Flow isolation system

Abstract

The invention discloses a flow isolation system. The system comprises a rule center, at least one server and at least one service node, and the rule center is used for responding to a traffic isolation operation of a user for a target server, generating an isolation instruction matched with the traffic isolation operation and sending the isolation instruction to each server; the server is used for analyzing the isolation instruction after receiving the isolation instruction sent by the rule center, and sending the isolation instruction to each service node according to an analysis result; and the service node is used for analyzing the isolation instruction after receiving the isolation instruction, and executing a traffic isolation operation according to an analysis result. Through the technical scheme of the invention, the traffic isolation for the target server can be realized, the computing power requirement of the traffic isolation operation is reduced, and the efficiency of the traffic isolation operation is improved.

Description

Technical Field

[0001] The present invention relates to the field of distribution, and in particular to a flow isolation system. Background Art

[0002] In today's microservice architecture, traffic isolation technology is crucial to ensuring the stability and reliability of the system. The current mainstream microservice traffic isolation technology usually takes effect on the consumer or request caller, and the consumer implements traffic isolation based on the routing rules.

[0003] However, this technology has obvious defects. First, during the implementation process, the solution only focuses on the rule effectiveness and routing calculation of the consumer, but fails to fully incorporate the relevant factors of the service provider, such as the load of the server node and the real-time status of the service. This leads to the lack of comprehensive consideration of the server node factors when the consumer actively performs service routing, which easily leads to a greater risk of failure due to improper traffic isolation, seriously affecting the normal operation of the entire microservice system. Second, when a server node needs to be isolated, the dynamic isolation rules must be sent to all request callers at the same time. If the scale of the request callers is large, it is undoubtedly a difficult task to ensure the timely and accurate issuance of isolation rules. Not only that, in such a large number of request callers, it is also a very challenging problem to accurately find all objects, which largely restricts the efficiency and effect of traffic isolation and brings huge pressure and uncertainty to the operation and maintenance of the microservice system.

[0004] In summary, the existing traffic isolation methods have the problem that the computing power requirements for traffic isolation operations are high and the efficiency of traffic isolation operations is low. Summary of the invention

[0005] The present invention provides a traffic isolation system, which can solve the problems of high computing power requirements for traffic isolation operations and low efficiency of traffic isolation operations in existing traffic isolation methods.

[0006] In a first aspect, an embodiment of the present invention provides a traffic isolation system, the system comprising: a rule center, at least one server and at least one service node;

[0007] The rule center establishes a communication connection with each server, and the service node establishes a communication connection with each server;

[0008] The rule center is used to generate an isolation instruction matching the traffic isolation operation to each server in response to the traffic isolation operation of the user on the target server and send the isolation instruction to each server;

[0009] The server is used to parse the isolation instruction after receiving the isolation instruction sent by the rule center, and send the isolation instruction to each service node according to the parsing result;

[0010] The service node is used to parse the isolation instruction after receiving the isolation instruction, and perform the traffic isolation operation according to the parsing result.

[0011] Among them, the rule center specifically includes: a data acquisition unit, which is used to respond to the user's traffic isolation operation on the target server, obtain the target server address of the target server, and the node IP, node port number and application information to be isolated that match the traffic isolation operation; a first isolation instruction sending unit, which is used to generate an isolation instruction based on the node IP, node port number and application information to be isolated, and send the isolation instruction to each server that has a communication connection with the rule center.

[0012] Furthermore, the server specifically includes: a first instruction parsing unit, used to parse the isolation instruction after receiving the isolation instruction, obtain the target server address matching the isolation instruction, and send the target server address to the first address judgment unit; the first address judgment unit, used to obtain the current address information of the server after receiving the target server address, and after judging that the current address information is the same as the target server address, send the isolation instruction to the second isolation instruction sending unit; the second isolation instruction sending unit, used to send the received isolation instruction to each service node that has a communication connection with the server.

[0013] Furthermore, the service node includes: a second instruction parsing unit, which is used to parse the isolation instruction after receiving the isolation instruction, obtain the node IP and node port number that match the isolation instruction, and send the node IP and node port number to the second address judgment unit; the second address judgment unit is used to obtain the current IP and current port number of the service node after receiving the node IP and node port number, and after judging that the current IP and current port number are the same as the node IP and node port number, send the isolation instruction to the traffic isolation unit; the traffic isolation unit is used to respond to the reception of the isolation instruction, and set the communication channel that matches the application information to be isolated in the isolation instruction to read-only mode to complete the traffic isolation operation.

[0014] Specifically, the first address determination unit is further used to: after receiving the target server address, obtain the current address information of the server, and after determining that the current address information is different from the target server address, clear the isolation instruction.

[0015] Specifically, the second address determination unit is further used to: after determining that the current IP and the current port number are different from the node IP and the node port number, clear the isolation instruction.

[0016] Furthermore, the rule center is also used to: in response to a user's traffic recovery operation on a target server, generate a traffic recovery instruction matching the traffic recovery operation and send it to each server; the server is also used to parse the traffic recovery instruction after receiving the traffic recovery instruction sent by the rule center, and send the traffic recovery instruction to each service node based on the parsing result; the service node is used to parse the traffic recovery instruction after receiving the traffic recovery instruction, and perform the traffic recovery operation based on the parsing result.

[0017] Furthermore, the rule center specifically includes: a recovery response unit, which is used to respond to the user's traffic recovery operation on the server to be restored, obtain the server address to be restored of the server to be restored, and the IP of the node to be restored, the port number of the node to be restored and the application information to be restored that match the traffic recovery operation; a first recovery instruction sending unit, which is used to generate a traffic recovery instruction based on the IP of the node to be restored, the port number of the node to be restored and the application information to be restored, and send the traffic recovery instruction to each server that has a communication connection with the rule center.

[0018] Furthermore, the server specifically includes: a third instruction parsing unit, which is used to parse the traffic recovery instruction after receiving the traffic recovery instruction, obtain the address of the server to be restored that matches the traffic recovery instruction, and send the address of the server to be restored to the third address judgment unit; the third address judgment unit is used to obtain the current address information of the server after receiving the address of the server to be restored, and after judging that the current address information is the same as the address of the server to be restored, send the traffic recovery instruction to the second recovery instruction sending unit; the second recovery instruction sending unit is used to send the received traffic recovery instruction to each service node that has a communication connection with the server.

[0019] Specifically, the service node also includes: a fourth instruction parsing unit, which is used to parse the traffic recovery instruction after receiving the traffic recovery instruction, obtain the IP of the node to be restored and the port number of the node to be restored that match the traffic recovery instruction, and send the IP of the node to be restored and the port number of the node to be restored to the fourth address judgment unit; the fourth address judgment unit is used to obtain the current IP and current port number of the service node after receiving the IP of the node to be restored and the port number of the node to be restored, and after judging that the current IP and current port number are the same as the IP of the node to be restored and the port number of the node to be restored, send the traffic recovery instruction to the traffic recovery unit; the traffic recovery unit is used to respond to the reception of the traffic recovery instruction, and set the communication channel matching the application information to be restored to normal mode based on the application information to be restored in the traffic recovery instruction to complete the traffic recovery operation.

[0020] The technical solution of the embodiment of the present invention is that a rule center responds to a user's traffic isolation operation on a target server, generates an isolation instruction matching the traffic isolation operation and sends it to each server; then, after receiving the isolation instruction sent by the rule center, the server parses the isolation instruction and sends the isolation instruction to each service node according to the parsing result; then, after receiving the isolation instruction, the service node parses the isolation instruction and performs the traffic isolation operation according to the parsing result, which solves the problem of high computing power requirements for traffic isolation operations and low efficiency of traffic isolation operations in existing traffic isolation methods, realizes traffic isolation for the target server, reduces the computing power requirements for traffic isolation operations, and improves the efficiency of traffic isolation operations.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 This is a schematic diagram of the structure of a flow isolation system provided according to Embodiment 1 of the present invention;

[0024] Figure 2 It is a structural schematic diagram of a flow isolation system provided according to the second embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, any variation of the terms "including" and "having" is intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Embodiment 1

[0028] Figure 1 This is a structural diagram of a traffic isolation system provided in Example 1 of the present invention. This embodiment is applicable to the situation where traffic is isolated for servers in a distributed scenario.

[0029] The system includes: a rule center 110 , at least one server 120 and at least one service node 130 ; wherein the rule center 110 establishes a communication connection with each server 120 , and the service node 130 establishes a communication connection with each server 120 .

[0030] The traffic isolation operation refers to an action performed by a user to limit, block or reallocate network traffic of a specific server 120. For example, the upper limit of access traffic of a server 120 within a specific time period is limited.

[0031] The rule center 110 is used to respond to the user's traffic isolation operation on the target server 120, generate an isolation instruction matching the traffic isolation operation and send it to each server 120.

[0032] Among them, the rule center 110 specifically includes: a data acquisition unit, which is used to respond to the user's traffic isolation operation on the target server 120, obtain the target server 120 address of the target server 120, and the node IP, node port number and application information to be isolated that match the traffic isolation operation; a first isolation instruction sending unit, which is used to generate an isolation instruction based on the node IP, node port number and application information to be isolated, and send the isolation instruction to each server 120 that has a communication connection with the rule center 110.

[0033] In this embodiment, the rule center 110 refers to a centralized management and control unit that can perform fine control and scheduling of traffic in the network; wherein the rule center 110 specifically includes: a data acquisition unit, which is used to respond to the user's traffic isolation operation on the target server 120, obtain the target server 120 address of the target server 120, and the node IP, node port number and application information to be isolated that match the traffic isolation operation. For example, in an enterprise's internal network, when a user decides to isolate the traffic of a specific server 120 (such as a file server), the data acquisition unit will obtain the IP address of this server 120 (such as 192.168.1.100), the relevant node port number (such as port 8080) and the application information to be isolated (such as a specific file sharing application); a first isolation instruction sending unit, which is used to generate an isolation instruction based on the node IP, node port number and application information to be isolated, and send the isolation instruction to each server 120 that has a communication connection with the rule center 110; wherein, The "isolation instruction" is a specific instruction or command used in a network system or technical architecture to instruct related servers, service nodes or applications to take specific measures to isolate specified targets (such as servers, application clusters, ports, network traffic, etc.) from other parts to achieve the purpose of controlling access, limiting traffic, ensuring security or implementing specific business logic. For example, the generated isolation instruction may contain specific codes and parameters to instruct the related server 120 to isolate the specified traffic, ensure that the specific server 120 is not impacted by excessive traffic under specific circumstances, and ensure the stability and security of the network.

[0034] It should be noted that the method of generating isolation instructions based on data information is a mature existing technology, and the specific process and code of instruction generation are not described in detail in this embodiment.

[0035] The server 120 is used to parse the isolation instruction after receiving the isolation instruction sent by the rule center 110, and send the isolation instruction to each service node 130 according to the parsing result.

[0036] Among them, the server 120 specifically includes: a first instruction parsing unit, which is used to parse the isolation instruction after receiving the isolation instruction, obtain the target server 120 address that matches the isolation instruction, and send the target server 120 address to the first address judgment unit; the first address judgment unit is used to obtain the current address information of the server 120 after receiving the target server 120 address, and after judging that the current address information is the same as the target server 120 address, send the isolation instruction to the second isolation instruction sending unit; the second isolation instruction sending unit is used to send the received isolation instruction to each service node 130 that has a communication connection with the server 120.

[0037] Furthermore, the first address judgment unit is also used to: after receiving the address of the target server 120, obtain the current address information of the server 120, and after determining that the current address information is different from the address of the target server 120, clear the isolation instruction; the first address judgment unit is also used to: after receiving the address of the target server 120, obtain the current address information of the server 120, and after determining that the current address information is different from the address of the target server 120, clear the isolation instruction.

[0038] In this embodiment, the server 120 may be a hardware device with certain computing and processing capabilities, which is responsible for receiving, processing and distributing various instructions and data, such as common tower servers, rack servers, etc.; further, the server 120 specifically includes: a first instruction parsing unit, which is used to parse the isolation instruction after receiving the isolation instruction, obtain the target server 120 address that matches the isolation instruction, and send the target server 120 address to the first address judgment unit. For example, in a complex enterprise network, the first instruction parsing unit can accurately extract the key target server 120 address from the received complex instruction, such as parsing the address as 10.0.0.10. The first address judgment unit is used to obtain the current address information of the server 120 after receiving the target server 120 address, and after determining that the current address information is the same as the target server 120 address, send the isolation instruction to the second isolation instruction sending unit. For example, the current address of server 120 is 10.0.0.10, and the received address of target server 120 is also 10.0.0.10, then the condition for sending the isolation instruction is met; further, the second isolation instruction sending unit is used to send the received isolation instruction to each service node 130 that has a communication connection with the server 120.

[0039] Specifically, after receiving the address of the target server 120, the first address judgment unit will obtain the current address information of the server 120, and if it is found after judgment that the current address information is different from the address of the target server 120, the isolation instruction will be cleared. It should be noted here that clearing means completely removing the isolation instruction from the processing flow of the server 120 so that it no longer has any effect on the subsequent operations of the server 120. For example, assuming that the address of the target server 120 is 192.168.1.50, and the address of the current server 120 is 192.168.1.80, and the two do not match, the first address judgment unit will perform a clearing operation.

[0040] The service node 130 is used to parse the isolation instruction after receiving the isolation instruction, and perform a traffic isolation operation according to the parsing result.

[0041] Among them, the service node 130 includes: a second instruction parsing unit, which is used to parse the isolation instruction after receiving the isolation instruction, obtain the node IP and node port number matching the isolation instruction, and send the node IP and node port number to the second address judgment unit; the second address judgment unit is used to obtain the current IP and current port number of the service node 130 after receiving the node IP and node port number, and after judging that the current IP and current port number are the same as the node IP and node port number, send the isolation instruction to the traffic isolation unit; the traffic isolation unit is used to respond to the reception of the isolation instruction, and set the communication channel matching the application information to be isolated in the isolation instruction to read-only mode to complete the traffic isolation operation.

[0042] Furthermore, the second address determination unit is also used to: after determining that the current IP and the current port number are different from the node IP and the node port number, clear the isolation instruction.

[0043] In this embodiment, specifically, the service node 130 can be understood as a basic unit that provides specific service functions in the network system. For example, in a distributed database system, each server that stores and processes data can be regarded as a service node 130, or in the architecture of an e-commerce platform, a server that processes functions such as orders and payments is also a service node 130.

[0044] The service node 130 specifically includes: a second instruction parsing unit, which is used to parse the isolation instruction after receiving the isolation instruction, obtain the node IP and node port number that match the isolation instruction, and send the node IP and node port number to the second address judgment unit. For example, in an internal network of an enterprise, assuming that the node IP contained in the isolation instruction is 10.10.10.10, and the node port number is 8080, the second instruction parsing unit will accurately extract these key information; the second address judgment unit is used to obtain the current IP and current port number of the service node 130 after receiving the node IP and node port number, and after determining that the current IP and current port number are the same as the node IP and node port number, send the isolation instruction to the traffic isolation unit. For example, if the current IP of service node 130 is 10.10.10.10 and the current port number is 8080, which is consistent with the received node IP and node port number, the subsequent operation will be performed; the traffic isolation unit is used to respond to the reception of the isolation instruction and set the communication channel matching the application information to be isolated to read-only mode based on the application information to be isolated in the isolation instruction to complete the traffic isolation operation. For example, if the application information to be isolated indicates that a specific file sharing application is to be isolated, the traffic isolation unit will set the communication channel related to it to read-only mode, so that the data can only be read, but cannot be modified or written.

[0045] Furthermore, the second address determination unit is further configured to: after determining that the current IP and the current port number are not the same as the node IP and the node port number, clear the isolation instruction. This means that if the IP and the port number of the service node 130 itself do not match those required in the received isolation instruction, the irrelevant isolation instruction is cleared to avoid erroneous execution or interference with normal service operation.

[0046] The technical solution of the embodiment of the present invention is that a rule center responds to a user's traffic isolation operation on a target server, generates an isolation instruction matching the traffic isolation operation and sends it to each server; then, after receiving the isolation instruction sent by the rule center, the server parses the isolation instruction and sends the isolation instruction to each service node according to the parsing result; then, after receiving the isolation instruction, the service node parses the isolation instruction and executes the traffic isolation operation according to the parsing result, thereby realizing traffic isolation for the target server, reducing the computing power requirement of the traffic isolation operation, and improving the efficiency of the traffic isolation operation.

[0047] Embodiment 2

[0048] Figure 2This is a structural diagram of a traffic isolation system provided in Embodiment 2 of the present invention. This embodiment is applicable to the situation where traffic is isolated from a server and then traffic is restored in a distributed scenario.

[0049] The system includes: a rule center 210, at least one server 220 and at least one service node 230; wherein the rule center establishes a communication connection with each server, and the service node establishes a communication connection with each server.

[0050] The rule center is used to: in response to a user's traffic recovery operation on a target server, generate a traffic recovery instruction matching the traffic recovery operation and send the instruction to each server;

[0051] Among them, the rule center specifically includes: a recovery response unit, which is used to respond to the user's traffic recovery operation on the server to be restored, obtain the server address to be restored of the server to be restored, and the IP of the node to be restored, the port number of the node to be restored and the application information to be restored that match the traffic recovery operation; a first recovery instruction sending unit, which is used to generate a traffic recovery instruction based on the IP of the node to be restored, the port number of the node to be restored and the application information to be restored, and send the traffic recovery instruction to each server that has a communication connection with the rule center.

[0052] Specifically, the rule center includes: a recovery response unit, which is used to respond to the user's traffic recovery operation on the server to be restored, obtain the server address to be restored of the server to be restored, and the node IP to be restored, the node port number to be restored and the application information to be restored that match the traffic recovery operation. For example, in an enterprise's network system, when a user decides to restore a server (such as a mail server) whose traffic is restricted due to a fault or other reasons, the recovery response unit will quickly obtain the accurate address of the server (such as 192.168.2.200), and the related node IP to be restored (such as 192.168.2.10), the node port number to be restored (such as port 25) and the application information to be restored (such as mail sending and receiving applications); a first recovery instruction sending unit, which is used to generate a traffic recovery instruction based on the node IP to be restored, the node port number to be restored and the application information to be restored, and send the traffic recovery instruction to each server that has a communication connection with the rule center, for example, the generated traffic recovery instruction may contain specific codes and parameters, clearly instructing the relevant server to lift the restriction on the traffic of the specified server so that it can receive and process data normally.

[0053] The server is used to parse the traffic restoration instruction after receiving the traffic restoration instruction sent by the rule center, and send the traffic restoration instruction to each service node according to the parsing result.

[0054] Among them, the server specifically includes: a third instruction parsing unit, which is used to parse the traffic recovery instruction after receiving the traffic recovery instruction, obtain the address of the server to be restored that matches the traffic recovery instruction, and send the address of the server to be restored to the third address judgment unit; the third address judgment unit is used to obtain the current address information of the server after receiving the address of the server to be restored, and after judging that the current address information is the same as the address of the server to be restored, send the traffic recovery instruction to the second recovery instruction sending unit; the second recovery instruction sending unit is used to send the received traffic recovery instruction to each service node that has a communication connection with the server.

[0055] In this embodiment, the server specifically includes: a third instruction parsing unit, which is used to parse the traffic recovery instruction after receiving the traffic recovery instruction, obtain the address of the server to be restored that matches the traffic recovery instruction, and send the address of the server to be restored to the third address judgment unit. For example, in the internal network of a large enterprise, when the traffic recovery instruction is received, the third instruction parsing unit can extract the address of the server to be restored from the complex instruction, such as 10.100.10.50. The third address judgment unit is used to obtain the current address information of the server after receiving the address of the server to be restored, and after judging that the current address information is the same as the address of the server to be restored, send the traffic recovery instruction to the second recovery instruction sending unit. Assuming that the current address of the server is 10.100.10.50, which is consistent with the received address of the server to be restored, the third address judgment unit will perform subsequent instruction sending operations, just like a rigorous examiner, to ensure the accurate transmission of the instruction; the second recovery instruction sending unit is used to send the received traffic recovery instruction to each service node that has a communication connection with the server, so as to ensure the normal operation and data flow of the entire network system.

[0056] The service node is used to parse the traffic restoration instruction after receiving the traffic restoration instruction, and perform a traffic restoration operation according to the parsing result.

[0057] Specifically, the service node includes: a fourth instruction parsing unit, which is used to parse the traffic recovery instruction after receiving the traffic recovery instruction, obtain the IP of the node to be restored and the port number of the node to be restored that match the traffic recovery instruction, and send the IP of the node to be restored and the port number of the node to be restored to the fourth address judgment unit; the fourth address judgment unit is used to obtain the current IP and current port number of the service node after receiving the IP of the node to be restored and the port number of the node to be restored, and after judging that the current IP and current port number are the same as the IP of the node to be restored and the port number of the node to be restored, send the traffic recovery instruction to the traffic recovery unit; the traffic recovery unit is used to respond to the reception of the traffic recovery instruction, and set the communication channel matching the application information to be restored to normal mode based on the application information to be restored in the traffic recovery instruction to complete the traffic recovery operation.

[0058] In a specific implementation scenario of this embodiment, the service node includes: a fourth instruction parsing unit, which is used to parse the traffic recovery instruction after receiving the traffic recovery instruction, obtain the IP of the node to be restored and the port number of the node to be restored that match the traffic recovery instruction, and send the IP of the node to be restored and the port number of the node to be restored to the fourth address judgment unit. For example, in the background system of an e-commerce website, the IP of the node to be restored contained in the traffic recovery instruction may be 192.168.1.20, and the port number of the node to be restored may be 8080. The fourth instruction parsing unit can accurately extract these key information; a fourth address judgment unit, which is used to obtain the current IP and current port number of the service node after receiving the IP and port number of the node to be restored, and after determining that the current IP and current port number are the same as the IP and port number of the node to be restored, send the traffic recovery instruction to the traffic recovery unit. Assuming that the current IP of the service node is 192.168.1.20 and the current port number is 8080, which are consistent with the received information to be restored, the fourth address judgment unit will start the subsequent processing flow. The traffic recovery unit is used to respond to the receipt of the traffic recovery instruction and set the communication channel matching the application information to be recovered in the traffic recovery instruction to normal mode to complete the traffic recovery operation. For example, if the application information to be recovered indicates that it is a certain online payment module, the traffic recovery unit will restore the communication channel related to it from the previous restricted state to normal mode, allowing free transmission and processing of data, so that related services can operate normally.

[0059] The technical solution of the embodiment of the present invention is that a rule center responds to a user's traffic recovery operation on a target server, generates a traffic recovery instruction matching the traffic recovery operation and sends it to each server; then, after receiving the traffic recovery instruction sent by the rule center, the server parses the traffic recovery instruction and sends the traffic recovery instruction to each service node according to the parsing result; finally, after receiving the traffic recovery instruction, the service node parses the traffic recovery instruction and executes the traffic recovery operation according to the parsing result, thereby realizing traffic recovery for the target server after the traffic isolation operation, reducing the computing power requirement of the traffic recovery operation, and improving the efficiency of the traffic recovery operation.

[0060] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

Claims

1. A flow isolation system, characterized in that: The system comprises: a rule center, at least one server and at least one service node; The rule center establishes a communication connection with each server, and the service node establishes a communication connection with each server; The rule center is used to generate an isolation instruction matching the traffic isolation operation to each server in response to the traffic isolation operation of the user on the target server and send the isolation instruction to each server; The server is used to parse the isolation instruction after receiving the isolation instruction sent by the rule center, and send the isolation instruction to each service node according to the parsing result; The service node is used to parse the isolation instruction after receiving the isolation instruction, and perform the traffic isolation operation according to the parsing result.

2. The system according to claim 1, characterized in that The rule center specifically includes: A data acquisition unit, configured to acquire, in response to a user's traffic isolation operation on a target server, a target server address of the target server, and a node IP, a node port number, and application information to be isolated that match the traffic isolation operation; The first isolation instruction sending unit is used to generate an isolation instruction based on the node IP, node port number and application information to be isolated, and send the isolation instruction to each server that has a communication connection with the rule center.

3. The system according to any one of claims 1 to 2, characterized in that: The server specifically includes: A first instruction parsing unit is used to parse the isolation instruction after receiving the isolation instruction, obtain a target server address matching the isolation instruction, and send the target server address to the first address determination unit; A first address determination unit, configured to obtain current address information of the server after receiving the target server address, and send the isolation instruction to a second isolation instruction sending unit after determining that the current address information is the same as the target server address; The second isolation instruction sending unit is used to send the received isolation instruction to each service node that has a communication connection with the server.

4. The system according to any one of claims 1 to 2, characterized in that: The service node comprises: A second instruction parsing unit is used to parse the isolation instruction after receiving the isolation instruction, obtain the node IP and node port number matching the isolation instruction, and send the node IP and node port number to the second address judgment unit; A second address determination unit is used to obtain the current IP and current port number of the service node after receiving the node IP and the node port number, and after determining that the current IP and the current port number are the same as the node IP and the node port number, send the isolation instruction to the traffic isolation unit; The traffic isolation unit is used to, in response to receiving an isolation instruction, set a communication channel matching the application information to be isolated in the isolation instruction to a read-only mode to complete a traffic isolation operation.

5. The system according to claim 2, characterized in that The first address determination unit is further used to: after receiving the target server address, obtain the current address information of the server, and after determining that the current address information is different from the target server address, clear the isolation instruction.

6. The system according to claim 3, characterized in that The second address determination unit is further configured to clear the isolation instruction after determining that the current IP and the current port number are different from the node IP and the node port number.

7. The system according to claim 1, characterized in that The rule center is further used to: in response to a user's traffic recovery operation on a target server, generate a traffic recovery instruction matching the traffic recovery operation and send the instruction to each server; The server is further configured to parse the traffic restoration instruction after receiving the traffic restoration instruction sent by the rule center, and send the traffic restoration instruction to each service node according to the parsing result; The service node is used to parse the traffic restoration instruction after receiving the traffic restoration instruction, and perform a traffic restoration operation according to the parsing result.

8. The system according to claim 7, characterized in that The rule center specifically includes: A recovery response unit, configured to, in response to a user's traffic recovery operation on a server to be recovered, obtain the server address to be recovered of the server to be recovered, as well as the IP address of a node to be recovered that matches the traffic recovery operation, the port number of the node to be recovered, and the application information to be recovered; The first recovery instruction sending unit is used to generate a traffic recovery instruction based on the IP address of the node to be recovered, the port number of the node to be recovered and the application information to be recovered, and send the traffic recovery instruction to each server that has a communication connection with the rule center.

9. The system according to any one of claims 7-8, characterized in that: The server specifically includes: A third instruction parsing unit is used to parse the traffic restoration instruction after receiving the traffic restoration instruction, obtain the address of the server to be restored that matches the traffic restoration instruction, and send the address of the server to be restored to the third address judgment unit; a third address determination unit, configured to, after receiving the address of the server to be restored, obtain the current address information of the server, and after determining that the current address information is the same as the address of the server to be restored, send the traffic restoration instruction to the second restoration instruction sending unit; The second restoration instruction sending unit is used to send the received traffic restoration instruction to each service node that has a communication connection with the server.

10. The system according to any one of claims 7-8, characterized in that: The service node further includes: A fourth instruction parsing unit, configured to parse the traffic restoration instruction after receiving the traffic restoration instruction, obtain the IP address of the node to be restored and the port number of the node to be restored that match the traffic restoration instruction, and send the IP address of the node to be restored and the port number of the node to be restored to the fourth address judgment unit; The fourth address judgment unit is used to obtain the current IP and current port number of the service node after receiving the IP and port number of the node to be restored, and after judging that the current IP and current port number are the same as the IP and port number of the node to be restored, send the flow recovery instruction to the flow recovery unit; The flow recovery unit is used to, in response to receiving the flow recovery instruction, set the communication channel matching the application information to be recovered in the flow recovery instruction to a normal mode based on the application information to be recovered in the flow recovery instruction to complete the flow recovery operation.

Images