Fault detection method and device and electronic equipment

Abstract

The invention discloses a fault detection method and apparatus, and an electronic device. The method comprises the steps of determining whether an exit network card of a to-be-detected security service instance detects a detection data packet; if not, determining that the to-be-detected security service instance has a fault; and if yes, determining that the to-be-detected security service instance does not have a fault, thereby realizing fault detection of the security service instance in the service chain, and solving the problem that fault detection of the security service instance is not supported in the service chain.

Description

Technical Field

[0001] The present application relates to the field of computer network technology, and in particular to a fault detection method, device and electronic equipment. Background Art

[0002] At present, the node forwarding of the Openstack gateway security service function chain (i.e. service chain) is as follows Figure 1 As shown. First, the message is imported into the first security service instance through the first service chain orchestration module. The message is processed by the first security service instance. The message processed by the first security service instance is then submitted to the second service chain orchestration module so that the second service chain orchestration module processes the message. Finally, the message processed by the second service chain orchestration module is introduced into the second security service instance so that the second security service instance processes the message.

[0003] However, in the above process, the service chain orchestration module (such as the first service chain orchestration module and the second service chain orchestration module) lacks fault detection for the security service instances (such as the first security service instance and the second security service instance) in the service chain, and thus cannot promptly discover when a security service instance fails, leading to problems such as message loss, network failure, and business interruption. Summary of the invention

[0004] The present application provides a fault detection method, device and electronic device to solve the problem of lack of fault detection of security service instances in the service chain. The specific implementation scheme is as follows:

[0005] In a first aspect, the present application provides a fault detection method, the method comprising:

[0006] Determine whether a detection data packet is detected at the egress network card of the security service instance to be detected; wherein the detection data packet is a data packet sent to the ingress network card of the security service instance to be detected;

[0007] If not, it is determined that the security service instance to be detected fails;

[0008] If so, it is determined that the security service instance to be detected has no failure.

[0009] Through the above-mentioned application embodiments, the egress network card of the security service instance to be detected determines whether the data packet sent to the ingress network card of the security service instance to be detected (i.e., the detection data packet) is detected, so that the state of the security service instance to be detected can be determined by detecting whether the data packet can be normally transmitted from the ingress network card of the security service instance to be detected to the egress network card, so as to determine whether the security service instance to be detected has a fault, thereby realizing fault detection of the security service instance to be detected, so as to timely discover the fault of the security service instance to be detected, so as to avoid problems such as message loss, network failure, and business interruption caused by untimely fault discovery of the security service instance.

[0010] In a possible implementation manner, before determining whether the egress network card of the security service instance to be detected detects the detection data packet, the method further includes:

[0011] Acquire the second information of the security service instance to be detected from the first information stored in the bypass function bypass management module; wherein the first information includes the information of the security service instance for which fault detection is required, and the second information includes at least the address of the inlet network card;

[0012] Generate the detection data packet corresponding to the security service instance to be detected according to the second information;

[0013] The detection data packet is sent to the ingress network card.

[0014] Through the above-mentioned application embodiment, the destination address in the generated data packet to be detected is the address of the entry network card of the security service instance to be detected, thereby ensuring the accuracy of the destination address in the data packet to be detected, so that based on this address, the detection data packet can be accurately sent to the entry network card of the security service instance to be detected.

[0015] In a possible implementation manner, before acquiring the second information of the security service instance to be detected from the first information stored in the bypass function bypass management module, the method further includes:

[0016] Receiving, through the management port, the first information of the security service instance that needs to be detected for faults and the status information of the security service instance that needs to be detected for faults; wherein the status information includes the device status of the corresponding security service instance;

[0017] In the bypass management module, the first information and the status information are stored.

[0018] Through the above application embodiment, the bypass management module stores the first information of the security service instance that needs to be detected for faults and its corresponding status information, so that when generating a detection data packet, the required information can be directly obtained from the first information in the bypass management module, thereby speeding up the generation efficiency of the detection data packet. In addition, the bypass management module also stores the status information of the security service instance that needs to be detected for faults, so that the fault status of the security instance to be detected before the current moment can be accurately learned later.

[0019] In a possible implementation manner, sending the detection data packet to the ingress network card includes:

[0020] The detection data packet is sent to the ingress network card at intervals of a first time length.

[0021] Through the above-mentioned application embodiment, a detection data packet is sent to the entry network card of the security service instance to be detected every first time period, so that whether the security service instance to be detected has a fault is detected once every first time period, thereby realizing automatic detection and real-time detection of whether the security service instance to be detected has a fault, further ensuring that it can be discovered in time when a fault occurs in the security service instance to be detected.

[0022] In a possible implementation manner, if not, determining that the security service instance to be detected has a fault includes:

[0023] At the egress network card, if the detection data packet is not detected within a second time period, it is determined that a fault occurs in the security service instance to be detected; wherein the second time period is greater than a lower time period threshold and less than an upper time period threshold.

[0024] Through the above application embodiment, if the detection data packet is not detected in the egress network card within the second duration, it can be determined that the security service instance to be detected has a fault. In addition, through the limitation of the second duration, it is avoided that the message transmission time is too long due to excessive time waste in the fault detection process of the security service instance to be detected, thereby avoiding the reduction of the message transmission efficiency. In addition, through the limitation of the second duration, it is also possible to avoid the inaccurate judgment result caused by the waiting time being too short in the process of judging whether the detection data packet is detected, thereby further improving the accuracy of the judgment result.

[0025] In a possible implementation manner, after determining that the security service instance to be detected fails, the method further includes:

[0026] The message sent by the first service chain orchestration module to the security service instance to be detected is directly sent to the second service chain orchestration module through the forwarding module in the bypass; and

[0027] If it is determined that the status information of the security service instance to be detected in the bypass management module indicates that the device status of the security service instance to be detected is normal, the status information of the security service instance to be detected is modified to information indicating that the device status of the security service instance to be detected is a faulty state.

[0028] Through the above application embodiments, it is ensured that when the security service instance to be detected fails, the normal transmission of the message can still be maintained, thereby avoiding the problems of message loss, network failure, business interruption, etc. caused by the failure of the security service instance. In addition, by correcting the state information of the security service instance to be detected stored in the bypass management module, the state information of the security service instance to be detected stored in the bypass management module can be completely matched with the currently detected state, thereby ensuring the correctness of the state information of the security service instance to be detected stored in the bypass management module.

[0029] In a possible implementation manner, after determining that the security service instance to be detected has no fault, the method further includes:

[0030] Sending the message sent by the first service chain orchestration module to the security service instance to be detected to the second service chain orchestration module through the egress network card of the security service instance; and

[0031] If it is determined that the status information of the security service instance to be detected in the bypass management module indicates that the device status of the security service instance to be detected is a faulty state, the status information of the security service instance to be detected is modified to information indicating that the device status of the security service instance to be detected is a normal state.

[0032] Through the above application embodiment, the normal transmission of the message is guaranteed. In addition, by correcting the status information of the security service instance to be detected stored in the bypass management module, the status information of the security service instance to be detected stored in the bypass management module can be completely matched with the currently detected status, further ensuring the correctness of the status information of the security service instance to be detected stored in the bypass management module.

[0033] In a second aspect, the present application also provides a fault detection device, comprising:

[0034] A processing module, used to determine whether a detection data packet is detected at the egress network card of the security service instance to be detected; wherein the detection data packet is a data packet sent to the ingress network card of the security service instance to be detected;

[0035] If not, it is determined that the security service instance to be detected fails;

[0036] If so, it is determined that the security service instance to be detected has no failure.

[0037] In a possible implementation, the processing module is specifically used to obtain second information of the security service instance to be detected from the first information stored in the bypass function bypass management module; wherein the first information includes information of the security service instance that needs to be fault detected, and the second information includes at least the address of the entry network card; based on the second information, generate the detection data packet corresponding to the security service instance to be detected; and send the detection data packet to the entry network card.

[0038] In a possible implementation, the processing module is also used to receive, through a management port, the first information of a security service instance that requires fault detection and status information of a security service instance that requires fault detection; wherein the status information includes a device status of a corresponding security service instance; and in the bypass management module, the first information and the status information are stored.

[0039] In a possible implementation manner, the processing module is further configured to send the detection data packet to the ingress network card at intervals of a first time length.

[0040] In a possible implementation, the processing module is also used to determine, at the egress network card, that a fault has occurred in the security service instance to be detected if the detection data packet is not detected within a second time period; wherein the second time period is greater than a lower time period threshold and less than an upper time period threshold.

[0041] In a possible implementation, the processing module is further used to send the message sent by the first service chain orchestration module to the security service instance to be detected directly to the second service chain orchestration module through the forwarding module in the bypass; and if it is determined that the status information of the security service instance to be detected in the bypass management module indicates that the device status of the security service instance to be detected is normal, the status information of the security service instance to be detected is modified to information indicating that the device status of the security service instance to be detected is a faulty state.

[0042] In a possible implementation, the processing module is further used to send the message sent by the first service chain orchestration module to the security service instance to be detected to the second service chain orchestration module through the egress network card of the security service instance; and if it is determined that the status information of the security service instance to be detected in the bypass management module indicates that the device status of the security service instance to be detected is a fault state, the status information of the security service instance to be detected is modified to information indicating that the device status of the security service instance to be detected is a normal state.

[0043] In a third aspect, the present application provides an electronic device, including:

[0044] Memory, used to store computer programs;

[0045] The processor is used to implement the above-mentioned fault detection method steps when executing the computer program stored in the memory.

[0046] In a fourth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the above-mentioned fault detection method steps are implemented.

[0047] For each aspect from the second to the fourth aspect and the technical effects that may be achieved by each aspect, please refer to the above description of the technical effects that can be achieved by the first aspect or various possible schemes in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A schematic diagram of node forwarding of the Openstack gateway security service function chain provided in an embodiment of the present application;

[0049] Figure 2 A flowchart of a fault detection method provided in an embodiment of the present application;

[0050] Figure 3 A schematic diagram of the bypass module connection provided in the embodiment of the present application;

[0051] Figure 4 A schematic diagram of the processing process of the fault detection method provided in an embodiment of the present application;

[0052] Figure 5 A schematic diagram of a fault detection device provided in an embodiment of the present application;

[0053] Figure 6 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The specific operating methods in the method embodiments can also be applied to device embodiments or system embodiments. It should be noted that in the description of the present application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A is connected to B, which can represent: A is directly connected to B and A is connected to B through C. In addition, in the description of the present application, words such as "first" and "second" are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0055] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0056] Service Function Chaining (SFC) is a network service architecture and technology used to define and manage service function links in the network to implement specific data packet processing flows. In SFC, data packets are processed through a series of service function nodes in a predefined service function link sequence, thereby achieving flexible deployment and traffic control of network services. Among them, a series of service function nodes may include nodes of the service chain orchestration module and nodes of security service instances. However, the service chain orchestration module lacks fault detection for security service instances, and thus cannot detect faults in security service instances in a timely manner, leading to problems such as message loss, network failure, and service interruption.

[0057] Therefore, the present application proposes a fault detection method, which determines whether a fault occurs in the security service instance to be detected by determining whether the egress network card of the security service instance to be detected detects a data packet (i.e., a detection data packet) sent to the ingress network card of the security service instance to be detected, thereby realizing fault detection of the security service instance, so as to timely discover the fault of the security service instance, and avoid problems such as message loss, network failure, and business interruption caused by untimely fault discovery of the security service instance.

[0058] The fault detection method proposed in this application can be applied to scenarios based on Openstack service function chains (i.e., service chains), but is not limited thereto. Thus, real-time fault detection and timely fault handling can be performed on security service instances on the service chain to ensure the normal forwarding of messages (or traffic), thereby ensuring the normal operation of the network. In addition, the fault detection method proposed in this application can be applied to all Openstack cluster deployment methods, such as distributed, single-node, and highly available deployment methods.

[0059] The above-mentioned Openstack is a cloud platform management project. The project is composed of multiple main components to complete some specific tasks, covering various aspects such as network, virtualization, operating system, server, etc.

[0060] Reference Figure 2 The figure is a flow chart of a method for fault detection provided by an embodiment of the present application, the method comprising:

[0061] S201, determining whether a detection data packet is detected at an egress network card of a security service instance to be detected.

[0062] The detection data packet is a data packet sent to the entry network card of the security service instance to be detected. In addition, the destination address in the detection data packet is the address of the entry network card of the security service instance to be detected. The destination address can be a destination media access control address (English: Media Access Control Address, abbreviated as MAC address), and the address of the entry network card can be the MAC address of the entry network card of the security service instance to be detected.

[0063] The above-mentioned security service instance to be detected is a security service instance that requires fault detection.

[0064] In the embodiments of the present application, a security service instance refers to a device that provides security services, which can be a virtual device or a physical device. For example, a security service instance is a network security device such as a firewall, World Wide Web (English: World Wide Web, abbreviated as Web) application protection, intrusion protection, etc.

[0065] In a security service instance, there are usually two service network cards for message processing (or traffic processing), and the two service network cards are an ingress network card and an egress network card.

[0066] Before determining whether the detection data packet is detected at the egress network card of the security service instance to be detected, the detection data packet is first sent to the ingress network card of the security service instance to be detected.

[0067] Before sending the detection data packet to the ingress network card of the security service instance to be detected, the detection data packet needs to be generated first.

[0068] In an embodiment of the present application, a detection data packet corresponding to the security service instance to be detected can be generated based on the second information of the security service instance to be detected, and the second information at least includes the address of the entry network card of the security service instance to be detected (such as the MAC address of the entry network card), so that the destination address in the generated data packet to be detected is the address of the entry network card of the security service instance to be detected, thereby ensuring the accuracy of the destination address in the data packet to be detected, so that based on the address, the detection data packet can be accurately sent to the entry network card of the security service instance to be detected.

[0069] The second information may also include information indicating that the security service instance to be detected needs to be fault detected, so as to quickly and accurately find the security service instance that needs to be fault detected (i.e., the security service instance to be detected), but is not limited to this and can be adjusted according to the specific application scenario.

[0070] The second information can be obtained from the first information stored in the bypass function (bypass) management module. The first information includes information about the security service instance that needs to be detected for faults.

[0071] Therefore, before sending the detection data packet to the inlet network card of the security service instance to be detected, or before generating the data packet to be detected according to the second information of the data packet to be detected, the first information of the security service instance that needs to be detected (the security service instance that needs to be detected includes the aforementioned security instance to be detected) and the status information of the security service instance that needs to be detected are received through the management port, and then the first information and the status information are stored in the bypass management module, so that when generating the detection data packet, the required second information can be directly obtained from the first information in the bypass management module, thereby speeding up the generation efficiency of the detection data packet. In addition, the status information of the security service instance that needs to be detected is stored in the bypass management module, so as to quickly and accurately learn the fault status of the security service instance before the current moment.

[0072] Further, after generating a detection data packet corresponding to the security service instance to be detected, the detection data packet is sent to the ingress network port of the security service instance to be detected, so as to perform fault detection on the security service instance to be detected.

[0073] In order to achieve automatic real-time detection of faults in the security service instance to be detected, a detection data packet can be sent to the inlet network card of the security service instance to be detected at every first time interval, that is, a detection data packet is sent once at every first time interval, so that it is possible to detect whether the security service instance to be detected has a fault once every first time interval, thereby achieving automatic and real-time detection of whether the security service instance to be detected has a fault, further ensuring that a fault in the security service instance to be detected can be discovered in time.

[0074] The first duration may be 1 second (s), or 2 seconds, but is not limited thereto. The specific value of the first duration may be flexibly adjusted according to specific application scenarios.

[0075] After sending the detection data packet to the ingress network port of the security service instance to be detected, it can be determined whether the detection data packet is detected at the egress network card of the security service instance to be detected, that is, the above-mentioned step S201 is executed to determine whether the detection data packet can flow normally between the ingress network card and the egress network card of the security service instance to be detected, so that it can be determined whether the security service instance to be detected has a fault based on the detection result, and then fault detection of the security service instance to be detected can be realized.

[0076] Specifically, if the detection data packet is not detected at the egress network card, step S202 is executed.

[0077] If the detection data packet is detected at the egress network card, step S203 is executed.

[0078] Optionally, if the detection data packet is not received at the egress network card, step S202 is executed. Alternatively, if the detection data packet is not detected within the second time period at the egress network card, step S202 is executed. The second time period is between the lower time period threshold and the upper time period threshold, and the lower time period threshold is less than the upper time period threshold. Thus, by limiting the second time period, it is avoided that the message transmission time is too long due to excessive time waste in the fault detection process of the security service instance to be detected, thereby avoiding a reduction in the message transmission efficiency; it is also possible to avoid inaccurate judgment results caused by too short waiting time in the process of judging whether the detection data packet is detected, thereby further improving the accuracy of the judgment results.

[0079] In addition, in the process of determining whether the detection data packet is detected at the egress network card of the security service instance to be detected, the message sent by the first service chain orchestration module to the security service instance to be detected can also be intercepted at the egress network card, so that the security service instance to be detected cannot send the message immediately, so as to temporarily prohibit the message from flowing out of the egress network card of the security service instance to be detected before determining whether the security service instance to be detected has a fault, which helps to avoid various problems caused by the failure of the security service instance to be detected. In addition, since the message is a message sent by the first service chain orchestration module to the security service instance to be detected, the fault detection process of the security service instance to be detected is performed during the process of the first service orchestration module sending the message to the security service instance to be detected, thereby making the fault detection of the security service instance implemented the fault detection of the security service instance in the service chain.

[0080] In an embodiment of the present application, the service chain orchestration module (such as the first service chain orchestration module and the second service chain orchestration module) can be a native traffic orchestration module of openstack, but can be adjusted according to the specific openstack, so that the message processing performed by the service chain orchestration module enables the message to be transmitted normally. The service chain orchestration module can perform message orchestration (or traffic orchestration) of the virtual machine through Openvswitch. The Openvswitch is an open source multi-layer virtual switch that aims to achieve large-scale network automation through programming extension.

[0081] S202: Determine that a fault occurs in the security service instance to be detected.

[0082] When the egress network card of the security service instance to be detected does not detect the detection data packet (or when the egress network card does not detect the detection data packet within the second time period), it means that the security service instance to be detected fails. At this time, the message is sent to the second service chain orchestration module through the forwarding module in the bypass, and the message is not sent to the second service chain orchestration module through the security service instance to be detected, so that when the security service instance to be detected fails, the normal transmission of the message can still be maintained, thereby avoiding problems such as message loss, network failure, and service interruption caused by the failure of the security service instance (such as the security service instance to be detected).

[0083] In the embodiment of the present application, the first service chain orchestration module and the second service chain orchestration module may be the same service chain orchestration module or different service chain orchestration modules, and may be adjusted according to specific application scenarios.

[0084] The forwarding module in the above-mentioned bypass may be a forwarding module in the bypass function module in the bypass. In addition to the bypass function module, the bypass may also include the aforementioned bypass management module. The bypass can bypass the message (or traffic) from passing through the failed device (such as bypassing the failed security service instance to be detected and directly sending the message to the second service chain orchestration module) after a network security device (such as a security service instance) fails (such as a power outage or a crash), thereby ensuring the normal operation of the network.

[0085] Optionally, after determining that a fault has occurred in the security service instance to be detected, the status information of the security service instance to be detected stored in the bypass management module may be corrected to ensure that the status information of the security service instance to be detected stored in the bypass management module is completely matched with the currently detected status, thereby ensuring the correctness of the status information stored in the bypass management module.

[0086] Specifically, it is detected whether the status information of the security service instance to be detected stored in the bypass management module indicates that the device status of the security service instance to be detected is a fault status.

[0087] If it is determined that the status information of the security service instance to be detected stored in the bypass management module does not indicate that the device status of the security service instance to be detected is a fault state, that is, the status information of the security service instance to be detected stored in the bypass management module indicates that the device status of the security service instance to be detected is a normal state, then the status information of the security service instance to be detected stored in the bypass management module is modified to information indicating that the device status of the security service instance to be detected is a fault state.

[0088] If it is determined that the status information of the security service instance to be detected stored in the bypass management module indicates that the device status of the security service instance to be detected is a faulty status, there is no need to revise the status information.

[0089] In addition, since the detection data packet can be sent once every first time interval, after executing step S202, step S201 can be continued to be executed, thereby realizing automatic detection of fault detection of the security service instance to be detected.

[0090] S203: Determine that the security service instance to be detected has no fault.

[0091] When the detection data packet is detected at the egress network card of the security service instance to be detected, it means that the security service instance to be detected is normal. At this time, the message is directly sent to the second service chain orchestration module through the egress network card of the security service instance to be detected, that is, the message intercepted by the egress network card of the security service instance to be detected is released, so that the message can be transmitted normally, and the integrity of the fault detection method is guaranteed. In addition, since the security service instance to be detected can also perform security detection on the message, it is easy to determine whether there is a malicious message in the message, thereby also ensuring the security of the entire service chain process.

[0092] Optionally, after determining that the security service instance to be detected is normal, the status information of the security service instance to be detected stored in the bypass management module can also be corrected to further ensure that the status information of the security service instance to be detected stored in the bypass management module can completely match the currently detected status, thereby further ensuring the correctness of the status information stored in the bypass management module.

[0093] Specifically, it is detected whether the status information of the security service instance to be detected stored in the bypass management module indicates that the device status of the security service instance to be detected is a normal status.

[0094] If it is determined that the status information of the security service instance to be detected stored in the bypass management module does not indicate that the device status of the security service instance to be detected is in a normal state, that is, the status information of the security service instance to be detected stored in the bypass management module indicates that the device status of the security service instance to be detected is in a fault state, then the status information of the security service instance to be detected stored in the bypass management module is modified to information indicating that the device status of the security service instance to be detected is in a normal state.

[0095] If it is determined that the status information of the security service instance to be detected stored in the bypass management module indicates that the device status of the security service instance to be detected is normal, there is no need to revise the status information.

[0096] In addition, since the detection data packet can be sent once every first time interval, after executing step S203, step S201 can also be continued to be executed, so as to realize automatic detection of the security service instance to be detected.

[0097] In summary, the fault detection method proposed in the present application, between the first service chain orchestration module and the security service instance to be detected, sends the generated detection data packet to the inlet network card of the security service instance to be detected, and at the same time detects in real time at the outlet network card of the security service instance to be detected whether the detection data packet is received, so as to quickly determine the running status of the security service instance to be detected (that is, whether a fault occurs), and perform different processing for different states of the security service instance to be detected (that is, whether a fault occurs or not).

[0098] Then, when it is determined that the security service instance to be detected has not failed, the message is sent to the second service chain orchestration module directly through the export network card of the security service instance to be detected; when it is determined that the security service instance to be detected has failed, the message is sent to the second service chain orchestration module through the forwarding module in the bypass, so that when the security service instance to be detected fails, the normal transmission of the message can still be guaranteed, thereby solving the problems of message loss, network failure, business interruption, etc. caused by the failure of the security service instance to be detected. In addition, when the fault detection method proposed in the embodiment of the present application is applied to the scenario of the Openstack service chain, the problem that the current Openstack service chain does not support fault detection and bypass capabilities is solved.

[0099] In addition, in the embodiment of the present application, the aforementioned steps S201-S203 can be performed by bypass, that is, a bypass module is inserted between the first service chain orchestration module and the security service instance to be detected, so as to perform fault detection on the security service instance to be detected by the bypass module.

[0100] like Figure 3 As shown, a bypass module is inserted between the first service chain orchestration module and the first security service instance to be detected, and a bypass module is inserted between the second service chain orchestration module and the second security service instance to be detected, so that the bypass module can be used to detect whether the first security service instance to be detected and the second security service instance to be detected have faults, and different processing is performed for different detection results.

[0101] Specifically, the message is imported into the bypass module through the first service chain orchestration module, and the bypass module determines whether it is necessary to introduce the message into the first security service instance to be detected based on the detected device status of the first security service instance to be detected (such as the first security service instance to be detected appears or the first security service instance to be detected has not failed).

[0102] If not necessary, the message is directly introduced into the second service chain orchestration module for processing, without introducing the message into the second service chain orchestration module for processing through the first security service instance to be detected, and then repeating the corresponding operation.

[0103] If necessary, the message is introduced into the first security service instance to be detected for processing; the message is then submitted to the second service chain orchestration module for processing through the first security service instance to be detected, and then the corresponding operations are repeated.

[0104] Among them, the processing process of the second service chain orchestration module, the bypass module, the second security service instance to be detected and the third service chain orchestration module is consistent with the processing process of the first service chain orchestration module, the bypass module, the first security service instance to be detected and the second service chain orchestration module, and will not be repeated here.

[0105] The bypass module determines whether it is necessary to introduce the message into the first security service instance to be detected according to the detected device status of the first security service instance to be detected (such as the first security service instance to be detected appears or the first security service instance to be detected has not failed), which is the above-mentioned step S201.

[0106] If the above is not necessary, the specific process of directly introducing the message into the second service chain orchestration module for processing without introducing the message into the second service chain orchestration module for processing through the first security service instance to be detected is the aforementioned step S202.

[0107] If necessary, the message is introduced into the first security service instance to be detected for processing; and then the specific process of submitting the message to the second service chain orchestration module for processing through the first security service instance to be detected is the aforementioned step S203.

[0108] The technical solution of this application is further explained below in conjunction with a specific application process.

[0109] like Figure 4 It is a schematic diagram of the processing process of the fault detection method, and the bypass module (ie bypass) includes a bypass management module and a bypass function module.

[0110] Through the management port, the configuration information (such as the first information) and status information of the security service instance provided by the administrator / external system (or external user) are sent to the bypass management module, so that the bypass management module can store the configuration information and status information of the security service instance for the bypass function module to perform data storage and query.

[0111] The bypass management module provides bypass management functions. It provides an interface to the outside to manage whether to provide bypass functions for security service instances, and stores the configuration information and status information of security service instances internally for data storage and query by the bypass function module. In addition, the bypass management module can also generate independent detection tasks for security service instances that need to be fault-detected based on the received information (such as configuration information and status information). The detection task is the fault detection of the security service instance to be detected (such as the first security service instance to be detected and the second security service instance to be detected).

[0112] Through the business port, the client access service message (or traffic) is introduced into the first service chain orchestration module of openstack. The introduction of the message can be achieved through the drainage node. The drainage node is provided by openstack to introduce the message (or traffic) outside the openstack cluster into the cluster, and the external Internet Protocol (English: Internet Protocol, abbreviated as IP) is provided to the external route to achieve the drainage of openstack.

[0113] In the first service chain arrangement module, the message is processed and then transmitted to the bypass function module so that the bypass function module can process the message. The bypass function module includes a forwarding module, a detection packet sending module and a detection packet detection module.

[0114] In the detection packet sending module in the bypass function module, the configuration information (such as the second information) of the first security service instance to be detected is obtained from the bypass management module, and then a detection data packet corresponding to the first security service instance to be detected is generated according to the configuration information of the first security service instance to be detected. The destination MAC address in the detection data packet is the MAC address of the entry network card (i.e., nic1) of the first security service instance to be detected. Then, every 1s (i.e., the first duration is 1s), the detection data packet is sent to nic1 of the first security service instance to be detected, that is, a detection data packet is sent every 1s.

[0115] In the detection packet detection module in the bypass function module, at the egress network card (i.e., nic2) of the first security service instance to be detected, the message of nic2 of the first security service instance to be detected is intercepted, and it is detected whether the received data packet contains the detection data packet sent by the detection packet sending module (i.e., it is determined whether the detection data packet is detected).

[0116] If no detection data packet is detected in nic2 within the second time period, it means that the first security service instance to be detected has a fault, then the bypass management module and the forwarding module in the bypass function module are notified that the first security service instance to be detected has a fault. If the status information of the first security service instance to be detected stored in the bypass management module indicates that the device status of the first security service instance to be detected is normal, the bypass management module modifies the status information of the first security service instance to be detected to information indicating that the device status of the first security service instance to be detected is a faulty state; if the status information of the first security service instance to be detected stored in the bypass management module indicates that the device status of the first security service instance to be detected is a faulty state, the bypass management module does not modify the status information of the first security service instance to be detected. In addition, the message is forwarded to the second service chain orchestration module through the forwarding module, so that the message does not pass through the first security service instance to be detected when it circulates to the second service chain orchestration module.

[0117] If the detection data packet is received on nic2, it means that the first security service instance to be detected is normal, then the bypass management module and the forwarding module are notified that the first security service instance to be detected is normal. If the status information of the first security service instance to be detected stored in the bypass management module indicates that the device status of the first security service instance to be detected is normal, the bypass management module does not modify the status information of the first security service instance to be detected; if the status information of the first security service instance to be detected stored in the bypass management module indicates that the device status of the first security service instance to be detected is a faulty state, the bypass management module modifies the status information of the first security service instance to be detected to information indicating that the device status of the first security service instance to be detected is normal. In addition, the forwarding module transmits the message to nic1 of the first security service instance to be detected, and then transmits the message to the second service chain orchestration module through nic2 of the first security service instance to be detected. In other words, the message is directly transmitted to the second service chain orchestration module through nic2 of the first security service instance to be detected.

[0118] The process in which the second service chain orchestration module transmits the message to the third service chain orchestration module through the processing of the second security service instance to be detected is the same as the process in which the first service chain orchestration module transmits the message to the second service chain orchestration module through the processing of the first security service instance to be detected. Both need to be processed by the bypass module (i.e., the bypass function module and the bypass management module). The process is consistent and will not be repeated here.

[0119] Finally, the third service chain orchestration module transmits the finally processed message to the service server through the service port.

[0120] Based on the same inventive concept, the present application also provides a fault detection device, such as Figure 5 The figure is a schematic diagram of the structure of a fault detection device provided by the present application, the device comprising:

[0121] The processing module 501 is used to determine whether a detection data packet is detected at the egress network card of the security service instance to be detected; wherein the detection data packet is a data packet sent to the ingress network card of the security service instance to be detected;

[0122] If not, it is determined that the security service instance to be detected fails;

[0123] If so, it is determined that the security service instance to be detected has no failure.

[0124] In one possible implementation, the processing module 501 is specifically used to obtain second information of the security service instance to be detected from the first information stored in the bypass function bypass management module; wherein the first information includes information of the security service instance that needs to be fault detected, and the second information includes at least the address of the entry network card; based on the second information, generate the detection data packet corresponding to the security service instance to be detected; and send the detection data packet to the entry network card.

[0125] In one possible implementation, the processing module 501 is also used to receive, through a management port, the first information of a security service instance that requires fault detection and status information of a security service instance that requires fault detection; wherein the status information includes the device status of the corresponding security service instance; and in the bypass management module, the first information and the status information are stored.

[0126] In a possible implementation manner, the processing module 501 is further configured to send the detection data packet to the ingress network card at intervals of a first time length.

[0127] In one possible implementation, the processing module 501 is also used to determine, at the egress network card, that a fault has occurred in the security service instance to be detected if the detection data packet is not detected within a second time period; wherein the second time period is greater than a lower time period threshold and less than an upper time period threshold.

[0128] In a possible implementation, the processing module 501 is further used to send the message sent by the first service chain orchestration module to the security service instance to be detected directly to the second service chain orchestration module through the forwarding module in the bypass; and if it is determined that the status information of the security service instance to be detected in the bypass management module indicates that the device status of the security service instance to be detected is normal, the status information of the security service instance to be detected is modified to information indicating that the device status of the security service instance to be detected is a faulty state.

[0129] In a possible implementation, the processing module 501 is further used to send the message sent by the first service chain orchestration module to the security service instance to be detected to the second service chain orchestration module through the egress network card of the security service instance; and if it is determined that the status information of the security service instance to be detected in the bypass management module indicates that the device status of the security service instance to be detected is a fault state, the status information of the security service instance to be detected is modified to information indicating that the device status of the security service instance to be detected is a normal state.

[0130] Based on the same inventive concept, an electronic device is also provided in the embodiment of the present application. The electronic device can realize the function of the aforementioned fault detection device. Figure 6 , the electronic equipment includes:

[0131] At least one processor 601, and a memory 602 connected to the at least one processor 601. The specific connection medium between the processor 601 and the memory 602 is not limited in the embodiment of the present application. Figure 6 In the example, the processor 601 and the memory 602 are connected via a bus 600. Figure 6 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 600 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 601 can also be called a controller, and there is no limitation on the name.

[0132] In the embodiment of the present application, the memory 602 stores instructions that can be executed by at least one processor 601. The at least one processor 601 can execute the fault detection method discussed above by executing the instructions stored in the memory 602. The processor 601 can implement Figure 5 The functions of each module in the device shown.

[0133] Among them, the processor 601 is the control center of the device, and can use various interfaces and lines to connect the various parts of the entire control device. By running or executing instructions stored in the memory 602 and calling the data stored in the memory 602, the various functions of the device and processing data, the device can be monitored as a whole.

[0134] In one possible design, the processor 601 may include one or more processing units, and the processor 601 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 601. In some embodiments, the processor 601 and the memory 602 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0135] Processor 601 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the fault detection method disclosed in the embodiments of the present application can be directly embodied as a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0136] The memory 602 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 602 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (English: Random Access Memory, abbreviated as RAM), a static random access memory (English: Static Random Access Memory, abbreviated as SRAM), a programmable read-only memory (English: Programmable Read Only Memory, abbreviated as PROM), a read-only memory (English: Read Only Memory, abbreviated as ROM), an electrically erasable programmable read-only memory (English: Electrically Erasable Programmable Read-Only Memory, abbreviated as EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 602 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 602 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0137] By programming the processor 601, the code corresponding to the fault detection method described in the above embodiment can be fixed into the chip, so that the chip can execute the fault detection method when running. Figure 2 The steps of the fault detection method of the embodiment shown are as follows: How to design and program the processor 601 is a technique well known to those skilled in the art and will not be described in detail here.

[0138] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the fault detection method discussed above.

[0139] In some possible implementations, various aspects of the fault detection method provided in the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of the fault detection method according to various exemplary implementations of the present application described above in this specification.

[0140] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0141] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0142] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0143] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0144] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A fault detection method, characterized in that: include: Determine whether a detection data packet is detected at the egress network card of the security service instance to be detected; wherein the detection data packet is a data packet sent to the ingress network card of the security service instance to be detected; If not, it is determined that the security service instance to be detected fails; If so, it is determined that the security service instance to be detected has no failure.

2. The method according to claim 1, characterized in that Before determining whether the detection data packet is detected at the egress network card of the security service instance to be detected, the method further includes: Acquire the second information of the security service instance to be detected from the first information stored in the bypass function bypass management module; wherein the first information includes the information of the security service instance for which fault detection is required, and the second information includes at least the address of the inlet network card; Generate the detection data packet corresponding to the security service instance to be detected according to the second information; The detection data packet is sent to the ingress network card.

3. The method according to claim 2, characterized in that Before acquiring the second information of the security service instance to be detected from the first information stored in the bypass function bypass management module, the method further includes: Receiving, through the management port, the first information of the security service instance that needs to be detected for faults and the status information of the security service instance that needs to be detected for faults; wherein the status information includes the device status of the corresponding security service instance; In the bypass management module, the first information and the status information are stored.

4. The method according to claim 2, characterized in that The step of sending the detection data packet to the ingress network card includes: The detection data packet is sent to the ingress network card at intervals of a first time length.

5. The method according to claim 1, characterized in that If not, determining that the security service instance to be detected has a fault includes: At the egress network card, if the detection data packet is not detected within a second time period, it is determined that a fault occurs in the security service instance to be detected; wherein the second time period is greater than a lower time period threshold and less than an upper time period threshold.

6. The method according to claim 1, characterized in that After determining that the security service instance to be detected fails, the method further includes: The message sent by the first service chain orchestration module to the security service instance to be detected is directly sent to the second service chain orchestration module through the forwarding module in the bypass; and If it is determined that the status information of the security service instance to be detected in the bypass management module indicates that the device status of the security service instance to be detected is normal, the status information of the security service instance to be detected is modified to information indicating that the device status of the security service instance to be detected is a faulty state.

7. The method according to claim 1, characterized in that After determining that the security service instance to be detected has no fault, the method further includes: Sending the message sent by the first service chain orchestration module to the security service instance to be detected to the second service chain orchestration module through the egress network card of the security service instance; and If it is determined that the status information of the security service instance to be detected in the bypass management module indicates that the device status of the security service instance to be detected is a faulty state, the status information of the security service instance to be detected is modified to information indicating that the device status of the security service instance to be detected is a normal state.

8. A fault detection device, characterized in that: include: A processing module, used to determine whether a detection data packet is detected at the egress network card of the security service instance to be detected; wherein the detection data packet is a data packet sent to the ingress network card of the security service instance to be detected; If not, it is determined that the security service instance to be detected fails; If so, it is determined that the security service instance to be detected has no failure.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to implement the method steps of any one of claims 1 to 7 when executing the computer program stored in the memory.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 7 are implemented.

Images