data packet detection task corresponding to the original data packet can be executed later.

[0065] In actual applications, when sending the mirror configuration information to the programmable logic module, it can be done in a pre-configured manner, that is, the mirror configuration information is sent to the programmable logic module in advance. In addition, it can also be sent at other stages, such as after the software completes the detection information configuration, the information is carried in the metadata information of the data packet, and then carried to the replication module for subsequent processing operations.

[0066] Using the above example, during the FPGA device configuration phase, the cloud computing service can use the API provided by the network card driver to send the mirror configuration information Mirror to the FPGA's traffic mirror module. The mirror configuration information Mirror contains the following information: Bond-ENI-index: 1; sys-VNI: 2048; IP_addr: 192.168.100.1; member: [{nc-ip: 10.10.1.1}, {nc-ip: 10.10.1.2}, {nc-ip: 10.10.1.3}, {nc-ip: 10.10.1.4}]. Among them, Bond-ENI-index:1 indicates that the index of the Bond-ENI used for traffic mirroring is 1, the VXLAN network id used is 2048, and the overlay IP address where it is located is 192.168.100.1. This Bond-ENI contains four members, and the physical machines where each member is located are 10.10.1.1, 10.10.1.2, 10.10.1.3, and 10.10.1.4. After that, if a data packet that needs to be mirrored is received, the traffic mirroring function can be implemented according to the configuration information.

[0067] In summary, by configuring the mirror configuration information for the programmable logic module, the programmable logic module can be provided with a traffic mirroring function, so as to facilitate subsequent processing and use.

[0068] Furthermore, considering that the programmable logic module is an FPGA device, in order to enable it to cooperate with the private cloud service gateway and the replication module to realize the mirrored traffic function, it needs to combine the network card device and the network card driver to determine and send the data packet and description information. In this embodiment, the programmable logic module is also used to receive the original data packet associated with the cloud computing service through the network card device, store the original data packet in the server memory using the memory access strategy, and determine the original description information corresponding to the original data packet using the network card driver corresponding to the network card device, and send the original description information to the private cloud service gateway.

[0069] Specifically, the network card device specifically refers to the network card on the programmable logic module, which is used to receive data packets sent from the external network. Correspondingly, the network card driver specifically refers to the software driver corresponding to the network card device, which is used to process the associated network card device, such as determining the description information corresponding to the data packet, and forwarding the description information. Correspondingly, the server memory specifically refers to the memory space that the programmable logic module can access, which belongs to the server. Correspondingly, the memory access strategy specifically refers to the DMA (Direct Memory Access) mechanism.

[0070] Based on this, when the programmable logic module receives the original data packet associated with the cloud computing service through the network card device, it indicates that the original data packet needs to be processed and transmitted in accordance with the service requirements. In order to be able to mirror the traffic of the data packet based on the service requirements, the original data packet can be stored in the server memory using the memory access strategy. At the same time, the network card driver corresponding to the network card device can be used to determine the original description information corresponding to the original data packet. On this basis, the original description information can be sent to the private cloud service gateway to enable the private cloud service gateway to update the original description information.

[0071] In summary, by storing the original data packet in the server memory, the number of transmissions of the original data packet can be reduced during the description information extraction and sending stage, thereby saving more network resources.

[0072] In actual applications, after the private cloud service gateway receives the original description information, if it is determined that the original data packet needs to be mirrored, it is necessary to update the original description information according to the data detection strategy so that it can be mirrored and detected after being sent to the replication module. In this embodiment, the private cloud service gateway is also used to convert the public network address contained in the original description information into a private network address according to a preset data detection strategy, set the mirror flag in the metadata contained in the original description information, and configure the network device index information contained in the original description information, generate the target description information according to the address conversion result, the setting result and the configuration result, and call the sending function to feed back the target description information to the programmable logic module.

[0073] Specifically, the public network address specifically refers to the address corresponding to the original data packet in the public network, and the private network address specifically refers to the address of the corresponding user's private cloud network. Correspondingly, the metadata is the Meta corresponding to the original data packet. Correspondingly, the mirror flag specifically refers to the flag that reflects whether the original data packet needs to be traffic mirrored. Correspondingly, the network device index information specifically refers to the index value that needs to be used to record the original data packet when it is traffic mirrored.

[0074] Based on this, after the private cloud service gateway receives the original description information corresponding to the original data packet, when it is determined that the original data packet needs to be mirrored according to the service requirements, the public network address contained in the original description information can be converted into a private network address according to the preset data detection strategy, and the mirror flag in the metadata contained in the original description information can be set, and the network device index information contained in the original description information can be configured. After completing the above operations, it can be determined that the data packet has the attributes of traffic mirroring. Thereafter, the target description information can be generated according to the address conversion result, the setting result and the configuration result, and then the sending function is called to feed the target description information back to the programmable logic module for subsequent processing.

[0075] In summary, by updating the mirror identification bit, network device index information and address through the private cloud service gateway, the target description information obtained after the update can have the property of triggering the traffic mirroring function, so as to facilitate subsequent detection of the original data packet.

[0076] After the programmable logic module receives the target description information, it can read the original data packet in the server memory and send it to the replication module for processing in combination with the target description information. In this embodiment, the programmable logic module is also used to read the original data packet in the server memory according to the target description information through the network card device, and send the original data packet and the target description information to the replication module using the network card driver.

[0077] Based on this, when the private cloud service gateway feeds back the target description information to the programmable logic module, the programmable logic module can read the original data packet in the server memory according to the target description information through the network card device. After reading the original data packet, the network card driver can be used to send the original data packet and the target description information to the replication module, so that the replication module can perform traffic mirroring on the original data packet.

[0078] Using the above example, after the FPGA device's network card receives the data packet, it can send the data packet to the server memory for storage through the DMA mechanism. The FPGA device's network card driver can extract the data descriptor of the original data packet and send it to the XGW for processing. After the XGW receives the data descriptor, it needs to convert the public network address of the data packet in the data descriptor to the private network address corresponding to the customer in the VPC, and at the same time determine that the original data packet needs to be processed by traffic billing and NIS. Therefore, the mirror flag in the Meta of the data packet in the data descriptor can be set, and the index of the Bond address can be set to 1, so that the original data packet has the property of traffic mirroring. After that, the XGW can call the sending function to send the processed data descriptor to the FPGA device's network card driver. After the FPGA device receives the updated data descriptor, it can use the DMA mechanism in the server memory to read the original data packet according to the updated data descriptor, and move it to the hardware. After being processed by the service module, it can be sent to the traffic mirroring module to implement traffic mirroring for the original data packet.

[0079] In summary, by adopting a combination of software and hardware to support traffic mirroring in cloud computing services, the elasticity of traffic mirroring can be effectively improved, thereby making it have stronger disaster recovery capabilities.

[0080] Furthermore, after receiving the target description information and the original data packet, the copy module needs to detect whether the original data packet needs to be mirrored, and the detection can be determined by detecting the mirror flag bit in the information and the network device index information. In this embodiment, the copy module is also used to detect the mirror flag bit in the metadata contained in the target description information, and when the configured network device index information is stored in the configuration table item, determine that the original data packet meets the detection condition, and execute the step of constructing a mirror data packet corresponding to the original data packet.

[0081] Based on this, after the replication module receives the original data packet and the target description information, the replication module needs to detect the original data packet. If it is detected that the mirror flag in the metadata contained in the target description information is in the position, and the configured network device index information is stored in the configuration table item, it means that the original data packet meets the requirements of mirror replication at this time. Therefore, it can be determined that the original data packet meets the detection conditions, and the steps of constructing a mirror data packet corresponding to the original data packet can be executed.

[0082] In addition, if the original data packet does not meet the detection conditions, the message statistics can be updated for the original data packet, and the target description information corresponding to the original data packet can be released, and the original data packet can be sent to the remote end through the physical link for direct processing. At the same time, if the detection conditions are met, the mirror data packet will be processed later, while the original data packet will not be affected by the processing of the mirror data packet. The message statistics can be updated, and the target description information corresponding to the original data packet can be released, and the original data packet can be sent to the remote end through the physical link for direct processing.

[0083] In summary, by detecting the mirror flag bit and network device index information of the target description information, it is possible to accurately determine whether the original data packet has the property of traffic mirroring, and then selectively process the data packet without having to perform this operation on all data packets, thereby saving more resources and reducing the transmission of invalid traffic.

[0084] Furthermore, after determining that the original data packet needs to be mirrored, the replication module can select a data detection node through network device configuration information in order to accurately select a virtual server that can be used for detection of the mirrored data packet in the future. In this embodiment, the replication module is also used to select network device configuration information according to the configured network device index information, and to perform hash calculation on the five-tuple information corresponding to the mirrored data packet to obtain a hash value, select a data detection node in the network device configuration information according to the hash value, and execute the step of configuring detection information for the mirrored data packet when the detection parameter of the mirrored data packet is less than the parameter threshold preset by the data detection node.

[0085] Specifically, the network device configuration information specifically refers to the Bond configuration selected for the mirror data packet according to the configured network device index information. Accordingly, the hash value specifically refers to the hash value obtained by performing a hash operation on the five-tuple information corresponding to the mirror data packet. Accordingly, the data detection condition specifically refers to the member member selected to process the mirror data packet in the Bond configuration. Accordingly, the detection parameter specifically refers to the amount of data corresponding to the mirror data packet or the amount of calculation required, and the parameter threshold specifically refers to the upper limit of the amount of data or the upper limit of the amount of calculation that the data detection node can process.

[0086] Based on this, after the replication module constructs a mirror data packet for the original data packet, it is determined that traffic mirroring is required for the mirror data packet, so the network device configuration information can be selected according to the configured network device index information, and the five-tuple information corresponding to the mirror data packet is hashed to obtain a hash value; on this basis, a data detection node can be selected in the network device configuration information according to the hash value, and the data detection node can be detected to see whether it can process the mirror data packet. If the detection parameter of the mirror data packet is less than the parameter threshold preset by the data detection node, it means that subsequent processing can be performed, so the step of configuring the detection information for the mirror data packet can be executed.

[0087] In summary, before detecting the mirrored data packet, the data detection node can be determined through configuration information, which makes it easier to send it to a pre-configured virtual server for processing, thereby saving more computing resources.

[0088] Furthermore, when configuring detection information for the mirrored data packet, a virtual extensible LAN data header containing multiple information is actually added to the message of the original data packet. In this embodiment, the copy module is also used to add a virtual extensible LAN data header to the mirrored data packet as detection information configured for the mirrored data packet; wherein the virtual extensible LAN data header contains virtual server information and physical machine information.

[0089] Specifically, the virtual extensible LAN data header specifically refers to a data header defined for a mirrored data packet, which includes virtual server information and physical machine information; wherein the virtual server information is used to determine the virtual server that processes the mirrored data packet, and the physical machine information is used to determine the physical machine to which the virtual server belongs.

[0090] Based on this, the replication module completes the construction of the mirror data packet and can add a virtual extensible LAN data header to the mirror data packet as detection information for the mirror data packet configuration; and the virtual extensible LAN data header contains virtual server information and physical machine information, so that it can be subsequently sent to the virtual machine server running on the physical machine for detection and processing of the mirror data packet.

[0091] Using the above example, after the replication module receives the original data packet and the updated data descriptor, it can determine whether the mirror flag bit of the Meta information record in the updated data descriptor is set. If it is not set, the message statistics can be directly updated, the data descriptor can be released, and the original data packet can be sent from the physical link to the remote processing. If the mirror flag bit is set and the Bond index exists in the configuration table item, the original data packet can be replicated to obtain the mirrored data packet. For the original data packet, the message statistics can be directly updated, the data descriptor can be released, and the original data packet can be sent from the physical link to the remote processing.

[0092] Furthermore, for the mirrored data packet, the corresponding Bond configuration can be selected according to the Bond index. After that, the hash value can be calculated according to the five-tuple information (sip, dip, proto, sport, dport) of the data packet to obtain the hash value Hash1. According to Hash1, the member of the corresponding mirrored data packet can be selected in the Bond configuration. At this time, if the member1 member is confirmed to be in compliance, the physical machine address 10.10.1.1 to which it belongs can be determined.

[0093] Furthermore, when it is determined that the mirrored data packet does not exceed the protective rate limit of member1, a VXLAN header can be added to the outer layer of the mirrored data packet, and the header information includes VNI 2048, source IP address XGW's IP address, and destination address 10.10.1.1. After that, the mirrored data packet can be sent to the physical network underlay network according to the information, for transmission to the physical machine corresponding to the physical machine address 10.10.1.1 for subsequent processing.

[0094] In summary, by configuring a virtual extensible LAN datagram header for a mirrored data packet, the data packet can be sent to a designated virtual server for processing, thereby achieving the purpose of dynamically scaling traffic mirroring.

[0095] On this basis, it is necessary to determine the virtual server. At this time, the target physical machine corresponding to the physical machine information can be determined first, and then the target physical machine flexibly selects the virtual server to complete the detection of the data packet. In this embodiment, the system also includes a target physical machine corresponding to the physical machine information, and the target physical machine is used to receive the mirror data packet submitted by the replication module through the physical network corresponding to the target physical machine, determine the virtual server according to the virtual server information, and send the mirror data packet to the virtual server for detecting the mirror data packet.

[0096] Specifically, the target physical machine refers to the physical machine corresponding to the physical machine information, which is used to receive the mirror data packet and send it to the virtual server corresponding to the detection information for processing.

[0097] Based on this, after the target physical machine is determined according to the physical machine information, the mirror data packet can be sent to the target physical machine through the physical network. At this time, after the target physical machine receives the mirror data packet submitted by the replication module through the physical network corresponding to the target physical machine, it can first determine the virtual server according to the virtual server information, so that the mirror data packet can be sent to the virtual server for detection of the mirror data packet.

[0098] In summary, the target physical machine and virtual server are clearly identified through the physical machine information and the virtual server information, so as to ensure that the mirrored data packets are selectively mirrored by the traffic, thereby saving the transmission of invalid traffic.

[0099] In specific implementation, when the virtual server detects the mirror data packet, it can perform traffic billing, network detection or network testing, etc. In this embodiment, the virtual server is used to receive the mirror data packet, perform traffic billing, network detection or network testing on the mirror data packet, and feed back the traffic billing result, network detection result or network test result to the management platform corresponding to the cloud computing service.

[0100] Based on this, when the virtual server receives the mirror data packet, it can perform traffic billing, network detection or network testing on the mirror data packet according to the preset service policy, and then feed back the traffic billing results, network detection results or network test results to the management platform corresponding to the cloud computing service for maintenance by the management platform. Among them, network detection specifically refers to NIS detection on the mirror data packet, and network testing specifically refers to DDOS detection on the mirror data packet.

[0101] Using the above example, the mirrored data packet is routed through the switch in the physical network and is sent to the physical machine with the physical address of 10.10.1.1. After the physical machine receives the mirrored data packet, it sends the mirrored data packet to ECS1 with VNI 2048 and IP address 192.168.100.1 according to the pre-configured information. After ECS1 receives the mirrored data packet, it can perform service logic such as traffic billing, NIS or DDOS detection on the mirrored data packet.

[0102] The data packet processing system provided in this embodiment can improve resource utilization while reducing costs, and can achieve the ability to quickly expand and contract to cope with the sudden increase in public network traffic and thus solve the problems of under-billing and security attack omissions. The data packet processing system can be composed of a programmable logic module, a private cloud service gateway and a replication module. For the original data packet associated with the cloud computing service, the programmable logic module can determine the original description information corresponding to the original data packet. After sending it to the private cloud service gateway, the private cloud service gateway can update the original description information to the target description information according to the preset data detection strategy, and feed back the target description information to the programmable logic module; at this time, the original data packet and the target description information are sent to the replication module through the programmable logic module; the target description information is carried only for the original data packet that needs to be mirrored, thereby achieving on-demand splitting, avoiding the problem of processing all data packets, and reducing the transmission of invalid traffic. After the replication module receives the original data packet and target description information, if it is determined by detecting the target description information that the original data packet meets the detection conditions, the replication module can then independently construct a mirror data packet corresponding to the original data packet, and configure detection information for the mirror data packet. On this basis, the mirror data packet is submitted to the virtual server according to the detection information for detection of the mirror data packet. The detection of the mirror data packet can be completed on the virtual server, thereby achieving the purpose of elastic expansion and contraction of the traffic mirroring function, which is not affected by objective factors of the physical device, thereby solving the bottleneck of insufficient performance.

[0103] The following combination Figure 4 , taking the application of the data packet processing system provided in this specification in a cloud computing scenario as an example, the data packet processing system is further described. Figure 4 A processing flow chart of a data packet processing system provided by an embodiment of the present specification is shown, which specifically includes the following steps.

[0104] Step S402, the programmable logic module receives the mirror configuration information sent by the management module of the cloud computing service, determines the network device index information, virtual extensible local area network information, network address information and physical machine information according to the mirror configuration information, and caches the network device index information, virtual extensible local area network information, network address information and physical machine information.

[0105] During the FPGA device configuration phase, the cloud computing service can be used to send the mirror configuration information Mirror to the FPGA's traffic mirror module through the API provided by the network card driver. The mirror configuration information Mirror contains the following information: Bond-ENI-index: 1; sys-VNI: 2048; IP_addr: 192.168.100.1; member: [{nc-ip: 10.10.1.1}, {nc-ip: 10.10.1.2}, {nc-ip: 10.10.1.3}, {nc-ip: 10.10.1.4}]. Among them, Bond-ENI-index:1 indicates that the index of the Bond-ENI used for traffic mirroring is 1, the VXLAN network id used is 2048, and the overlay IP address where it is located is 192.168.100.1. This Bond-ENI contains four members, and the physical machines where each member is located are 10.10.1.1, 10.10.1.2, 10.10.1.3, and 10.10.1.4. After that, if a data packet that needs to be mirrored is received, the traffic mirroring function can be implemented according to the configuration information.

[0106] In step S404, the programmable logic module receives the original data packet associated with the cloud computing service through the network card device, stores the original data packet in the server memory using the memory access strategy, determines the original description information corresponding to the original data packet using the network card driver corresponding to the network card device, and sends the original description information to the private cloud service gateway.

[0107] In step S406, the private cloud service gateway converts the public network address contained in the original description information into a private network address according to the preset data detection strategy, sets the mirror flag in the metadata contained in the original description information, and configures the network device index information contained in the original description information, generates target description information according to the address conversion result, the setting result and the configuration result, and calls the sending function to feed back the target description information to the programmable logic module.

[0108] Step S408: the programmable logic module reads the original data packet in the server memory according to the target description information through the network card device, and sends the original data packet and the target description information to the replication module using the network card driver.

[0109] After the network card of the FPGA device receives the data packet, it can send the data packet to the server memory for storage through the DMA mechanism. The network card driver of the FPGA device can extract the data descriptor of the original data packet and send it to the XGW for processing. After the XGW receives the data descriptor, it needs to convert the public network address of the data packet in the data descriptor into the private network address corresponding to the customer in the VPC, and at the same time determine that the original data packet needs to be processed by traffic billing and NIS. Therefore, the mirror flag in the Meta of the data packet in the data descriptor can be set, and the index of the Bond address can be set to the index corresponding to any member, such as the index of the current Bond address is set to 1, so that the original data packet can be guaranteed to have the property of traffic mirroring. Thereafter, the XGW can call the sending function to send the processed data descriptor to the network card driver of the FPGA device. After the FPGA device receives the updated data descriptor, it can read the original data packet in the server memory using the DMA mechanism according to the updated data descriptor, and move it to the hardware. After being processed by the service module, it can be sent to the traffic mirroring module to realize traffic mirroring for the original data packet.

[0110] Step S410, the replication module detects that the mirror flag in the metadata included in the target description information is in position, and the configured network device index information is stored in the configuration table entry, determines that the original data packet meets the detection condition, and constructs a mirror data packet corresponding to the original data packet.

[0111] Step S412, the replication module selects network device configuration information according to the configured network device index information, performs hash calculation on the five-tuple information corresponding to the mirrored data packet to obtain a hash value, and selects a data detection node in the network device configuration information according to the hash value.

[0112] Step S414, when the detection parameter of the mirrored data packet is less than the parameter threshold preset by the data detection node, the replication module adds a virtual extensible LAN data header to the mirrored data packet, wherein the virtual extensible LAN data header includes virtual server information and physical machine information, and sends the mirrored data packet to the target physical machine according to the physical machine information.

[0113] After receiving the original data packet and the updated data descriptor, the replication module can determine whether the mirror flag of the Meta information record in the updated data descriptor is set. If not, the message statistics can be directly updated, the data descriptor can be released, and the original data packet can be sent from the physical link to the remote processing. If the mirror flag is set and the Bond index exists in the configuration table item, the original data packet can be replicated to obtain the mirror data packet. For the original data packet, the message statistics can be directly updated, the data descriptor can be released, and the original data packet can be sent from the physical link to the remote processing.

[0114] Furthermore, for the mirrored data packet, the corresponding Bond configuration can be selected according to the Bond index. After that, the hash value can be calculated according to the five-tuple information (sip, dip, proto, sport, dport) of the data packet to obtain the hash value Hash1. According to Hash1, the member of the corresponding mirrored data packet can be selected in the Bond configuration. At this time, if the member1 member is confirmed to be in compliance, the physical machine address 10.10.1.1 to which it belongs can be determined.

[0115] Furthermore, when it is determined that the mirrored data packet does not exceed the protective rate limit of member1, a VXLAN header can be added to the outer layer of the mirrored data packet, and the header information includes VNI 2048, source IP address XGW's IP address, and destination address 10.10.1.1. After that, the mirrored data packet can be sent to the physical network underlay network according to the information, for transmission to the physical machine corresponding to the physical machine address 10.10.1.1 for subsequent processing.

[0116] Step S416: The target physical machine receives the mirror data packet via Ethernet, determines the virtual server according to the virtual server information, and sends the mirror data packet to the virtual server.

[0117] Step S418: The virtual server receives the mirrored data packet, performs traffic billing, network detection or network testing on the mirrored data packet, and feeds back the traffic billing result, network detection result or network testing result to the management platform corresponding to the cloud computing service.

[0118] The mirrored data packet is routed through the switch in the physical network and is sent to the physical machine with the physical address of 10.10.1.1. After the physical machine receives the mirrored data packet, it sends the mirrored data packet to ECS1 with VNI 2048 and IP address 192.168.100.1 according to the pre-configured information. After ECS1 receives the mirrored data packet, it can perform service logic such as traffic billing, NIS or DDOS detection on the mirrored data packet.

[0119] To summarize, in order to improve resource utilization while reducing costs, and to achieve the ability to expand and contract rapidly to cope with sudden increases in public network traffic and thereby solve the problems of under-billing and missed security attacks, a data packet processing system can be composed of a programmable logic module, a private cloud service gateway, and a replication module. For the original data packet associated with the cloud computing service, the programmable logic module can determine the original description information corresponding to the original data packet. After sending it to the private cloud service gateway, the private cloud service gateway can update the original description information to the target description information according to a preset data detection strategy, and feed the target description information back to the programmable logic module; at this time, the original data packet and the target description information are sent to the replication module through the programmable logic module; the target description information is carried only for the original data packet that needs to be mirrored, thereby achieving on-demand splitting, avoiding the problem of processing all data packets, and reducing the transmission of invalid traffic. After the replication module receives the original data packet and target description information, if it is determined by detecting the target description information that the original data packet meets the detection conditions, the replication module can then independently construct a mirror data packet corresponding to the original data packet, and configure detection information for the mirror data packet. On this basis, the mirror data packet is submitted to the virtual server according to the detection information for detection of the mirror data packet. The detection of the mirror data packet can be completed on the virtual server, thereby achieving the purpose of elastic expansion and contraction of the traffic mirroring function, which is not affected by objective factors of the physical device, thereby solving the bottleneck of insufficient performance.

[0120] Corresponding to the above system embodiment, this specification also provides a data packet processing method embodiment, Figure 5 FIG. 1 is a flow chart of a method for processing a data packet provided by an embodiment of the present specification. Figure 5 As shown, the method includes:

[0121] Step S502, determining an original data packet associated with a cloud computing service through a programmable logic module, and sending original description information corresponding to the original data packet to a private cloud service gateway;

[0122] Step S504, updating the original description information using the data detection strategy preset by the private cloud service gateway to obtain target description information;

[0123] Step S506, detecting the target description information through a replication module, and constructing a mirror data packet corresponding to the original data packet when it is determined according to the detection result that the original data packet meets the detection condition;

[0124] Step S508: configuring detection information for the mirrored data packet, and detecting the mirrored data packet according to the detection information.

[0125] In an optional embodiment, the programmable logic module receives mirror configuration information issued by the management module of the cloud computing service, determines network device index information, virtual extensible local area network information, network address information and physical machine information based on the mirror configuration information, and caches the network device index information, the virtual extensible local area network information, the network address information and the physical machine information to execute the data packet detection task corresponding to the original data packet.

[0126] In an optional embodiment, the programmable logic module receives the original data packet associated with the cloud computing service through a network card device, stores the original data packet in the server memory using a memory access strategy, and determines the original description information corresponding to the original data packet using the network card driver corresponding to the network card device, and sends the original description information to the private cloud service gateway.

[0127] In an optional embodiment, the private cloud service gateway converts the public network address contained in the original description information into a private network address according to a preset data detection strategy, sets the mirror flag in the metadata contained in the original description information, and configures the network device index information contained in the original description information, generates target description information according to the address conversion result, the setting result and the configuration result, and calls the sending function to feed the target description information back to the programmable logic module.

[0128] In an optional embodiment, the programmable logic module reads the original data packet in the server memory according to the target description information through the network card device, and uses the network card driver to send the original data packet and the target description information to the replication module.

[0129] In an optional embodiment, the replication module detects the mirror flag position in the metadata contained in the target description information, and when the configured network device index information is stored in the configuration table item, determines that the original data packet meets the detection conditions, and executes the step of constructing a mirror data packet corresponding to the original data packet.

[0130] In an optional embodiment, the replication module selects network device configuration information based on the configured network device index information, and performs hash calculation on the five-tuple information corresponding to the mirror data packet to obtain a hash value, selects a data detection node in the network device configuration information according to the hash value, and executes the step of configuring detection information for the mirror data packet when the detection parameter of the mirror data packet is less than a parameter threshold preset by the data detection node.

[0131] In an optional embodiment, the replication module adds a virtual extensible local area network data header to the mirror data packet as detection information for the configuration of the mirror data packet; wherein the virtual extensible local area network data header includes virtual server information and physical machine information.

[0132] In an optional embodiment, the target physical machine corresponding to the physical machine information receives the mirror data packet submitted by the replication module through the physical network corresponding to the target physical machine, determines the virtual server according to the virtual server information, and sends the mirror data packet to the virtual server for detecting the mirror data packet.

[0133] In an optional embodiment, the virtual server receives the mirror data packet, performs traffic billing, network detection or network testing on the mirror data packet, and feeds back the traffic billing result, network detection result or network testing result to the management platform corresponding to the cloud computing service.

[0134] The data packet processing method provided in this embodiment can improve resource utilization while reducing costs, and can achieve the ability of rapid expansion and contraction to cope with the sudden increase in public network traffic and thus solve the problems of under-billing and security attack omissions. A data packet processing system can be composed of a programmable logic module, a private cloud service gateway and a replication module. For the original data packet associated with the cloud computing service, the programmable logic module can determine the original description information corresponding to the original data packet. After sending it to the private cloud service gateway, the private cloud service gateway can update the original description information to the target description information according to the preset data detection strategy, and feed back the target description information to the programmable logic module; at this time, the original data packet and the target description information are sent to the replication module through the programmable logic module; the target description information is carried only for the original data packet that needs to be mirrored, thereby achieving on-demand splitting, avoiding the problem of processing all data packets, and reducing the transmission of invalid traffic. After the replication module receives the original data packet and target description information, if it is determined by detecting the target description information that the original data packet meets the detection conditions, the replication module can then independently construct a mirror data packet corresponding to the original data packet, and configure detection information for the mirror data packet. On this basis, the mirror data packet is submitted to the virtual server according to the detection information for detection of the mirror data packet. The detection of the mirror data packet can be completed on the virtual server, thereby achieving the purpose of elastic expansion and contraction of the traffic mirroring function, which is not affected by objective factors of the physical device, thereby solving the bottleneck of insufficient performance.

[0135] The above is a schematic scheme of a data packet processing method of this embodiment. It should be noted that the technical scheme of the data packet processing method and the technical scheme of the data packet processing system described above are of the same concept, and the details not described in detail in the technical scheme of the data packet processing method can be referred to the description of the technical scheme of the data packet processing system described above.

[0136] Corresponding to the above method embodiment, this specification also provides a data packet processing device embodiment, Figure 6 FIG. 2 shows a schematic diagram of the structure of a data packet processing device provided by an embodiment of the present specification. Figure 6 As shown, the device comprises:

[0137] The determination unit 602 is configured to determine an original data packet associated with the cloud computing service through a programmable logic module, and send original description information corresponding to the original data packet to the private cloud service gateway;

[0138] An updating unit 604 is configured to update the original description information using a data detection strategy preset by the private cloud service gateway to obtain target description information;

[0139] A construction unit 606 is configured to detect the target description information through a replication module, and if it is determined according to the detection result that the original data packet meets the detection condition, construct a mirror data packet corresponding to the original data packet;

[0140] The detection unit 608 is configured to configure detection information for the mirrored data packet and detect the mirrored data packet according to the detection information.

[0141] In an optional embodiment, the programmable logic module receives mirror configuration information issued by the management module of the cloud computing service, determines network device index information, virtual extensible local area network information, network address information and physical machine information based on the mirror configuration information, and caches the network device index information, the virtual extensible local area network information, the network address information and the physical machine information to execute the data packet detection task corresponding to the original data packet.

[0142] In an optional embodiment, the programmable logic module receives the original data packet associated with the cloud computing service through a network card device, stores the original data packet in the server memory using a memory access strategy, and determines the original description information corresponding to the original data packet using the network card driver corresponding to the network card device, and sends the original description information to the private cloud service gateway.

[0143] In an optional embodiment, the private cloud service gateway converts the public network address contained in the original description information into a private network address according to a preset data detection strategy, sets the mirror flag in the metadata contained in the original description information, and configures the network device index information contained in the original description information, generates target description information according to the address conversion result, the setting result and the configuration result, and calls the sending function to feed the target description information back to the programmable logic module.

[0144] In an optional embodiment, the programmable logic module reads the original data packet in the server memory according to the target description information through the network card device, and uses the network card driver to send the original data packet and the target description information to the replication module.

[0145] In an optional embodiment, the replication module detects the mirror flag position in the metadata contained in the target description information, and when the configured network device index information is stored in the configuration table item, determines that the original data packet meets the detection conditions, and executes the step of constructing a mirror data packet corresponding to the original data packet.

[0146] In an optional embodiment, the replication module selects network device configuration information based on the configured network device index information, and performs hash calculation on the five-tuple information corresponding to the mirror data packet to obtain a hash value, selects a data detection node in the network device configuration information according to the hash value, and executes the step of configuring detection information for the mirror data packet when the detection parameter of the mirror data packet is less than a parameter threshold preset by the data detection node.

[0147] In an optional embodiment, the replication module adds a virtual extensible local area network data header to the mirror data packet as detection information for the configuration of the mirror data packet; wherein the virtual extensible local area network data header includes virtual server information and physical machine information.

[0148] In an optional embodiment, the target physical machine corresponding to the physical machine information receives the mirror data packet submitted by the replication module through the physical network corresponding to the target physical machine, determines the virtual server according to the virtual server information, and sends the mirror data packet to the virtual server for detecting the mirror data packet.

[0149] In an optional embodiment, the virtual server receives the mirror data packet, performs traffic billing, network detection or network testing on the mirror data packet, and feeds back the traffic billing result, network detection result or network testing result to the management platform corresponding to the cloud computing service.

[0150] The above is a schematic scheme of a data packet processing device of this embodiment. It should be noted that the technical scheme of the data packet processing device and the technical scheme of the data packet processing method described above belong to the same concept, and the details not described in detail in the technical scheme of the data packet processing device can be referred to the description of the technical scheme of the data packet processing method described above.

[0151] Figure 7 The block diagram of a computing device 700 according to an embodiment of the present specification is shown. The components of the computing device 700 include but are not limited to a memory 710 and a processor 720. The processor 720 is connected to the memory 710 via a bus 730, and the database 750 is used to store data.

[0152] The computing device 700 also includes an access device 740 that enables the computing device 700 to communicate via one or more networks 760. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 740 may include one or more of any type of network interface (e.g., a network interface card (NIC)) of wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, and a near field communication (NFC).

[0153] In one embodiment of the present specification, the above components of the computing device 700 and Figure 7 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 7 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0154] The computing device 700 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 700 may also be a mobile or stationary server.

[0155] The processor 720 is used to execute the following computer executable instructions, which implement the steps of the above-mentioned data packet processing method when executed by the processor.

[0156] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the above-mentioned data packet processing method belong to the same concept, and the details not described in detail in the technical scheme of the computing device can be referred to the description of the technical scheme of the above-mentioned data packet processing method.

[0157] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the above-mentioned data packet processing method.

[0158] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the above-mentioned data packet processing method belong to the same concept, and the details not described in detail in the technical scheme of the storage medium can be referred to the description of the technical scheme of the above-mentioned data packet processing method.

[0159] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned data packet processing method.

[0160] The above is an illustrative solution of a computer program of this embodiment. It should be noted that the technical solution of the computer program and the technical solution of the above-mentioned data packet processing method belong to the same concept, and the details not described in detail in the technical solution of the computer program can be referred to the description of the technical solution of the above-mentioned data packet processing method.

[0161] An embodiment of the present specification further provides a computer program product, including a computer program or instructions, which implement the steps of the above-mentioned data packet processing method when executed by a processor.

[0162] The above is a schematic scheme of a computer program product of this embodiment. It should be noted that the technical scheme of the computer program product and the technical scheme of the above-mentioned data packet processing method belong to the same concept, and the details not described in detail in the technical scheme of the computer program product can be referred to the description of the technical scheme of the above-mentioned data packet processing method.

[0163] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0164] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0165] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0166] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0167] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A data packet processing system, comprising a programmable logic module, a private cloud service gateway and a replication module, comprising: The programmable logic module is used to receive an original data packet associated with a cloud computing service, and send original description information corresponding to the original data packet to the private cloud service gateway; The private cloud service gateway is used to convert the public network address contained in the original description information into a private network address according to a preset data detection strategy, set the mirror flag in the metadata contained in the original description information, and configure the network device index information contained in the original description information, generate target description information according to the address conversion result, the setting result and the configuration result, and feed back the target description information to the programmable logic module; The programmable logic module is used to send the original data packet and the target description information to the replication module; The replication module is used to construct a mirror data packet corresponding to the original data packet when determining that the original data packet meets the detection conditions by detecting the target description information, configure detection information for the mirror data packet, and submit the mirror data packet to the virtual server according to the detection information for detecting the mirror data packet.

2. According to the data packet processing system of claim 1, the programmable logic module is also used to receive mirror configuration information issued by the management module of the cloud computing service, determine network device index information, virtual extensible local area network information, network address information and physical machine information according to the mirror configuration information, and cache the network device index information, the virtual extensible local area network information, the network address information and the physical machine information to execute the data packet detection task corresponding to the original data packet.

3. According to the data packet processing system of claim 1, the programmable logic module is also used to receive the original data packet associated with the cloud computing service through the network card device, store the original data packet in the server memory using the memory access strategy, and determine the original description information corresponding to the original data packet using the network card driver corresponding to the network card device, and send the original description information to the private cloud service gateway.

4. According to the data packet processing system according to claim 1, the private cloud service gateway calls a sending function to feed back the target description information to the programmable logic module.

5. According to the packet processing system of claim 3, the programmable logic module is used to read the original data packet in the server memory according to the target description information through the network card device, and use the network card driver to send the original data packet and the target description information to the replication module.

6. According to the data packet processing system of claim 4, the replication module is used to detect the mirror flag position in the metadata contained in the target description information, and when the configured network device index information is stored in the configuration table item, determine that the original data packet meets the detection conditions, and execute the step of constructing a mirror data packet corresponding to the original data packet.

7. According to the data packet processing system of claim 4 or 6, the replication module is also used to select network device configuration information according to the configured network device index information, and perform hash calculation on the five-tuple information corresponding to the mirror data packet to obtain a hash value, select a data detection node in the network device configuration information according to the hash value, and execute the step of configuring detection information for the mirror data packet when the detection parameter of the mirror data packet is less than a parameter threshold preset by the data detection node.

8. The data packet processing system according to claim 4 or 6, wherein the copy module is further used to add a virtual extensible local area network data header to the mirrored data packet as detection information for the configuration of the mirrored data packet; wherein, The virtual extensible local area network data header includes virtual server information and physical machine information.

9. According to the data packet processing system of claim 8, the system also includes a target physical machine corresponding to the physical machine information, the target physical machine is used to receive the mirror data packet submitted by the replication module through the physical network corresponding to the target physical machine, determine the virtual server according to the virtual server information, and send the mirror data packet to the virtual server for detecting the mirror data packet.

10. According to the data packet processing system according to any one of claims 1 to 6, the virtual server is used to receive the mirrored data packet, perform traffic billing, network detection or network testing on the mirrored data packet, and feed back the traffic billing result, network detection result or network testing result to the management platform corresponding to the cloud computing service.

11. A data packet processing method, comprising: Determine an original data packet associated with a cloud computing service through a programmable logic module, and send original description information corresponding to the original data packet to a private cloud service gateway; The public network address contained in the original description information is converted into a private network address by using the data detection strategy preset by the private cloud service gateway, the mirror flag in the metadata contained in the original description information is set, and the network device index information contained in the original description information is configured, and the target description information is generated according to the address conversion result, the setting result and the configuration result; The target description information is detected by a replication module, and when it is determined according to the detection result that the original data packet meets the detection condition, a mirror data packet corresponding to the original data packet is constructed; Detection information is configured for the mirrored data packet, and the mirrored data packet is detected according to the detection information.

12. A data packet processing device, comprising: a determination unit configured to determine an original data packet associated with a cloud computing service through a programmable logic module, and send original description information corresponding to the original data packet to a private cloud service gateway; An updating unit is configured to convert the public network address contained in the original description information into a private network address by using the data detection strategy preset by the private cloud service gateway, set the mirror flag in the metadata contained in the original description information, and configure the network device index information contained in the original description information, and generate the target description information according to the address conversion result, the setting result and the configuration result; A construction unit is configured to detect the target description information through a replication module, and if it is determined according to the detection result that the original data packet meets the detection condition, construct a mirror data packet corresponding to the original data packet; The detection unit is configured to configure detection information for the mirrored data packet and detect the mirrored data packet according to the detection information.

13. A computing device comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the method according to claim 11 are implemented.

14. A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions implement the steps of the method of claim 11 when executed by a processor.

15. A computer program product, comprising a computer program or instructions, which implement the steps of the method according to claim 11 when executed by a processor.

Images