High-flow container secure communication management method, device, equipment and program product
By analyzing the detected data packets and using hash linked lists to manage container communication information, the problem of relying on additional components and knowing container information in the prior art is solved, and a high flexibility and adaptability of container secure communication management is achieved.
Patent Information
- Application Number
- CN202411614930.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-13
- Publication Date
- 2025-02-25
AI Technical Summary
The prior art requires relying on additional network components or plug-ins when controlling container communication relationships, and requires a large amount of container information to be known in advance, resulting in less flexibility and adaptability.
By analyzing the detected data packets, determining the container communication information and managing it using hash linked lists, the security management of inter-container communication is achieved without relying on other network components or plug-ins.
It realizes the flexibility and adaptability of high-traffic container secure communication management, can dynamically manage container communication, without predicting a large amount of container information in advance, and is highly universal to the cluster.
Smart Images
Figure CN119520059A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the field of cloud computing, and more specifically to a method, apparatus, device, and program product for managing high-traffic container secure communications. Background Art
[0002] The cloud platform provides a flat network in which each container can communicate directly with other containers without any restrictions. This container network is usually regarded as a trusted network by the applications running in the specified network, and the service port running in the container is bound to the port of the host machine. In this way, all requests to access the target port of the host machine do not need to be authenticated, but the request is forwarded to the container server through the container proxy and finally reaches the application. The network mode of containers sharing network namespaces and shared protocol stacks makes the application's access to the container network have certain security risks. In related technologies, the container communication relationship is controlled through network plug-ins or network connection (Netlink) mechanisms to ensure the security of the container network.
[0003] In the process of implementing the concepts of the present disclosure, there are at least the following problems in the related art: controlling the container communication relationship through a network plug-in or a network connection mechanism, or relying on additional network components or plug-ins, or requiring a large amount of container information in advance, which makes its flexibility and adaptability low. Summary of the invention
[0004] In view of the above problems, the present disclosure provides a method, apparatus, device and program product for managing high-traffic container secure communications.
[0005] According to a first aspect of the present disclosure, a high-traffic container secure communication management method is provided, the method comprising: parsing a first data packet detected in a first preset time period to obtain header information of the first data packet; determining container communication information used for inter-container communication from the header information of the first data packet, wherein the container communication information includes a container address; determining an index position corresponding to the container address from a hash linked list, wherein each of the index positions corresponds to an information linked list; storing the container communication information in the information linked list according to the index position; in response to detecting a second data packet in a second preset time period, querying the container communication information in a plurality of the information linked lists according to the header information of the second data packet to obtain a first query result, wherein the second preset time period is located after the first preset time period; when the first query result indicates that the information linked list includes the container communication information, sending the second data packet to a destination container according to the header information of the second data packet.
[0006] According to an embodiment of the present disclosure, the method further includes: in response to detecting a third data packet in a second preset time period, querying the target container communication information in the plurality of information linked lists according to the header information of the third data packet to obtain a second query result; and restricting the transmission of the third data packet when the second query result indicates that the information linked list does not include the target container communication information.
[0007] According to an embodiment of the present disclosure, the method further includes: for each of the information linked lists, sorting the plurality of container communication information according to information heat values of the plurality of container communication information, wherein the information heat value is related to the number of times the container communication information is queried from the information linked list.
[0008] According to an embodiment of the present disclosure, the sorting of the plurality of container communication information according to the information heat values of the plurality of container communication information includes: adjusting the positions of the plurality of container communication information in the information linked list according to the information heat values so that the container communication information with a larger information heat value is close to the head of the information linked list.
[0009] According to an embodiment of the present disclosure, the method further includes: in response to detecting the second data packet in a second preset time period, increasing the information heat value of the target container communication information according to a preset increment value, so that in a subsequent search process, the target container communication information can be found in a shorter time.
[0010] According to an embodiment of the present disclosure, determining the index position corresponding to the container address from the hash linked list includes: searching for a target hash value corresponding to the container address in an association table, wherein the association table includes a plurality of container addresses and hash values corresponding to each of the plurality of container addresses; and modulo the target hash value using a preset load factor to obtain the index position.
[0011] According to an embodiment of the present disclosure, the target hash value is obtained by processing a hash seed and a container name corresponding to the container address using a hash algorithm.
[0012] A second aspect of the present disclosure provides a high-traffic container security communication management device, the device comprising: a first determination module, used to parse a first data packet detected in a first preset time period to obtain header information of the first data packet; a second determination module, used to determine container communication information used for inter-container communication from the header information of the first data packet, wherein the container communication information includes a container address; an index determination module, used to determine an index position corresponding to the container address from a hash linked list, wherein each index position corresponds to an information linked list; a storage module, used to store the container communication information in the information linked list according to the index position; a query module, used to query the container communication information in a plurality of information linked lists according to the header information of the second data packet in response to detecting a second data packet in a second preset time period to obtain a first query result, wherein the second preset time period is located after the first preset time period; and a sending module, used to send the second data packet to a destination container according to the header information of the second data packet when the first query result indicates that the information linked list includes the container communication information.
[0013] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.
[0014] The fourth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.
[0015] According to an embodiment of the present disclosure, in a cloud environment, each container in a cluster is assigned a cluster node when it is started normally. In a first preset period, the detected first data packet is parsed to obtain the header information of the first data packet, and the container communication information is determined based on the header information of the first data packet, and the information chain table corresponding to the container address is determined in the hash chain table according to the container address of the container communication information, and the container communication information is stored in the information chain table, so as to facilitate the processing of the second preset period of the container communication scenario with high traffic in the cloud environment, and the container communication information corresponding to the header information of the second data packet is searched in the hash chain table according to the detection of the second data packet. In the case of finding the corresponding container communication information, the second data packet is sent to the destination container according to the header information of the second data packet. The operation in the first preset period does not need to rely on other network components or plug-ins, and has high universality for different clusters; and by detecting cluster container communication in real time, the first data packet is converted into container communication information, which is a dynamic management solution, and does not need to predict a large amount of container information in advance, and has high adaptability and flexibility.
[0016] In addition, the present disclosure only identifies the first data packet of the communication between containers in the first preset time period to generate container communication information, and manages it through a hash linked list, which has the characteristics of non-intrusiveness, fast access speed, and high search accuracy for the communication between containers in the cluster. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] The above contents and other purposes, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:
[0018] Figure 1 The application scenario diagram of the high-traffic container secure communication management method according to an embodiment of the present disclosure is schematically shown;
[0019] Figure 2 A flowchart of a method for managing high-traffic container secure communications according to an embodiment of the present disclosure is schematically shown;
[0020] Figure 3 A schematic diagram of a hash chain table according to an embodiment of the present disclosure is schematically shown;
[0021] Figure 4 The structure block diagram of the high-traffic container secure communication management device according to an embodiment of the present disclosure is schematically shown;
[0022] Figure 5 A block diagram of an electronic device suitable for implementing a high-traffic container secure communication management method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION
[0023] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.
[0024] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.
[0025] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.
[0026] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).
[0027] It should be noted that in the embodiments of the present disclosure, certain software, components, models and other existing solutions in the industry may be mentioned, which should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present disclosure, but it does not mean that the present disclosure has or will necessarily use the solution.
[0028] A node is an abstract physical machine where a container runs, and a cluster is an abstract collection of central processing units (CPU) and random access memory (RAM) resources formed by the aggregation of nodes.
[0029] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and making decisions through computer programs. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge, and skills, and have reached a certain level of professionalism.
[0030] In the related art, one method is to manage and configure container security policies through the policy configuration function provided by the network plug-in. This policy management solution configures the access relationship between containers by writing configuration files to limit container-to-container communication. The network data packet sent by the container will first arrive at the virtual network card created by the network plug-in on the host machine. The virtual network card will decide where to send the data packet based on the routing table. The routing table information can be viewed through the database. When cross-host communication is performed, the data packet is forwarded to the next hop address through the host machine's network card, that is, a direct static route to the network protocol stack of the corresponding resident container on another host. This ensures that the container can only receive network traffic from a specific source and can only send network requests to a specific destination address.
[0031] Another way is to use the network connection mechanism to send the network data packet containing the container communication data to a socket through the system kernel. The user-state program can obtain the network data packet through the message queue, obtain detailed information of the data by parsing the data packet, and then analyze and compare the source address and destination address of the data packet to decide whether to release or discard the data packet. The data packet that meets the expected communication relationship data is repackaged and sent to the destination address, thereby realizing the restriction of the container communication relationship and ensuring the security of the container network.
[0032] However, completely entrusting the traffic to the relevant network plug-ins for management requires a large amount of container information to be known in advance, which lacks flexibility. It is extremely difficult to manage the traffic of each container in a high-traffic cloud environment. Intercepting the communication traffic and then managing it through queues will affect the normal passage of cluster traffic and have low timeliness. Therefore, there is an urgent need for a container security communication method that is highly flexible and does not affect cluster traffic.
[0033] An embodiment of the present disclosure provides a high-traffic container security communication management method, which parses a first data packet detected in a first preset time period to obtain header information of the first data packet; determines container communication information used for inter-container communication from the header information of the first data packet, wherein the container communication information includes a container address; determines an index position corresponding to the container address from a hash linked list, wherein each index position corresponds to an information linked list; stores the container communication information in the information linked list according to the index position; in response to detecting a second data packet in a second preset time period, queries the container communication information in multiple information linked lists according to the header information of the second data packet to obtain a first query result, wherein the second preset time period is located after the first preset time period; when the first query result indicates that the information linked list includes the container communication information, sends the second data packet to a destination container according to the header information of the second data packet.
[0034] Figure 1 The application scenario diagram of the high-traffic container secure communication management method according to an embodiment of the present disclosure is schematically shown.
[0035] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first container 101, a second container 102, a first firewall 103, a second firewall 104, a first router 105, and a second router 106. The communication between the first container 101 and the second container 102 may pass through the first firewall 103, the first router 105, the second router 106, and the second firewall 104 in sequence.
[0036] The first container 101 or the second container 102 is the smallest unit Pod of cluster scheduling. Here, one container is regarded as a Pod, that is, one or a few containers that are tightly coupled and share resources. The first container 101 and the second container 102 can be containers belonging to the same virtual host machine address, or the first container 101 and the second container 102 can be containers belonging to different virtual host machine addresses; the first container 101 and the second container 102 can be containers belonging to the same actual host machine address, or the first container 101 and the second container 102 can be containers belonging to different actual host machine addresses.
[0037] The first firewall 103 and the second firewall 104 may be virtual firewalls of the operating system where the first container 101 or the second container 102 is located, and the first router 105 and the second router 106 may be virtual routers of the operating system where the first container 101 or the second container 102 is located.
[0038] The first container 101 sends the first data packet to the container in the different network segment. The first data packet is first sent through the firewall to the Border Gateway Protocol (BGP) router, which can be the first router 105. When the first data packet is encapsulated into a frame and sent out, the "next hop" address in the routing table is used to set the destination Media Access Control Address (MAC), so that the frame encapsulated by the first data packet will reach the second router 106. In this way, the first data packet can reach the destination host through the Layer 2 network.
[0039] When the BGP editing gateway of the second router 106 receives the sent data frame, the network information is added to its own routing table. The host receiving the first data packet will parse the data frame and find the container to which the first data packet is sent through a component for network proxy and traffic forwarding, wherein the component may include kube-proxy; the second container 102 receives the first data packet.
[0040] In this process, the host machine (client) where the first container 101 or the second container 102 is located detects the communication traffic between containers at the first firewall 103 or the second firewall 104, that is, detects the first data packet.
[0041] It should be noted that the high-traffic container security communication management method provided by the embodiment of the present disclosure can generally be executed by the host machine (client) where the first container 101 or the second container 102 is located. Correspondingly, the high-traffic container security communication management device provided by the embodiment of the present disclosure can generally be set in the host machine (client) where each container is located. The high-traffic container security communication management method provided by the embodiment of the present disclosure can also be executed by a server or server cluster located in a cluster. Correspondingly, the high-traffic container security communication management device provided by the embodiment of the present disclosure can also be set in a server or server cluster in a cluster for execution.
[0042] It should be understood that Figure 1 The number of containers, routes, and servers in the example is only for illustration purposes. Any number of containers, routes, and servers may be provided as required.
[0043] The following will be based on Figure 1 The scene described by Figure 2~Figure 3 A high-traffic container secure communication management method of a disclosed embodiment is described in detail.
[0044] Figure 2 The flowchart of the method for managing high-traffic container secure communications according to an embodiment of the present disclosure is schematically shown.
[0045] like Figure 2 As shown, the high-traffic container secure communication management method of this embodiment includes operations S210 to S260.
[0046] In operation S210, a first data packet detected in a first preset time period is parsed to obtain header information of the first data packet.
[0047] In operation S220, container communication information used for inter-container communication is determined from header information of the first data packet, wherein the container communication information includes a container address.
[0048] In operation S230, an index position corresponding to the container address is determined from the hash linked list, wherein each index position corresponds to an information linked list.
[0049] In operation S240, the container communication information is stored in the information linked list according to the index position.
[0050] In operation S250, in response to detecting a second data packet in a second preset period, container communication information is queried in a plurality of information linked lists according to header information of the second data packet to obtain a first query result, wherein the second preset period is located after the first preset period.
[0051] In operation S260, when the first query result representation information linked list includes container communication information, the second data packet is sent to the destination container according to the header information of the second data packet.
[0052] According to an embodiment of the present disclosure, the first preset time period is set to detect the communication traffic between each container, that is, the data packets sent by each container. The firewalls of multiple host machines can be detected to obtain the first data packet sent by the container. The first data packet represents the data packet detected in the first preset time period. The first data packet is parsed to obtain the header information of the first data packet, wherein the header information of the first data packet may include the communication protocol, source address, destination address, source port, destination port and communication status, etc., wherein the communication status may include: ESTABLISHED, TIME_WAIT and CLOSE_WAIT, etc., wherein ESTABLISHED means communicating; TIME_WAIT means active closure; CLOSE_WAIT means passive closure.
[0053] According to an embodiment of the present disclosure, the container communication information may be in the form of a five-tuple, and the container communication information may include a communication protocol, a source address, a destination address, a source port, and a destination port, wherein the source address represents the address of the host machine where the container that sends the first data packet is located; the destination address represents the address of the host machine where the container that receives the first data packet is located. The source port represents the port to which the container that sends the first data packet belongs; the destination port represents the port to which the container that receives the first data packet belongs. The container address may be a source address or a destination address. The communication protocol, source address, destination address, source port, and destination port are searched from the header information of the first data packet to determine the container communication information used for communication between containers.
[0054] According to an embodiment of the present disclosure, container communication information in the form of a five-tuple can be represented by {(SIP), (DIP), (SP), (DP), (P)}, where SIP represents the source address, DIP represents the destination address, SP represents the source port, DP represents the destination port, and P represents the communication protocol. The format of the container communication information meets the requirements of firewall tools based on packet filtering, for example, iptables-A INPUT -s Source IP -d Destination IP -p Protocol --sport Source Port --dport Destination Port -j ACCEPT, which indicates that packets from a source address of SourceIP, a source port of Source Port, to a destination address of Destination IP, a destination port of DestinationPort, and a protocol of Protocol are allowed to pass through the INPUT chain.
[0055] According to an embodiment of the present disclosure, a hash linked list stores an information linked list of each node in the cluster, wherein a node is a physical machine where an abstract container runs, and a node is represented by a container address. The information linked list corresponding to each container address is a linked list for storing communication relationships between containers. The index position corresponding to the container address is determined from the hash linked list, and the information linked list corresponding to the container address is determined based on the index position. The container communication information is stored in the information linked list. The hash linked list and the information linked list in the hash linked list are pre-created for each container in the cluster.
[0056] According to an embodiment of the present disclosure, the second preset period represents a time period for communication using the container communication information recorded in the first preset period. The second preset period is located after the first preset period. The second data packet represents the data packet for communication between containers in the second preset period, that is, the communication traffic. In response to the second data packet detected in the second preset period, the source address or the destination address can be determined from the header information of the second data packet by parsing the second data packet, and the corresponding container communication information can be queried in multiple information linked lists based on the source address or the destination address.
[0057] According to an embodiment of the present disclosure, the first query result is used to feedback the query result. In the case where the container communication information corresponding to the source address or the destination address is found in the information linked list, the first query result may include the feedback of the queried container communication information; in the case where the container communication information corresponding to the source address or the destination address cannot be found in the information linked list, the first query result may include an identifier indicating that the corresponding information has not been found.
[0058] According to an embodiment of the present disclosure, when the first query result representation information linked list includes container communication information, the second data packet is sent to the destination container according to the header information of the second data packet. Specifically, the second data packet can be sent through the firewall to reach the BGP router, and the BGP router uses the "next hop" address in the routing table to determine the destination MAC address, so that the frame encapsulated by the second data packet will reach the next router. After passing through one or more routes, the second data packet can reach another host machine through the network, that is, the host machine represented by the destination address.
[0059] According to an embodiment of the present disclosure, the host receiving the second data packet will parse the data frame, and search for the container of the destination port to which the second data packet is sent through the components for network proxy and traffic forwarding, so that the container of the destination port receives the second data packet.
[0060] According to an embodiment of the present disclosure, in a cloud environment, each container in a cluster is assigned a cluster node when it is started normally. In a first preset period, the detected first data packet is parsed to obtain the header information of the first data packet, and the container communication information is determined based on the header information of the first data packet, and the information chain table corresponding to the container address is determined in the hash chain table according to the container address of the container communication information, and the container communication information is stored in the information chain table, so as to facilitate the processing of the second preset period of the container communication scenario with high traffic in the cloud environment, and the container communication information corresponding to the header information of the second data packet is searched in the hash chain table according to the detection of the second data packet. In the case of finding the corresponding container communication information, the second data packet is sent to the destination container according to the header information of the second data packet. The operation in the first preset period does not need to rely on other network components or plug-ins, and has high universality for different clusters; and by detecting cluster container communication in real time, the first data packet is converted into container communication information, which is a dynamic management solution, and does not need to predict a large amount of container information in advance, and has high adaptability and flexibility.
[0061] In addition, the present disclosure only identifies the first data packet of the communication between containers in the first preset time period to generate container communication information, and manages it through a hash linked list, which has the characteristics of non-intrusiveness, fast access speed, and high search accuracy for the communication between containers in the cluster.
[0062] According to an embodiment of the present disclosure, the high-traffic container secure communication management method further includes: in response to detecting a third data packet in a second preset time period, querying the target container communication information in multiple information linked lists according to the header information of the third data packet to obtain a second query result; when the second query result indicates that the information linked list does not include the target container communication information, restricting the transmission of the third data packet.
[0063] According to an embodiment of the present disclosure, in response to a third data packet detected during a second preset time period, the third data packet can be parsed to determine a source address or a destination address from header information of the third data packet, and based on the source address or the destination address, corresponding container communication information is queried in multiple information linked lists to obtain a second query result.
[0064] According to an embodiment of the present disclosure, the target container communication information represents the container communication information corresponding to the header information of the third data packet, that is, the communication protocol, source address, destination address, source port, and destination port included in the header information of the third data packet are the same as the communication protocol, source address, destination address, source port, and destination port included in the target container communication information. In the case where the second query result represents that the information linked list does not include the target container communication information, the transmission of the third data packet is restricted. The transmission of the third data packet can be restricted by discarding the third data packet.
[0065] According to an embodiment of the present disclosure, the first preset period learns the correlation of cluster communication traffic by active learning to store multiple container communication information in a hash linked list. The target container communication information corresponding to the header information of the third data packet is searched from the multiple container communication information stored in the hash linked list. If the target container communication information does not exist in the hash linked list, the sending of the third data packet is restricted, thereby isolating the network traffic between containers, restricting the access to the containers, and ensuring the security of the cluster network.
[0066] According to an embodiment of the present disclosure, the high-traffic container secure communication management method further includes: each container communication information in each information linked list includes an information heat value. When the index position corresponding to the container address is determined from the hash linked list, in the information linked list identified by the index position, it is determined whether there is information stored in the information linked list that is identical to the container communication information obtained based on the first data packet; when there is information that is identical to the container communication information obtained based on the first data packet, the heat value of the container communication information is increased.
[0067] According to an embodiment of the present disclosure, the high-traffic container secure communication management method further includes: for each information linked list, sorting multiple container communication information according to information heat values of the multiple container communication information, wherein the information heat value is related to the number of times the container communication information is queried from the information linked list.
[0068] According to an embodiment of the present disclosure, the information heat value is the weight of the container communication information, and the information heat value may be in numerical form. A larger information heat value indicates that the container communication information is accessed more frequently, and based on the information heat value of the container communication information, each container communication information in the information linked list is sorted so that the information heat value of the container communication information can be referenced in the second time period.
[0069] According to an embodiment of the present disclosure, multiple container communication information is sorted according to their information heat values, thereby improving data query efficiency and managing the traffic of each container in a high-traffic cloud environment.
[0070] According to an embodiment of the present disclosure, the high-traffic container secure communication management method further includes: in response to detecting a second data packet in a second preset time period, increasing the information heat value of the target container communication information according to a preset increment value, so that in a subsequent search process, the target container communication information can be found in a shorter time.
[0071] According to an embodiment of the present disclosure, in response to detecting a second data packet in a second preset time period, container communication information is queried in multiple information linked lists according to header information of the second data packet to obtain a first query result. When the first query result indicates that the information linked list includes container communication information, the second data packet is sent to a destination container according to the header information of the second data packet, and the information heat value of the target container communication information is increased according to a preset incremental value.
[0072] According to an embodiment of the present disclosure, the information heat value of the container communication information corresponding to the second data packet is increased, and each operation of querying the container communication information will increase the information heat value of the container communication information. The container communication data is separated into cold and hot data by the information heat value of the container communication information, thereby improving the retrieval speed.
[0073] According to an embodiment of the present disclosure, determining an index position corresponding to a container address from a hash linked list includes: searching an association table for a target hash value corresponding to the container address, wherein the association table includes a plurality of container addresses and hash values corresponding to each of the plurality of container addresses; and modulo the target hash value using a preset load factor to obtain the index position.
[0074] According to an embodiment of the present disclosure, the association table is used to store hash values corresponding to each container address, and the target hash value represents the hash value corresponding to the container address. The target hash value corresponding to the container address is searched in the association table, and the target hash value is modulo the preset load factor to determine the head address of the information linked list corresponding to the container address, that is, the index position.
[0075] Figure 3 A schematic diagram of a hash linked list according to an embodiment of the present disclosure is schematically shown.
[0076] like Figure 3 As shown, the cluster includes nodes 1, 2, and 3, and one or more containers are running in each node, wherein containers A, B, and C are running on node 1, container D is running on node 2, and containers E and F are running on node 3. The information linked list of container A includes container communication strategy a1 and container communication strategy a2; the information linked list of container B includes container communication strategy b1; the information linked list of container C includes container communication strategy c1 and container communication strategy c2. The information linked list of container D includes container communication strategy d1. The information linked list of container E includes container communication strategy e1; the information linked list of container F includes container communication strategy f1 and container communication strategy f2.
[0077] Each container of each node may include an information linked list corresponding thereto. A node is a physical machine where one or more abstract containers run. When the first data packet sent by a cluster container is detected in a first preset time period, a hash value corresponding to the container address is used as an identification object. In the hash linked list of the corresponding node, an information linked list corresponding to the container identifier is searched. By using the node as the basic unit for creating the hash linked list, the spatiality of traffic data can be utilized to improve the query efficiency of container communication information.
[0078] According to an embodiment of the present disclosure, the plurality of container communication information is sorted according to information heat values of the plurality of container communication information, including: adjusting positions of the plurality of container communication information in the information linked list according to the information heat values so that the container communication information with a larger information heat value is close to the head of the information linked list.
[0079] According to an embodiment of the present disclosure, based on the fact that the container communication information is indexed by a hash linked list and the container communication information is stored in the information linked list, in the process of searching for the container communication information, the search is generally started from the head of the information linked list, and the positions of multiple container communication information in the information linked list are adjusted according to the information heat value, and the container communication information with a larger information heat value is migrated to a position close to the head of the information linked list, or the pointers between the container communication information are adjusted to adjust the position of the container communication information in the information linked list.
[0080] According to the embodiments of the present disclosure, container communication information with high information heat value is hot data and is adjusted to the head of the information linked list; container communication information with low information heat value is cold data and sinks to the bottom of the linked list. In the case where two container communication information have the same information heat value, they can be sorted based on the time when the container communication information was inserted. Specifically, this can be achieved by swapping two container communication information with the same information heat value, so that the container communication information with a later insertion time floats up and the container communication information with an earlier insertion time sinks, so as to improve the efficiency of querying container communication information based on the principle that the recently accessed or inserted data is more likely to be accessed again in the near future.
[0081] According to an embodiment of the present disclosure, the positions of multiple container communication information in the information linked list are adjusted according to the information heat value so that the container communication information with a larger information heat value is close to the head of the information linked list. In the process of determining the index position corresponding to the container address from the hash linked list in the first preset time period or the second preset time period, the query efficiency can be improved, and in a high-traffic cloud environment, the communication traffic between containers can be flexibly managed.
[0082] According to an embodiment of the present disclosure, the target hash value is obtained by processing a hash seed and a container name corresponding to the container address using a hash algorithm.
[0083] According to an embodiment of the present disclosure, the system time can be obtained as a hash seed, and the container name corresponding to the container address can be hashed using a hash algorithm and a hash seed to obtain a target hash value corresponding to the container address. By using the hash seed and the hash name corresponding to the container address for hashing, hash collisions in the hash list can be reduced, and the hashability of the hash list can be improved, so that each container in the cluster has sufficient storage space. Using the system time as a hash seed can enhance the randomness of the target hash value and avoid hash conflicts caused by the same container name for different container addresses.
[0084] According to the embodiments of the present disclosure, the load factor can be set to an integer power of 2, and the information linked list corresponding to the container address is obtained by taking the modulus of the hash value and the load factor, and the generated hash conflict can be resolved by the chain address method. Specifically, an array with a fixed length of 8 can be designed, and the upper 8 bits of the hash value are used as the array storage subscript. Each array stores up to 8 key-value pairs. When the key-value pairs stored in each array reach 8, a pointer will point to a new array, thereby forming an information linked list. There may be multiple container communication information corresponding to a container. An index pointer is created below the container name hash table to link a single linked list storing container communication information.
[0085] According to the embodiments of the present disclosure, when it is necessary to delete the container communication information, the location of the information linked list in the node data page where the container communication information is located can be queried and then the data corresponding to the information linked list can be deleted to implement the operation of deleting the container communication information. Deleting a node from a dynamic linked list does not actually erase it from the memory, but separates it from the information linked list. It only needs to cancel the original link relationship. This operation is mainly completed through pointers.
[0086] According to an embodiment of the present disclosure, when it is necessary to update the container communication information, the location of the information linked list in the node data page where the container communication information is located can be located by querying. After the pointer traverses and queries the location where the data needs to be modified in the information linked list, the memory data corresponding to the pointer is modified by taking the address, thereby realizing the update of the container communication information in the model.
[0087] Based on the above high-flow container secure communication management method, the present disclosure also provides a high-flow container secure communication management device. Figure 4 The device is described in detail.
[0088] Figure 4 The structure block diagram of a high-traffic container secure communication management device according to an embodiment of the present disclosure is schematically shown.
[0089] like Figure 4As shown, the high-traffic container secure communication management device 400 of this embodiment includes a first determination module 410, a second determination module 420, an index determination module 430, a storage module 440, a query module 450 and a sending module 460.
[0090] The first determination module 410 is used to parse the first data packet detected in the first preset time period to obtain the header information of the first data packet. In one embodiment, the first determination module 410 can be used to perform the operation S210 described above, which will not be repeated here.
[0091] The second determination module 420 is used to determine container communication information for inter-container communication from the header information of the first data packet, wherein the container communication information includes a container address. In one embodiment, the second determination module 420 can be used to perform the operation S220 described above, which will not be repeated here.
[0092] The index determination module 430 is used to determine the index position corresponding to the container address from the hash linked list, wherein each index position corresponds to an information linked list. In one embodiment, the index determination module 430 can be used to perform the operation S230 described above, which will not be repeated here.
[0093] The storage module 440 is used to store the container communication information in the information linked list according to the index position. In one embodiment, the storage module 440 can be used to perform the operation S240 described above, which will not be described in detail here.
[0094] The query module 450 is configured to query the container communication information in a plurality of information linked lists according to the header information of the second data packet in response to detecting the second data packet in the second preset time period, and obtain a first query result, wherein the second preset time period is after the first preset time period. In one embodiment, the query module 450 can be used to perform the operation S250 described above, which will not be described in detail herein.
[0095] The sending module 460 is used to send the second data packet to the destination container according to the header information of the second data packet when the first query result representation information linked list includes the container communication information. In one embodiment, the sending module 460 can be used to perform the operation S260 described above, which will not be repeated here.
[0096] According to an embodiment of the present disclosure, the high-traffic container secure communication management device 400 further includes: a result determination module and a transmission restriction module.
[0097] The result determination module is used to query the target container communication information in multiple information linked lists according to the header information of the third data packet in response to detecting the third data packet in the second preset time period to obtain a second query result.
[0098] The transmission restriction module is used to restrict the transmission of the third data packet when the second query result representation information linked list does not include the target container communication information.
[0099] According to an embodiment of the present disclosure, the high-traffic container secure communication management device 400 further includes: a sorting module.
[0100] The sorting module is used to sort the multiple container communication information according to the information heat values of the multiple container communication information for each information chain list, wherein the information heat value is related to the number of times the container communication information is queried from the information chain list.
[0101] According to an embodiment of the present disclosure, the sorting module includes: a sorting unit.
[0102] The sorting unit is used to adjust the positions of the plurality of container communication information in the information linked list according to the information heat value, so that the container communication information with a larger information heat value is close to the head of the information linked list.
[0103] According to an embodiment of the present disclosure, the high-traffic container secure communication management device 400 further includes: a heat increase module.
[0104] The heat increasing module is used to increase the information heat value of the target container communication information according to a preset increment value in response to detecting the second data packet in the second preset time period, so that the target container communication information can be found in a shorter time during the subsequent search process.
[0105] According to an embodiment of the present disclosure, the index determination module 430 includes: a search unit and an index determination unit.
[0106] The search unit is used to search for a target hash value corresponding to the container address in the association table, wherein the association table includes multiple container addresses and hash values corresponding to each of the multiple container addresses.
[0107] The index determination unit is used to obtain the index position by modulo the target hash value using a preset load factor.
[0108] According to an embodiment of the present disclosure, the target hash value is obtained by processing a hash seed and a container name corresponding to the container address using a hash algorithm.
[0109] According to an embodiment of the present disclosure, any multiple modules of the first determination module 410, the second determination module 420, the index determination module 430, the storage module 440, the query module 450 and the sending module 460 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the first determination module 410, the second determination module 420, the index determination module 430, the storage module 440, the query module 450 and the sending module 460 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in a suitable combination of any of them. Alternatively, at least one of the first determination module 410, the second determination module 420, the index determination module 430, the storage module 440, the query module 450 and the sending module 460 can be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function can be performed.
[0110] Figure 5 A block diagram of an electronic device suitable for implementing a high-traffic container secure communication management method according to an embodiment of the present disclosure is schematically shown.
[0111] like Figure 5 As shown, the electronic device 500 according to an embodiment of the present disclosure includes a processor 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 to a random access memory (RAM) 503. The processor 501 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 501 may also include an onboard memory for caching purposes. The processor 501 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.
[0112] In RAM 503, various programs and data required for the operation of electronic device 500 are stored. Processor 501, ROM 502 and RAM 503 are connected to each other via bus 504. Processor 501 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 502 and / or RAM 503. It should be noted that the program can also be stored in one or more memories other than ROM 502 and RAM 503. Processor 501 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.
[0113] According to an embodiment of the present disclosure, the electronic device 500 may further include an input / output (I / O) interface 505, which is also connected to the bus 504. The electronic device 500 may further include one or more of the following components connected to the input / output (I / O) interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 508 including a hard disk, etc.; and a communication portion 509 including a network interface card such as a LAN card, a modem, etc. The communication portion 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the input / output (I / O) interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage portion 508 as needed.
[0114] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.
[0115] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 502 and / or RAM 503 described above and / or one or more memories other than ROM 502 and RAM 503.
[0116] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program includes a program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the high-traffic container secure communication management method provided by the embodiment of the present disclosure.
[0117] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 501. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.
[0118] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 509, and / or installed from the removable medium 511. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.
[0119] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the processor 501, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.
[0120] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).
[0121] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.
[0122] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.
[0123] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.
Claims
1. A high-traffic container secure communication management method, characterized in that: The method comprises: Parsing a first data packet detected in a first preset time period to obtain header information of the first data packet; Determining container communication information used for inter-container communication from header information of the first data packet, wherein the container communication information includes a container address; Determine an index position corresponding to the container address from the hash linked list, wherein each index position corresponds to an information linked list; Storing the container communication information in the information linked list according to the index position; In response to detecting a second data packet in a second preset time period, querying the container communication information in the plurality of information linked lists according to header information of the second data packet to obtain a first query result, wherein the second preset time period is after the first preset time period; When the first query result indicates that the information linked list includes the container communication information, the second data packet is sent to the destination container according to the header information of the second data packet.
2. The method according to claim 1, characterized in that The method further comprises: In response to detecting a third data packet in a second preset time period, querying the target container communication information in the plurality of information linked lists according to the header information of the third data packet to obtain a second query result; When the second query result indicates that the information linked list does not include the target container communication information, transmission of the third data packet is restricted.
3. The method according to claim 1, characterized in that: The method further comprises: For each of the information linked lists, the plurality of container communication information are sorted according to information heat values of the plurality of container communication information, wherein the information heat value is related to the number of times the container communication information is queried from the information linked list.
4. The method according to claim 3, characterized in that The step of sorting the plurality of container communication information according to the information heat values of the plurality of container communication information comprises: The positions of the plurality of container communication information in the information linked list are adjusted according to the information heat values, so that the container communication information with a larger information heat value is close to the head of the information linked list.
5. The method according to claim 3, characterized in that: The method further comprises: In response to detecting the second data packet in a second preset time period, the information heat value of the target container communication information is increased according to a preset increment value, so that the target container communication information can be found in a shorter time during a subsequent search process.
6. The method according to claim 1, characterized in that Determining the index position corresponding to the container address from the hash linked list includes: Searching for a target hash value corresponding to the container address in an association table, wherein the association table includes a plurality of container addresses and hash values corresponding to each of the plurality of container addresses; and The target hash value is modulo a preset load factor to obtain the index position.
7. The method according to claim 5, characterized in that The target hash value is obtained by processing a hash seed and a container name corresponding to the container address using a hash algorithm.
8. A high-flow container security communication management device, characterized in that: The device comprises: A first determining module, configured to parse a first data packet detected in a first preset time period to obtain header information of the first data packet; a second determining module, configured to determine container communication information used for inter-container communication from header information of the first data packet, wherein the container communication information includes a container address; An index determination module, used to determine an index position corresponding to the container address from a hash linked list, wherein each index position corresponds to an information linked list; A storage module, used for storing the container communication information into the information linked list according to the index position; A query module, configured to query the container communication information in the plurality of information linked lists according to header information of the second data packet in response to detecting the second data packet in a second preset time period, to obtain a first query result, wherein the second preset time period is after the first preset time period; A sending module is used to send the second data packet to a destination container according to header information of the second data packet when the first query result indicates that the information linked list includes the container communication information.
9. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.
10. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.