Data traffic transmission methods, apparatus, computer equipment, readable storage media and program products

Abstract

This application relates to a data traffic transmission method, apparatus, computer device, readable storage medium, and program product. The method includes: acquiring a data traffic packet, and detecting the traffic type identifier of the data traffic packet based on its transport layer protocol and port type identifier; if the traffic type identifier is a first preset identifier, entering a processing callback logic based on the first preset identifier, acquiring the protocol identifier corresponding to the data traffic packet, and detecting a network interface card (NIC) queue identifier matching the protocol identifier; if the traffic type identifier is a second preset identifier, acquiring the source address and source port of the data traffic packet, and generating a NIC queue identifier matching both the source address and source port; determining the NIC queue corresponding to the NIC queue identifier, and forwarding the data traffic packet to the processor corresponding to the NIC queue. This method can improve the security of data traffic transmission.

Description

Technical Field

[0001] This application relates to the field of cloud computing technology, and in particular to a data traffic transmission method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] With the development of science and technology, cloud computing has become a hot topic. Among them, the technology of how to process data traffic packets in this field is crucial, as it can provide convenience and security for data transmission.

[0003] In traditional cloud network scenarios, data traffic packets are encapsulated using VXLAN (Virtual eXtensible Local Area Network) to encapsulate VPN (Virtual Private Network) service packets. Specifically, VXLAN is used between the VPN gateway's front-end gateway and the VPN gateway to encapsulate IPsec (Internet Protocol Security) / SSL (Secure Sockets Layer) service packets. Tenant-level isolation between the front-end gateway and the VPN gateway is achieved using VXLAN. However, in cloud network architectures, VPN gateways mostly use DPDK (Data plane development kit) / VPP (Vector Packet Processing) technology as their data plane architecture, and hash data traffic packets using RSS (Really Simple Syndication). In this case, a tenant's data traffic packet is typically hashed into a network interface card queue, and then processed by a single CPU (Central Processing Unit) core.

[0004] However, current data transmission methods have security vulnerabilities. Summary of the Invention

[0005] Therefore, it is necessary to provide a secure data traffic transmission method, apparatus, computer equipment, computer-readable storage medium, and computer program product to address the aforementioned technical problems.

[0006] In a first aspect, this application provides a data traffic transmission method, including:

[0007] Acquire data traffic packets and detect the traffic type identifier of the data traffic packets based on the transport layer protocol and port type identifier of the data traffic packets;

[0008] When the traffic type identifier is the first preset identifier, the processing callback logic is entered according to the first preset identifier to obtain the protocol identifier corresponding to the data traffic packet and detect the network card queue identifier that matches the protocol identifier.

[0009] When the traffic type identifier is the second preset identifier, obtain the source address and source port of the data traffic packet, and generate a network interface card queue identifier that matches both the source address and source port.

[0010] Identify the network interface card (NIC) queue corresponding to the NIC queue identifier and forward the data traffic packets to the processor corresponding to the NIC queue.

[0011] In one embodiment, detecting the traffic type identifier of a data traffic packet based on its transport layer protocol and port type identifier includes:

[0012] If the virtual extended LAN information in the data traffic packet matches the preset virtual extended LAN information, the port type identifier of the data traffic packet is detected.

[0013] Detect the traffic type identifier of the data traffic packet based on the transport layer protocol and port type identifier of the data traffic packet.

[0014] In one embodiment, detecting the traffic type identifier of a data traffic packet based on its transport layer protocol and port type identifier includes:

[0015] Generate identifier matching rules based on the transport layer protocol of the data traffic packets;

[0016] Based on the identifier matching rules, traffic type identifiers that match the port type identifiers are detected. The identifier matching rules represent the mapping relationship between port type identifiers and traffic type identifiers.

[0017] If the port type identifier is the first port identifier, then the traffic type identifier of the data traffic packet is determined to be the first preset identifier;

[0018] If the port type identifier is the second port identifier, then the traffic type identifier of the data traffic packet is determined to be the second preset identifier.

[0019] In one embodiment, forwarding data traffic packets to the processor corresponding to the network interface card queue includes:

[0020] Forward data traffic packets to the network interface card (NIC) queue corresponding to the NIC queue identifier;

[0021] Forward data packets in the network interface card (NIC) queue to the corresponding processor in the application layer NIC queue.

[0022] In one embodiment, forwarding data traffic packets in the network interface card (NIC) queue to the processor corresponding to the NIC queue in the application layer includes:

[0023] The preset transmission function is invoked to forward the data traffic packets in the network interface card (NIC) queue to the corresponding processor in the application layer NIC queue.

[0024] In one embodiment, the method further includes:

[0025] When forwarding data packets to the network interface card (NIC) queue corresponding to the NIC queue identifier, update the count of data packets in each NIC queue;

[0026] Update the data traffic processing log based on the updated count.

[0027] Secondly, this application also provides a data traffic transmission device, comprising:

[0028] The traffic analysis module is used to acquire data traffic packets and detect the traffic type identifier of the data traffic packets based on the transport layer protocol and port type identifier of the data traffic packets.

[0029] The first processing module is used to enter the processing callback logic according to the first preset identifier when the traffic type identifier is the first preset identifier, obtain the protocol identifier corresponding to the data traffic packet, and detect the network card queue identifier that matches the protocol identifier.

[0030] The second processing module is used to obtain the source address and source port of the data traffic packet when the traffic type is identified as the second preset identifier, and generate a network card queue identifier that matches the source address and source port based on the source address and source port.

[0031] The traffic forwarding module is used to determine the network interface card (NIC) queue corresponding to the NIC queue identifier and forward the data traffic packets to the processor corresponding to the NIC queue.

[0032] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0033] Acquire data traffic packets and detect the traffic type identifier of the data traffic packets based on the transport layer protocol and port type identifier of the data traffic packets;

[0034] When the traffic type identifier is the first preset identifier, the processing callback logic is entered according to the first preset identifier to obtain the protocol identifier corresponding to the data traffic packet and detect the network card queue identifier that matches the protocol identifier.

[0035] When the traffic type identifier is the second preset identifier, obtain the source address and source port of the data traffic packet, and generate a network interface card queue identifier that matches both the source address and source port.

[0036] Identify the network interface card (NIC) queue corresponding to the NIC queue identifier and forward the data traffic packets to the processor corresponding to the NIC queue.

[0037] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0038] Acquire data traffic packets and detect the traffic type identifier of the data traffic packets based on the transport layer protocol and port type identifier of the data traffic packets;

[0039] When the traffic type identifier is the first preset identifier, the processing callback logic is entered according to the first preset identifier to obtain the protocol identifier corresponding to the data traffic packet and detect the network card queue identifier that matches the protocol identifier.

[0040] When the traffic type identifier is the second preset identifier, obtain the source address and source port of the data traffic packet, and generate a network interface card queue identifier that matches both the source address and source port.

[0041] Identify the network interface card (NIC) queue corresponding to the NIC queue identifier and forward the data traffic packets to the processor corresponding to the NIC queue.

[0042] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0043] Acquire data traffic packets and detect the traffic type identifier of the data traffic packets based on the transport layer protocol and port type identifier of the data traffic packets;

[0044] When the traffic type identifier is the first preset identifier, the processing callback logic is entered according to the first preset identifier to obtain the protocol identifier corresponding to the data traffic packet and detect the network card queue identifier that matches the protocol identifier.

[0045] When the traffic type identifier is the second preset identifier, obtain the source address and source port of the data traffic packet, and generate a network interface card queue identifier that matches both the source address and source port.

[0046] Identify the network interface card (NIC) queue corresponding to the NIC queue identifier and forward the data traffic packets to the processor corresponding to the NIC queue.

[0047] The aforementioned data traffic transmission methods, apparatus, computer equipment, computer-readable storage media, and computer program products, instead of hashing data traffic packets using simple aggregation techniques to hash multiple data traffic packets into a single network interface card queue for processing by the same processor, propose a more secure data traffic processing method. Specifically, for each data traffic packet, firstly, the traffic type identifier of the data traffic packet is detected based on its transport layer protocol and port type identifier; secondly, different data traffic processing is applied to the data traffic packet based on the traffic type identifier, ensuring that when the traffic type identifier is a first preset identifier... The system then enters the processing callback logic based on the first preset identifier, obtains the protocol identifier corresponding to the data traffic packet, and detects the network interface card (NIC) queue identifier that matches the protocol identifier. If the traffic type identifier is the second preset identifier, the system obtains the source address and source port of the data traffic packet, and generates a NIC queue identifier that matches both the source address and source port. The system then determines the NIC queue corresponding to the NIC queue identifier. Since each data traffic packet has its own NIC queue, all data traffic packets can be forwarded to the processor corresponding to their respective NIC queues. This reduces the occurrence of large packet loss due to excessive data traffic packets and improves the security of data traffic processing. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a diagram illustrating the application environment of a data traffic transmission method in one embodiment;

[0050] Figure 2 This is a flowchart illustrating a data traffic transmission method in one embodiment;

[0051] Figure 3 This is a flowchart illustrating a data traffic transmission method in another embodiment;

[0052] Figure 4 This is a flowchart illustrating the data traffic transmission method in yet another embodiment;

[0053] Figure 5 This is a structural block diagram of a data traffic transmission device in one embodiment;

[0054] Figure 6 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of this application.

[0056] Currently, in cloud network scenarios, data traffic packets are all based on VXLAN encapsulation of VPN-generated service packets. Specifically, VXLAN is used between the VPN gateway's front-end gateway and the VPN gateway to encapsulate IPsec / SSL service packets. Tenant granularity between the front-end gateway and the VPN gateway is isolated using VXLAN. In cloud network architectures, VPN gateways mostly use DPDK / VPP technology as their data plane architecture and hash data traffic packets using RSS. In this case, if multiple data traffic packets from the same tenant are transmitted, they are generally hashed onto a single CPU core. When the traffic from that tenant is too large, the performance of a single CPU core cannot keep up. Therefore, the bandwidth of a single tenant does not utilize the advantages of multiple cores, which may lead to a large number of packet losses under sudden increases in single-tenant traffic, resulting in poor security for data traffic transmission. VXLAN, a virtual networking technology, creates virtual Layer 2 tunnels on IP (Internet Protocol) networks, enabling dynamic migration of virtual machines and isolation of massive numbers of tenants.

[0057] Therefore, this application mainly provides a data traffic transmission method to solve the problem that in existing cloud network scenarios, IPsec / SSL traffic between the same tenant's front-end rate limiting gateway and VPN gateway is transmitted through only one VXLAN tunnel, which causes the tenant's IPsec / SSL traffic to be processed on a single CPU core when passing through the network card's RSS simple information aggregation function. In other words, the traffic forwarded by the VPN gateway is only processed on one core.

[0058] Specifically, this application mainly distributes VPN traffic to multiple CPU cores for processing by configuring IPsec's ESP (Encapsulating Security Payload) information and the source IP and source port information of the SSL tunnel. This fully utilizes multiple cores, improves the performance of the VPN gateway, reduces the number of times a large number of packets are lost when single-tenant traffic surges, and enhances the security of data traffic transmission.

[0059] The data traffic transmission method provided in this application embodiment can be applied to, for example... Figure 1 The application environment shown.

[0060] When at least one data traffic packet is transmitted between the front-end gateway and the VPN gateway of the same tenant through the virtual extended LAN tunnel 102, the data traffic will pass through the smart network interface card 104. At this time, the smart network interface card 104 obtains at least one data traffic packet. For each data traffic packet, it detects the traffic type of the data traffic packet. If the traffic type is an IPsec ESP packet, it obtains the ESP identifier of the data traffic packet and detects the network interface card queue identifier that matches the ESP identifier. If the type is an SSL packet, it obtains the source address and source port of the data traffic packet and detects the network interface card queue identifier that matches the source address and source port. It determines the network interface card queue 106 corresponding to the network interface card queue identifier and forwards all data traffic packets to the processor 108 corresponding to the network interface card queue 106.

[0061] In one exemplary embodiment, such as Figure 2 As shown, a data traffic transmission method is provided, which is applied to... Figure 1 The following explanation uses the smart network card 104 as an example. Specifically:

[0062] S100: Acquire data traffic packets and detect the traffic type identifier of the data traffic packets based on the transport layer protocol and port type identifier of the data traffic packets.

[0063] Network traffic refers to the amount of data transmitted in a computer network. It is usually the number or size of data packets passing through the network within a certain period of time. A data packet is the basic unit of network traffic transmission. It is defined as a small segment of data that includes necessary control information and user data.

[0064] Specifically, when data traffic is transmitted between the front-end gateway and the VPN gateway of the same tenant through a VXLAN tunnel, the data traffic will pass through the smart network interface card (NIC). At this time, the smart NIC will acquire data traffic packets, and the smart NIC will acquire at least one data traffic packet.

[0065] The system detects the transport layer protocol and port type identifier of data traffic packets. Based on the transport layer protocol and port type identifier of the data traffic packets, it detects the traffic type identifier of the data traffic packets. The traffic type identifier of the data traffic packets includes a first preset identifier or a second preset identifier. The first preset identifier indicates that the traffic in the data traffic packet is a message of the ESP protocol under the IPsec protocol packet. The second preset identifier indicates that the traffic in the data traffic packet is a message of the SSL protocol packet, such as a TCP (Transmission Control Protocol) message or a UDP (User Datagram Protocol) message.

[0066] S200, when the traffic type identifier is the first preset identifier, enters the processing callback logic according to the first preset identifier, obtains the protocol identifier corresponding to the data traffic packet, and detects the network card queue identifier that matches the protocol identifier.

[0067] Specifically, in order to forward data packets of different traffic types to multiple processors, it is first necessary to determine the forwarding queue of data packets of different traffic types, that is, their corresponding network interface card queue.

[0068] When the traffic type identifier is the first preset identifier, that is, when the traffic type is an ESP protocol packet under the IPsec protocol packet, the processing callback logic is entered according to the first preset identifier to obtain the IPsec protocol identifier in the data traffic packet. Furthermore, the protocol identifier is obtained from the IPsec ESP header information, which is the ESP id protocol identifier. The ESP header information is actually obtained from the ip_header field in the issued matching rules.

[0069] By further detecting the network interface card (NIC) queue identifier that matches the protocol identifier, the NIC queue used to transmit the data traffic packet can be determined.

[0070] Further, detecting the network interface card (NIC) queue identifier that matches the protocol identifier includes: obtaining preset first NIC queue matching information; and detecting the NIC queue identifier that matches the protocol identifier from the preset first NIC queue matching information. The preset first NIC queue matching information is information that maps protocol identifiers to NIC queue identifiers, and is generally represented in the form of graphs or tables.

[0071] S300, when the traffic type identifier is the second preset identifier, obtains the source address and source port of the data traffic packet, and generates a network card queue identifier that matches both the source address and source port.

[0072] Specifically, when the traffic type identifier is the second preset identifier, that is, when the traffic type is a packet under the SSL protocol, the source address and source port of the data traffic packet are obtained. In this case, the source address and source port are also obtained from the ip_header field in the issued matching rules. A network interface card (NIC) queue identifier that matches both the source address and source port is generated, thus determining the NIC queue used to transmit the data traffic packet.

[0073] Further, generating a network interface card (NIC) queue identifier that matches both the source address and the source port includes: obtaining preset second NIC queue matching information; and generating a NIC queue identifier that matches both the source address and the source port from the preset second NIC queue matching information. The preset second NIC queue matching information is information that maps the source address, source port, and NIC queue identifier, and is generally represented in the form of a graph or table.

[0074] S400 determines the network interface card (NIC) queue corresponding to the NIC queue identifier and forwards the data traffic packets to the processor corresponding to the NIC queue.

[0075] Specifically, the network interface card (NIC) queue identifier is determined, and based on the action in the action, data traffic packets are load-balanced to the corresponding NIC queue. These NIC queues then forward the data traffic packets to the corresponding processors, enabling data traffic processing on multiple processors. Generally, one NIC queue corresponds to one processor, but different NIC queues can correspond to the same processor.

[0076] In the aforementioned data traffic transmission method, instead of hashing data traffic packets using simple aggregation technology to distribute multiple data traffic packets into the network interface card (NIC) queue for processing by the same processor, this application proposes a more secure data traffic processing method. Specifically, for each data traffic packet, firstly, based on the port type identifier of the data traffic packet, the transport layer protocol and traffic type identifier of the data traffic packet are detected. Secondly, based on the traffic type identifier, different data traffic processing is performed on the data traffic packet. When the traffic type identifier is a first preset identifier, the processing callback logic is entered according to the first preset identifier to obtain the protocol identifier corresponding to the data traffic packet and detect the NIC queue identifier that matches the protocol identifier. When the traffic type identifier is a second preset identifier, the source address and source port of the data traffic packet are obtained, and a NIC queue identifier that matches both the source address and source port is generated. The NIC queue corresponding to the NIC queue identifier is determined. Since each data traffic packet has a NIC queue, all data traffic packets can be forwarded to the processor corresponding to their respective NIC queues, thereby reducing the occurrence of large packet loss due to excessive data traffic packets and improving the security of data traffic processing.

[0077] In one exemplary embodiment, such as Figure 3 As shown, S100 includes:

[0078] S120, acquire data traffic packets.

[0079] S140, if the virtual extended LAN information in the data traffic packet is detected to be the preset virtual extended LAN information, the port type identifier of the data traffic packet is detected.

[0080] S160 detects the traffic type identifier of the data traffic packet based on the transport layer protocol and port type identifier of the data traffic packet.

[0081] Specifically, when acquiring data traffic packets and detecting the traffic type identifier of the data traffic packets, it is first necessary to detect whether the data traffic packets are data traffic packets encapsulated by Virtual Extended LAN (VXLAN). If the data traffic packets are detected to be data traffic packets encapsulated by VXLAN, then it is necessary to detect whether the VXLAN information is the same as the VXLAN information in the preset matching rules.

[0082] If the Virtual Extended LAN (VXLAN) information in the data traffic packet is detected to be the same as the VXLAN information in the preset matching rules, the traffic type identifier of the data traffic packet can be detected based on the transport layer protocol and port type identifier of the data traffic packet.

[0083] In this embodiment, by matching the virtual extended local area network (VXLAN) information and port type of data traffic packets according to the matching rules issued by the control plane, the traffic type identifier of the data traffic packets can be accurately detected, thereby improving the accuracy of subsequent forwarding of data traffic packets.

[0084] In one exemplary embodiment, detecting the traffic type identifier of a data traffic packet based on its transport layer protocol and port type identifier includes:

[0085] Based on the transport layer protocol of the data traffic packet, an identifier matching rule is generated; based on the identifier matching rule, a traffic type identifier that matches the port type identifier is detected. If the port type identifier is the first port identifier, the traffic type identifier of the data traffic packet is determined to be the first preset identifier; if the port type identifier is the second port identifier, the traffic type identifier of the data traffic packet is determined to be the second preset identifier.

[0086] Among them, the identifier matching rule represents the mapping relationship between port type identifier and traffic type identifier.

[0087] Specifically, based on the transport layer protocol of the data traffic packet, an identifier matching rule matching the transport layer protocol is obtained. The identifier matching rule is the mapping relationship between port type identifiers and traffic type identifiers. From the identifier matching rule, a traffic type identifier matching the port type identifier is queried to accurately determine the traffic type identifier based on the port type identifier.

[0088] Furthermore, if the port type identifier is the first port identifier, then the traffic type identifier of the data traffic packet is determined to be the first preset identifier; if the port type identifier is the second port identifier, then the traffic type identifier of the data traffic packet is determined to be the second preset identifier. Generally, the first port identifier usually refers to the destination port 4500, such as UDP 4500, etc., and the second port identifier usually refers to the destination port 1194, such as TCP 1194 or UDP 1194, etc.

[0089] In an exemplary embodiment, during the process of detecting the traffic type identifier of a data traffic packet, the traffic type identifier is not determined arbitrarily based on the port type identifier. Instead, the traffic type identifier needs to be accurately determined according to a preset matching rule. In other words, the traffic type identifier is accurately determined by combining the preset matching rule with the port type identifier.

[0090] Therefore, this application involves a control plane and a data plane. The control plane is used to split the matching rules and distribute the split matching rules to the smart network interface card (NIC), while the data plane mainly matches data traffic packets with the corresponding NIC queues according to the rules.

[0091] In detail, the control plane organizes and splits the FDIR (Intel® Ethernet Flow Director) rules that need to be configured in the smart network interface card. FDIR refers to hardware acceleration that directly directs data packets to the core where the target application resides, solving the performance bottleneck of RSS. It's a technology that precisely matches packet fields and assigns them to a specific queue. The splitting rules are categorized according to different traffic types, and the specific processing is as follows:

[0092] Taking a packet identified by the first preset identifier as an IPsec protocol packet containing ESP protocol messages as an example, the traffic type is an IPsec ESP message. For IPsec ESP messages:

[0093] The matching rules follow the field order of ethernet_header->ip_header->udp_header->vxlan_header (configuring and sending VXLAN information between the network and the rate-limiting gateway)->ethernet_header->ip_header->udp_header (destination port 4500), which are then configured and sent to the smart network interface card as the pattern field of rte_flow. The action field in rte_flow is used to redirect the matched data traffic packets to a specific network interface card queue.

[0094] Taking the first preset identifier representing a data traffic packet as an SSL protocol packet as an example, in this case, the traffic type is an SSL packet. For SSL packets:

[0095] Because SSL VPN (Security Socket Layer Virtual Private Network, a new type of virtual private network technology that uses the SSL protocol to achieve remote access) gateways support both UDP and TCP transport modes, their matching rules are divided into two types. UDP protocol data flows are sent as the `pattern` field of `rte_flow` in the following order: `ethernet_header->ip_header->udp_header->vxlan_header (configuring and sending VXLAN information between the gateway and the rate-limiting gateway)->ethernet_header->ip_header->udp_header (destination port 1194)`. TCP protocol data flows are sent as the `pattern` field of `rte_flow` in the following order: `ethernet_header->ip_header->udp_header->vxlan_header (configuring and sending VXLAN information between the gateway and the rate-limiting gateway)->ethernet_header->ip_header->tcp_header (destination port 1194)`. The `action` field of `rte_flow` is mainly used to redirect data traffic packets to specific network interface card queues.

[0096] The data plane then performs data traffic type detection and forwarding processing based on the issued matching rules.

[0097] In other words, after the smart network interface card (NIC) receives a data traffic packet, it matches each field of the data traffic packet according to the matching rules issued by the control plane to determine which packet's matching rules the data traffic packet conforms to. If the data traffic packet conforms to the matching rules of an IPsec ESP packet, the data traffic packet is an IPsec ESP packet, and the traffic type identifier is determined to be the first preset identifier. If the data traffic packet conforms to the matching rules of an SSL packet, the data traffic packet is an SSL packet, and the traffic type identifier is determined to be the second preset identifier.

[0098] Furthermore, determining whether a data traffic packet conforms to the matching rules of IPsec ESP packets or SSL packets actually means determining whether the data traffic packet conforms to the port type identifier in the matching rules of IPsec ESP packets or SSL packets.

[0099] For example, when the port type identifier of the data traffic packet is destination port 4500, it can be determined that the port type identifier of the data traffic packet matches the port type identifier in the matching rules of IPsec ESP packets. Therefore, the data traffic packet is an IPsec ESP packet, and the traffic type identifier is the first preset identifier. When the port type identifier of the data traffic packet is destination port tcp / udp 1194, it can be determined that the port type identifier of the data traffic packet matches the port type identifier in the matching rules of SSL packets. Therefore, the data traffic packet is an SSL packet, and the traffic type identifier is the second preset identifier.

[0100] Based on the above analysis, it can be concluded that when the port type identifier is a first port identifier that matches the first preset identifier, the traffic type identifier of the data traffic packet is determined to be the first preset identifier; when the port type identifier is a second port identifier that matches the second preset identifier, the traffic type identifier of the data traffic packet is determined to be the second preset identifier.

[0101] In this embodiment, based on the identifier matching rule, a traffic type identifier that matches the port type identifier is detected. If the port type identifier is the first port identifier, such as UDP 4500, the traffic type of the data traffic packet is determined to be an IPsec ESP packet. If the port type identifier is the second port identifier, such as TCP 1194 or UDP 1194, the traffic type of the data traffic packet is determined to be an SSL packet. This enables accurate determination of the traffic type of a data traffic packet by matching the identifier with the specific port type of the data traffic packet.

[0102] In one exemplary embodiment, forwarding data traffic packets to the processor corresponding to the network interface card queue includes:

[0103] For each data traffic packet, the data traffic packet is forwarded to the network interface card (NIC) queue corresponding to the NIC queue identifier, and the data traffic packets in the NIC queue are forwarded to the processor corresponding to the NIC queue in the application layer.

[0104] Specifically, all data packets are forwarded to the processor corresponding to the network interface card (NIC) queue. One data packet corresponds to one NIC queue, one NIC queue corresponds to one processor, and each data packet also has a corresponding processor. Different data packets may correspond to different processors. Therefore, different data packets can be forwarded to different processors to reduce packet loss caused by excessive traffic and improve the security of data transmission.

[0105] More specifically, for each data packet, firstly, the data packet is forwarded to the network interface card (NIC) queue corresponding to the NIC queue identifier, and then the data packets in the NIC queue are forwarded to the processor corresponding to the NIC queue in the application layer. In other words, the data packet is carried and transmitted to the processor through the NIC queue.

[0106] In this embodiment, the network interface card (NIC) queue is identified by the NIC queue, which enables data packets to be efficiently transmitted to the processor. Each data packet corresponds to one NIC queue, and each NIC queue corresponds to one processor. Different data packets can also be transmitted to different processors, reducing packet loss caused by excessive traffic and improving the security of data transmission.

[0107] In an exemplary embodiment, forwarding data traffic packets in the network interface card (NIC) queue to the processor corresponding to the NIC queue in the application layer includes:

[0108] The preset transmission function is invoked to forward the data traffic packets in the network interface card (NIC) queue to the corresponding processor in the application layer NIC queue.

[0109] Specifically, the preset transmission function in this application can be the DPDK API (Application Programming Interface) rte_eth_rx_burst function, which is a key function in DPDK used to receive data packets from a specified network port. This function attempts to retrieve up to nb_pkts data packets from the specified receive queue and stores them in the rte_mbuf structure provided in the rx_pkts array.

[0110] In the network card driver before calling the DPDK API rte_eth_rx_burst function, the packet encapsulation format is matched according to the matching rules in the rte_flow framework to determine whether it is IPsec traffic or SSL traffic encapsulated by VXLAN. If a matching data traffic packet is found, it is processed according to the corresponding action in the matching rule, so that the traffic is load-loaded to other queues at the network card hardware level, and then processed by the multi-core processor at the VPP application layer after rte_eth_rx_burst.

[0111] In other words, before calling the preset transmission function, this application needs to detect the traffic type of the data traffic packet, and then forward the data traffic packets of different traffic types to the network card queue, so as to forward the data traffic packets in multiple network card queues to the processors corresponding to the network card queues in the application layer by calling the preset transmission function.

[0112] In this embodiment, by calling a preset transmission function, data traffic packets in the network card queue can be efficiently pushed to the corresponding processor in the application layer.

[0113] In one exemplary embodiment, the method further includes:

[0114] When forwarding data traffic packets to the network interface card (NIC) queue corresponding to the NIC queue identifier, update the count of data traffic packets in each NIC queue, and update the data traffic processing log based on the updated count.

[0115] Specifically, the `action` field of `rte_flow` can not only forward data packets to the network interface card (NIC) queue corresponding to the NIC queue identifier, but also count the matched data packets. That is, first, it obtains the initial count, typically set to 0. Then, when forwarding the next data packet to the NIC queue corresponding to the NIC queue identifier, it updates the count of data packets in each NIC queue. Finally, based on the updated count, it updates the data traffic processing log.

[0116] Furthermore, the way to update the count of data traffic packets in each network interface card queue is to increment the count by 1.

[0117] In this embodiment, by counting the data traffic packets forwarded to the network card queue corresponding to the network card queue identifier, the data traffic processing log can be updated to achieve traceability of the data traffic transmission process.

[0118] In one exemplary embodiment, such as Figure 4 As shown, a detailed example will be used to describe the data traffic transmission method, specifically including:

[0119] This application is divided into a control plane and a data plane. The control plane is mainly responsible for splitting the matching rules and sending them to the smart network interface card, while the data plane is mainly responsible for matching packets according to the rules.

[0120] Control plane: By organizing and splitting the FDIR rules configured in the smart network interface card, the rule settings are classified according to two types of traffic, and the specific processing is as follows:

[0121] IPsec tunnel matching rules:

[0122] The pattern field of the rte_flow component is configured and distributed in the following order: ethernet_header->ip_header->udp_header->vxlan_header (configuring and distributing VXLAN information between the rte_flow component and the rate-limiting gateway)->ethernet_header->ip_header->udp_header (destination port 4500). The action field of the rte_flow component mainly counts the matched traffic and redirects the flow to a specific network interface queue.

[0123] SSL tunnel matching rules:

[0124] The SSL VPN gateway supports both UDP and TCP transport methods. UDP data flows are sent as the `pattern` field of the `rte_flow` component in the following order: `ethernet_header->ip_header->udp_header->vxlan_header (configured and sent with VXLAN information between the gateway and the rate-limiting gateway)->ethernet_header->ip_header->udp_header (destination port 1194)`. TCP data flows as the `pattern` field of the `rte_flow` component in the following order: `ethernet_header->ip_header->udp_header->vxlan_header (configured and sent with VXLAN information between the gateway and the rate-limiting gateway)->ethernet_header->ip_header->tcp_header (destination port 1194)`. The `action` field of the `rte_flow` component primarily counts the matched traffic and redirects the flow to a specific network interface queue.

[0125] Data forwarding plane (described separately for IPsec and SSL protocols):

[0126] After IPsec tunnel data traffic is encapsulated via VXLAN, the network interface card (NIC) receives the data traffic packet and matches it against VXLAN information and whether the packet is an IPsec ESP packet according to the rules issued by the control plane. Specifically, based on the port type identifier of the data traffic packet, it determines whether the data traffic packet meets the matching rules for IPsec ESP packets or SSL packets. If the port type identifier of the data traffic packet is UDP 4500, then it meets the matching rules for IPsec ESP packets, and the traffic type of the data traffic packet is an IPsec ESP packet, with its traffic type identifier being the first preset identifier. At this time, the ESP protocol identifier in the ESP header information of IPsec is obtained, and the NIC queue identifier is mapped according to the ESP protocol identifier. Based on the matched information, an action is performed, and the data traffic is counted and load-loaded to the NIC queue corresponding to the NIC queue identifier according to the action. Then, the DPDK API rte_eth_rx_burst function is called to push the data traffic packets in the NIC queue to the CPU core corresponding to the NIC queue in the application layer.

[0127] After the data traffic from the SSL tunnel is encapsulated via VXLAN, the network interface card (NIC) receives the data traffic packet and matches it with VXLAN information and packets according to the rules issued by the control plane. Specifically, it determines whether the data traffic packet meets the matching rules for IPsec ESP packets or SSL packets. If the port type identifier of the data traffic packet is TCP / UDP 1194, it is confirmed to be SSL tunnel traffic, meeting the SSL packet matching rules. The traffic type of the data traffic packet is SSL packet, and its traffic type identifier is the second preset identifier. At this point, by obtaining the source IP, source port, and protocol-related information of TCP / UDP, the NIC queue identifier is mapped, and the data traffic packet is payloaded to the NIC queue corresponding to that NIC queue identifier. This allows the SSL traffic to be processed in other queues of the NIC. Finally, the DPDK API function `rte_eth_rx_burst` is called to push the data traffic packet in the NIC queue to the CPU core corresponding to the NIC queue in the application layer.

[0128] By operating on each data packet in this way, multiple data packets can be pushed to multiple CPU cores.

[0129] Furthermore, if the traffic data packet does not conform to the matching rules of the control plane, the data traffic transmission process will be terminated directly.

[0130] Based on the above process, it can be seen that this application applies the FDIR function of the smart network card to the VPN network element of the cloud network, realizing a high-performance network integrating hardware and software. Compared with the previous network cards that only used the five-tuple information of the underlay to load IPsec / SSL traffic onto a specific core, the performance has been greatly improved. The main advantages compared with the existing technology are:

[0131] 1. Increased traffic forwarding by the cloud gateway VPN allows a single VPN physical network element to handle greater network traffic, resulting in increased bandwidth supported by the resource pool VPN gateway and leading performance.

[0132] 2. The network card hardware-level load queuing eliminates the need for software-level load queuing, freeing up more CPU performance for business processing.

[0133] 3. Improved efficiency: This solution fully utilizes multi-core technology in the VPN gateway, allowing a single VPN gateway to support more users. Unlike previous solutions where the VPN gateway could only handle a limited number of users and required expansion when the user limit was reached, this application achieves a significant increase in the number of users that can be connected to a single VPN gateway.

[0134] The most significant innovation compared to existing technologies lies in:

[0135] This application fully considers the problem of packet loss in public cloud scenarios where VPN gateways previously processed each tenant on a single core, resulting in high VPN gateway load due to excessive traffic from the same tenant, which in turn caused packet loss for that tenant.

[0136] In addition, this application can also be applied to the following scenarios:

[0137] 1. DPDK uses smart network cards in all cloud network multi-layer tunnel scenarios.

[0138] 2. In the field of high-throughput, high-performance VPN forwarding, especially for network elements that have high requirements for multi-core processing.

[0139] 3. All hardware and software integrated offload tunnel solutions can be implemented with reference to this application.

[0140] 4. The encryption and decryption of VPN tunnel data packets are handled by the smart network interface card (NIC). The DPU (Data Processing Unit) can be implemented with reference to this application.

[0141] 5. The cloud network VPN gateway is mainly designed based on the method of hashing the source IP, source port and ESP information of the VPN traffic in the control plane for both IPsec and SSL traffic.

[0142] In an exemplary embodiment, starting from the control plane, this application splits IPsec rules and SSL rules into VXLAN underlay rules and IPsec / SSL service packet rules. The IPsec rules mainly focus on VXLAN information, IPsec UDP header, and ESP header information, while the SSL rules mainly focus on VXLAN information and SSL UDP / TCP header information. All split rules are distributed to the DPDK network card driver through rte_flow_validate provided by rte_flow, so that data packets can use rte_flow rule queries when passing through the network card.

[0143] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0144] Based on the same inventive concept, this application also provides a data traffic transmission device for implementing the data traffic transmission method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more data traffic transmission device embodiments provided below can be found in the limitations of the data traffic transmission method described above, and will not be repeated here.

[0145] In one exemplary embodiment, such as Figure 5 As shown, a data traffic transmission device is provided, comprising: a traffic analysis module 100, a first processing module 200, a second processing module 300, and a traffic forwarding module 400, wherein:

[0146] The traffic analysis module 100 is used to acquire data traffic packets and detect the traffic type identifier of the data traffic packets based on the transport layer protocol and port type identifier of the data traffic packets.

[0147] The first processing module 200 is used to enter the processing callback logic according to the first preset identifier when the traffic type identifier is the first preset identifier, obtain the protocol identifier corresponding to the data traffic packet, and generate a network card queue identifier that matches the protocol identifier according to the source address and source port.

[0148] The second processing module 300 is used to obtain the source address and source port of the data traffic packet when the traffic type identifier is the second preset identifier, and to detect the network card queue identifier that matches both the source address and source port.

[0149] The traffic forwarding module 400 is used to determine the network card queue corresponding to the network card queue identifier and forward the data traffic packets to the processor corresponding to the network card queue.

[0150] In an exemplary embodiment, the traffic analysis module 100 is further configured to detect the port type identifier of the data traffic packet when the virtual extended LAN information in the data traffic packet matches the preset virtual extended LAN information, and to detect the traffic type identifier of the data traffic packet according to the transport layer protocol and the port type identifier of the data traffic packet.

[0151] In an exemplary embodiment, the traffic analysis module 100 is further configured to generate an identifier matching rule according to the transport layer protocol of the data traffic packet; detect a traffic type identifier that matches the port type identifier according to the identifier matching rule, wherein the identifier matching rule represents the mapping relationship between the port type identifier and the traffic type identifier; if the port type identifier is a first port identifier, then determine that the traffic type identifier of the data traffic packet is a first preset identifier; if the port type identifier is a second port identifier, then determine that the traffic type identifier of the data traffic packet is a second preset identifier.

[0152] In an exemplary embodiment, the traffic forwarding module 400 is further configured to forward data traffic packets to the network interface card queue corresponding to the network interface card queue identifier, and forward data traffic packets in the network interface card queue to the processor corresponding to the network interface card queue in the application layer.

[0153] In an exemplary embodiment, the traffic forwarding module 400 is further configured to call a preset transmission function to forward data traffic packets in the network interface card queue to the processor corresponding to the network interface card queue in the application layer.

[0154] In an exemplary embodiment, the data traffic transmission device further includes a counting module, which is used to update the count of data traffic packets in each network interface card queue when forwarding data traffic packets to the network interface card queue corresponding to the network interface card queue identifier, and update the data traffic processing log based on the updated count.

[0155] Each module in the aforementioned data transmission device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0156] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 6 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data such as data packets. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a data transmission method.

[0157] Those skilled in the art will understand that Figure 6 The structure shown is a block diagram of a partial structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0158] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0159] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0160] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0161] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0162] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0163] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A data traffic transmission method, characterized in that, The method includes: The system acquires data traffic packets, and when it detects that the virtual extended LAN information in the data traffic packets matches preset virtual extended LAN information, it detects the port type identifier of the data traffic packets; based on the transport layer protocol of the data traffic packets and the port type identifier, it detects the traffic type identifier of the data traffic packets, wherein the step of detecting the traffic type identifier of the data traffic packets based on the transport layer protocol of the data traffic packets and the port type identifier includes: generating an identifier matching rule based on the transport layer protocol of the data traffic packets; and detecting a traffic type identifier that matches the port type identifier based on the identifier matching rule, wherein the identifier matching rule represents the mapping relationship between the port type identifier and the traffic type identifier; When the traffic type identifier is a first preset identifier, the processing callback logic is entered according to the first preset identifier to obtain the protocol identifier corresponding to the data traffic packet and detect the network card queue identifier that matches the protocol identifier. The protocol identifier is obtained from the header information of the ESP protocol under the IPsec protocol packet. The first preset identifier indicates that the traffic in the data traffic packet is the ESP protocol under the IPsec protocol packet. When the traffic type identifier is a second preset identifier, the source address and source port of the data traffic packet are obtained, and a network interface card queue identifier that matches the source address and source port is generated based on the source address and source port. The second preset identifier indicates that the traffic in the data traffic packet is a message under the SSL protocol packet. The network interface card (NIC) queue corresponding to the NIC queue identifier is determined, and the data traffic packet is forwarded to the processor corresponding to the NIC queue.

2. The method according to claim 1, characterized in that, The step of detecting the traffic type identifier of the data traffic packet based on the transport layer protocol and port type identifier of the data traffic packet includes: If the port type identifier is a first port identifier, then the traffic type identifier of the data traffic packet is determined to be a first preset identifier; If the port type identifier is the second port identifier, then the traffic type identifier of the data traffic packet is determined to be the second preset identifier.

3. The method according to claim 1, characterized in that, The step of forwarding the data traffic packet to the processor corresponding to the network interface card queue includes: The data traffic packet is forwarded to the network interface card queue corresponding to the network interface card queue identifier; The data traffic packets in the network interface card (NIC) queue are forwarded to the processor corresponding to the NIC queue in the application layer.

4. The method according to claim 3, characterized in that, The step of forwarding the data traffic packets in the network interface card (NIC) queue to the processor corresponding to the NIC queue in the application layer includes: A preset transmission function is invoked to forward the data traffic packets in the network interface card queue to the processor corresponding to the network interface card queue in the application layer.

5. The method according to claim 3, characterized in that, The method further includes: When forwarding the data traffic packet to the network interface card queue corresponding to the network interface card queue identifier, update the count of the data traffic packet in each network interface card queue; Update the data traffic processing log based on the updated count.

6. A data traffic transmission device, characterized in that, The device includes: A traffic analysis module is used to acquire data traffic packets and, when it detects that the virtual extended LAN information in the data traffic packet matches preset virtual extended LAN information, detect the port type identifier of the data traffic packet; and, based on the transport layer protocol of the data traffic packet and the port type identifier, detect the traffic type identifier of the data traffic packet, wherein the step of detecting the traffic type identifier of the data traffic packet based on the transport layer protocol and the port type identifier includes: generating an identifier matching rule based on the transport layer protocol of the data traffic packet; and detecting a traffic type identifier that matches the port type identifier based on the identifier matching rule, wherein the identifier matching rule represents the mapping relationship between the port type identifier and the traffic type identifier; The first processing module is configured to, when the traffic type identifier is a first preset identifier, enter the processing callback logic according to the first preset identifier, obtain the protocol identifier corresponding to the data traffic packet, and detect the network card queue identifier that matches the protocol identifier, wherein the protocol identifier is obtained from the header information of the ESP protocol packet under the IPsec protocol packet, and the first preset identifier indicates that the traffic in the data traffic packet is the ESP protocol packet under the IPsec protocol packet. The second processing module is used to obtain the source address and source port of the data traffic packet when the traffic type identifier is a second preset identifier, and generate a network card queue identifier that matches the source address and the source port according to the source address and the source port. The second preset identifier indicates that the traffic in the data traffic packet is a message under the SSL protocol packet. The traffic forwarding module is used to determine the network interface card queue corresponding to the network interface card queue identifier and forward the data traffic packet to the processor corresponding to the network interface card queue.

7. The apparatus according to claim 6, characterized in that, The traffic analysis module is further configured to determine the traffic type identifier of the data traffic packet as a first preset identifier if the port type identifier is a first port identifier; and to determine the traffic type identifier of the data traffic packet as a second preset identifier if the port type identifier is a second port identifier.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images