Network transmission management and control method and system for cloud environment

Abstract

The invention discloses a cloud environment-oriented network transmission management and control method and a cloud environment-oriented network transmission management and control system. The method comprises the following steps: configuring a flow table of a network bridge of a cloud environment, and forwarding network traffic sent to the network bridge by a managed and controlled virtual machine and network traffic sent to the managed and controlled virtual machine through the network bridge to a virtual machine where a network transmission management and control system is located; and the network transmission management and control system performs security detection on the network traffic transmitted by the managed and controlled virtual machine and the network traffic transmitted to the managed and controlled virtual machine and forwarded by the network bridge, manages and controls the detected illegal network traffic, and forwards other network traffic to the network bridge.

Description

(I) Technical field

[0001] The present invention relates to the field of computer network technology, and in particular to a network transmission control method and system for a cloud environment. (II) Background technology

[0002] Network transmission control is a technology that limits, manages, and controls network transmission data. Most existing network transmission control systems are deployed on the network boundary side, and control the north-south network transmission by performing security detection and control on the network traffic flowing out and into the network. However, the existing network transmission control methods and systems cannot be applied to cloud environments, cannot control the east-west traffic between cloud computing virtual machines that does not flow through the network boundary, and cannot handle illegal network traffic, making it impossible to ensure the transmission security within the cloud computing environment. (III) Summary of the invention

[0003] In order to solve the above problems, an embodiment of the present invention provides a network transmission control method for a cloud environment.

[0004] In the first aspect, an embodiment of the present invention provides a network transmission control for a cloud environment, including: configuring a flow table of a bridge in the cloud environment, forwarding the network traffic sent from the controlled virtual machine to the bridge and the network traffic sent to the controlled virtual machine via the bridge to the virtual machine where a network transmission control system is located; the network transmission control system performs security detection on the network traffic sent by the controlled virtual machine via the bridge and the network traffic sent to the controlled virtual machine, controls the detected illegal network traffic, and forwards other network traffic to the bridge.

[0005] Furthermore, the network transmission control method for a cloud environment is characterized in that the flow table of the bridge configuring the cloud environment includes:

[0006] Add a flow table rule in the bridge to forward the network traffic sent from the bridge port connected to the controlled virtual machine to the bridge port connected to the virtual machine where the network transmission control system is located;

[0007] Add a flow table rule in the bridge to forward the network traffic with the destination address of the controlled virtual machine flowing through the bridge to the bridge port connected to the virtual machine where the network transmission control system is located;

[0008] A flow table rule is added to the bridge to forward network traffic sent from the bridge port connected to the virtual machine where the network transmission control system is located and whose destination address is the controlled virtual machine to the bridge port connected to the controlled virtual machine.

[0009] Furthermore, the network transmission control method for a cloud environment is characterized in that the control of the detected illegal network traffic includes one or more of the following:

[0010] The network transmission control system discards illegal network traffic and does not forward it to the bridge port connected to the virtual machine where the network transmission control system is located;

[0011] For illegal network traffic based on the transmission control protocol, the network transmission control system sends a constructed spoofed message for resetting the connection to the source node and destination node of the illegal network traffic, and sends a constructed spoofed message based on the transmission control protocol filled with false content to the source node and destination node of the illegal network traffic;

[0012] For illegal network traffic based on the User Datagram Protocol, the network transmission control system sends a constructed counterfeit message based on the User Datagram Protocol filled with false content to the source node and destination node of the network message.

[0013] In the second aspect, an embodiment of the present invention provides a network transmission control system for a cloud environment, including: a flow table configuration module, used to configure the flow table of the bridge of the cloud environment, and forward the network traffic sent from the controlled virtual machine to the bridge and the network traffic sent to the controlled virtual machine via the bridge to the virtual machine where the network transmission control system is located; a security detection module, used to perform security detection on the network traffic; and a transmission control module, used to perform transmission control on illegal network traffic.

[0014] In a third aspect, an embodiment of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of a network transmission control method for a cloud environment according to the first aspect of the present invention are implemented.

[0015] In a fourth aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of a network transmission control method for a cloud environment according to the first aspect of the present invention. (IV) Description of the drawings

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1A flow chart of a network transmission control method for a cloud environment provided by an embodiment of the present invention;

[0018] Figure 2 A diagram of the structure of a network transmission control system for a cloud environment provided by an embodiment of the present invention;

[0019] Figure 3 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention. (V) Specific implementation methods

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Network transmission control is a technology that limits, manages, and controls network transmission data. Most existing network transmission control systems are deployed on the network boundary side, and control the north-south network transmission by performing security detection and control on the traffic flowing out and into the network. However, the existing network transmission control methods and systems cannot be applied to cloud environments, cannot perform security detection on the east-west traffic between cloud computing virtual machines that does not flow through the network boundary, and cannot handle illegal network traffic, making it impossible to control the network transmission of cloud computing.

[0022] The present invention provides a network transmission control method for a cloud environment, so as to solve the problem that the existing network transmission control method is deployed on the network boundary side and cannot perform transmission security control on the traffic between cloud computing virtual machines.

[0023] Figure 1 A flow chart of a network transmission control method for a cloud environment provided by an embodiment of the present invention, such as Figure 1 As shown, an embodiment of the present invention provides a network transmission control method for a cloud environment, comprising:

[0024] 101. Configure the flow table of the bridge of the cloud environment, and forward the network traffic sent from the controlled virtual machine to the bridge and the network traffic sent to the controlled virtual machine via the bridge to the virtual machine where the network transmission control system is located.

[0025] When a virtual machine in a cloud environment is created on a host host, a bridge is also created at the same time, and the network interface of the virtual machine is added to the interface of the bridge. When the network traffic sent from the network interface of the virtual machine reaches the bridge, the bridge will adopt a similar processing method as the physical switch to check the address port mapping table and then forward the network message. According to the network message address and the action specified by the flow table rules, the network data message is forwarded, discarded, etc. By configuring the bridge flow table rules, the network traffic sent from the bridge port connected to the controlled virtual machine and the network traffic sent to the bridge port connected to the controlled virtual machine are forwarded to the virtual machine where the network transmission control system is located, so as to realize the collection and capture of the network traffic of the controlled virtual machine.

[0026] 102. The network transmission control system performs security detection on the network traffic sent by the controlled virtual machine and the network traffic sent to the controlled virtual machine forwarded via the bridge, controls the detected illegal network traffic, and forwards other network traffic to the bridge.

[0027] After the network transmission control system collects and captures the network traffic of the controlled virtual machine, it performs TCP / IP protocol analysis, reorganization and restoration, and application layer protocol analysis on the network traffic, extracts the network traffic data transmitted by the controlled virtual machine, performs network traffic security detection on it, discards the detected illegal network traffic, performs transmission control processing such as counterfeiting and deception, and forwards other network traffic to the bridge, which then transmits and forwards the network traffic normally.

[0028] Based on the content of the above embodiment, as an optional embodiment, the network transmission control method for a cloud environment is characterized in that the flow table of the bridge configuring the cloud environment includes:

[0029] Add a flow table rule in the bridge to forward the network traffic sent from the bridge port connected to the controlled virtual machine to the bridge port connected to the virtual machine where the network transmission control system is located;

[0030] Add a flow table rule in the bridge to forward the network traffic with the destination address of the controlled virtual machine flowing through the bridge to the bridge port connected to the virtual machine where the network transmission control system is located;

[0031] A flow table rule is added to the bridge to forward network traffic sent from the bridge port connected to the virtual machine where the network transmission control system is located and whose destination address is the controlled virtual machine to the bridge port connected to the controlled virtual machine.

[0032] When the network traffic sent from the virtual machine network interface reaches the bridge, the bridge will adopt a similar processing method as the physical switch to check the address port mapping table and then forward the network message. According to the network message address and the action specified by the flow table rules, the network data message will be forwarded, discarded, etc. The network transmission control system needs to collect and capture the network traffic sent and received by the controlled virtual machine. By configuring the flow table of the bridge in the cloud environment, the network traffic sent by the controlled virtual machine and the network traffic sent to the controlled virtual machine can be forwarded to the network transmission control system for security detection and control processing.

[0033] For the network traffic sent by the controlled virtual machine, configure the bridge flow table rules to forward the network traffic sent from the bridge port connected to the controlled virtual machine to the bridge port connected to the virtual machine where the network transmission control system is located. The network transmission control system collects and captures the network traffic, and then transmits the network traffic that has been security-checked and controlled by the network transmission control system back to the bridge through the bridge port connected to the virtual machine where the network transmission control system is located. The bridge forwards the network traffic in the normal processing mode.

[0034] For the network traffic sent to the controlled virtual machine, configure the bridge flow table rules to forward the network traffic with the destination address being the controlled virtual machine address to the bridge port connected to the virtual machine where the network transmission control system is located. The network transmission control system collects and captures the network traffic, and then transmits the network traffic that has been security-checked and controlled by the network transmission control system back to the bridge through the bridge port connected to the virtual machine where the network transmission control system is located. At this time, it is necessary to add another bridge flow table rule with a higher priority so that the bridge forwards the network traffic with the destination address being the controlled virtual machine address sent from the bridge port connected to the virtual machine where the network transmission control system is located to the bridge port connected to the controlled virtual machine, thereby achieving normal forwarding of the network traffic and avoiding forwarding the network traffic again to the bridge port connected to the virtual machine where the network transmission control system is located.

[0035] Based on the content of the above embodiment, as an optional embodiment, the network transmission control method for cloud environment is characterized in that the control of the detected illegal network traffic includes one or more of the following:

[0036] The network transmission control system discards illegal network traffic and does not forward it to the bridge port connected to the virtual machine where the network transmission control system is located;

[0037] For illegal network traffic based on the transmission control protocol, the network transmission control system sends a constructed spoofed message for resetting the connection to the source node and destination node of the illegal network traffic, and sends a constructed spoofed message based on the transmission control protocol filled with false content to the source node and destination node of the illegal network traffic;

[0038] For illegal network traffic based on the User Datagram Protocol, the network transmission control system sends a constructed counterfeit message based on the User Datagram Protocol filled with false content to the source node and destination node of the network message.

[0039] When network traffic is transmitted between a controlled virtual machine and a peer node, the network transmission control system is located between the controlled virtual machine and other nodes. When a controlled virtual machine (or peer node) transmits network traffic, it can only be forwarded to the peer node (or controlled virtual machine) after security detection by the network transmission control system. When the network transmission control system detects illegal network traffic, it can control the illegal network traffic in a variety of ways.

[0040] When the discard strategy is adopted, the network traffic transmitted by the controlled virtual machine (or peer node) cannot reach the peer node (or controlled virtual machine).

[0041] When illegal network traffic is transmitted between the controlled virtual machine and the peer node, the illegal data is encapsulated as a load in a network data message based on the transmission control protocol or the user datagram protocol for transmission. For the network message based on the transmission control protocol, the network transmission control system extracts the sequence number, confirmation number, source port, destination port and other information of the transmission control protocol layer header. The network transmission control system constructs a counterfeit message based on the transmission control protocol, fills the extracted sequence number, confirmation number, source port, destination port and other information into the constructed counterfeit message for resetting the connection, sets the reset connection position of the transmission control protocol layer header to 1, and fills in the protocol header information including the checksum, and then sends the counterfeit message to the source node and destination node (controlled virtual machine and peer node) of the illegal network traffic. Construct the counterfeit message again, fill the false content into the counterfeit message, fill the extracted sequence number, confirmation number, source port, destination port and other information into the transmission control protocol layer header of the constructed counterfeit message, and fill in the protocol header information including the checksum, and then send the counterfeit message to the source node and destination node of the network message. When a node receives a counterfeit message for resetting the connection, it will reset the connection to implement control over network transmission. The network transmission control system is located between the source node and the destination node (the controlled virtual machine and the peer node) of the illegal network traffic. The constructed counterfeit message based on the transmission control protocol filled with false content will arrive at the peer node (or the controlled virtual machine) before the controlled virtual machine (or the peer node). According to the transmission control protocol, the node will discard the content of the network message that overlaps with the sequence number of the received network message, so that the controlled virtual machine (or the peer node) cannot receive the correct network data for transmission, thereby implementing control over network transmission.

[0042] For network messages based on the User Datagram Protocol, the network transmission control system extracts the source port, destination port and other information from the User Datagram Protocol layer header. The network transmission control system constructs a counterfeit message, fills the false content into the counterfeit message, fills the extracted source port, destination port and other information into the User Datagram Protocol layer header of the constructed counterfeit message, and fills in the protocol header information including the false content length and checksum, and then sends the counterfeit message to the source node and destination node (controlled virtual machine and peer node) of the illegal network traffic. According to the User Datagram Protocol, the node will piece together all the received network message contents including the counterfeit message sent by the network transmission control system, so that the controlled virtual machine (or peer node) can receive network data containing false content, thereby realizing the control of network transmission.

[0043] Figure 2 The structure diagram of the network transmission control system for cloud environment provided by the embodiment of the present invention is as follows: Figure 2As shown, the network transmission control system for cloud environment includes: flow table configuration module 201, security detection module 202, and transmission control module 203. Among them, the flow table configuration module 201 is used to configure the flow table of the bridge of the cloud environment, and forward the network traffic sent from the controlled virtual machine to the bridge and the network traffic sent to the controlled virtual machine via the bridge to the virtual machine where the network transmission control system is located; the security detection module 202 is used to perform security detection on the network traffic; and the transmission control module 203 is used to perform transmission control on illegal network traffic.

[0044] The system embodiment provided in the embodiment of the present invention is to implement the above-mentioned method embodiments. Please refer to the above-mentioned method embodiments for specific processes and detailed contents, which will not be repeated here.

[0045] The network transmission control system for cloud environments provided by the embodiment of the present invention configures the flow table of the bridge of the cloud environment, and forwards the network traffic sent from the controlled virtual machine to the bridge and the network traffic sent to the controlled virtual machine via the bridge to the bridge port connected to the virtual machine where the network transmission control system is located. The network transmission control system collects and captures network traffic, performs security detection, and controls illegal network traffic through a variety of methods including discarding. For illegal network traffic based on the transmission control protocol, the network transmission control system constructs a counterfeit message for resetting the connection and sends it to the source node and destination node (controlled virtual machine and opposite node) of the illegal network traffic, so that the source node and destination node (controlled virtual machine and opposite node) reset the connection, thereby realizing the control of network transmission; and sends the constructed counterfeit message based on the transmission control protocol filled with false content to the source node and destination node (controlled virtual machine and opposite node) of the illegal network traffic. Since the network transmission control system is located between the source node and destination node (controlled virtual machine and opposite node) of the illegal network traffic, the counterfeit message will arrive at the opposite node (or controlled virtual machine) before the controlled virtual machine (or opposite node). According to the transmission control protocol, the node will discard the content of the network message that overlaps with the sequence number of the received network message, so that the controlled virtual machine (or opposite node) can not receive the correct network data transmitted, thereby realizing the control of network transmission. For network messages based on the User Datagram Protocol, the network transmission control system will construct a counterfeit message based on the User Datagram Protocol filled with false content and send it to the source node and destination node (controlled virtual machine and peer node) of the illegal network traffic. According to the User Datagram Protocol, the node will piece together all the received network message contents including the counterfeit message sent by the network transmission control system, so that the controlled virtual machine (or peer node) can receive network data containing false content, thereby realizing the control of network transmission. Then, the network transmission control system forwards other network traffic to the bridge, and the bridge will transmit and forward network traffic normally.

[0046] Figure 3 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention, such as Figure 3 As shown, the electronic device may include: a processor 301, a communication interface 302, a memory 303 and a bus 304, wherein the processor 301, the communication interface 302, and the memory 303 complete mutual communication through the bus 304. The communication interface 302 can be used for information transmission of the electronic device. The processor 301 can call the logic instructions in the memory 303 to execute the following method: configure the flow table of the bridge of the cloud environment, forward the network traffic sent by the controlled virtual machine to the bridge and the network traffic sent to the controlled virtual machine through the bridge to the virtual machine where the network transmission control system is located; the network transmission control system performs security detection on the network traffic sent by the controlled virtual machine forwarded through the bridge and the network traffic sent to the controlled virtual machine, controls the detected illegal network traffic, and forwards other network traffic to the bridge.

[0047] In addition, the logic instructions in the above-mentioned memory 303 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the above-mentioned method embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0048] On the other hand, an embodiment of the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the transmission methods provided by the above-mentioned embodiments, for example including: configuring the flow table of the bridge of the cloud environment, forwarding the network traffic sent from the controlled virtual machine to the bridge and the network traffic sent to the controlled virtual machine via the bridge to the virtual machine where the network transmission control system is located; the network transmission control system performs security detection on the network traffic sent by the controlled virtual machine forwarded via the bridge and the network traffic sent to the controlled virtual machine, controls the detected illegal network traffic, and forwards other network traffic to the bridge.

[0049] The system embodiment described above is merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0050] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0051] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network transmission control method for a cloud environment, characterized in that: include: Configure the flow table of the bridge of the cloud environment to forward the network traffic sent from the controlled virtual machine to the bridge and the network traffic sent to the controlled virtual machine via the bridge to the virtual machine where the network transmission control system is located; The network transmission control system performs security detection on the network traffic sent by the controlled virtual machine and the network traffic sent to the controlled virtual machine forwarded via the bridge, controls the detected illegal network traffic flows, and forwards other network traffic to the bridge.

2. The network transmission control method for cloud environment according to claim 1 is characterized in that: The flow table of the bridge configured in the cloud environment includes: Add a flow table rule in the bridge to forward the network traffic sent from the bridge port connected to the controlled virtual machine to the bridge port connected to the virtual machine where the network transmission control system is located; Add a flow table rule in the bridge to forward the network traffic with the destination address of the controlled virtual machine flowing through the bridge to the bridge port connected to the virtual machine where the network transmission control system is located; A flow table rule is added to the bridge to forward network traffic sent from the bridge port connected to the virtual machine where the network transmission control system is located and whose destination address is the controlled virtual machine to the bridge port connected to the controlled virtual machine.

3. The network transmission control method for cloud environment according to claim 1 is characterized in that: The control of the detected illegal network traffic includes one or more of the following: The network transmission control system discards illegal network traffic and does not forward it to the bridge port connected to the virtual machine where the network transmission control system is located; For illegal network traffic based on the transmission control protocol, the network transmission control system sends a constructed spoofed message for resetting the connection to the source node and destination node of the illegal network traffic, and sends a constructed spoofed message based on the transmission control protocol filled with false content to the source node and destination node of the illegal network traffic; For illegal network traffic based on the User Datagram Protocol, the network transmission control system sends a constructed counterfeit message based on the User Datagram Protocol filled with false content to the source node and destination node of the network message.

4. A network transmission control system for cloud environment, characterized in that: include: A flow table configuration module is used to configure the flow table of the bridge of the cloud environment, and forward the network traffic sent from the controlled virtual machine to the bridge and the network traffic sent to the controlled virtual machine via the bridge to the virtual machine where the network transmission control system is located; Security detection module, used to perform security detection on network traffic; The transmission control module is used to control the transmission of illegal network traffic.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the network transmission control method for a cloud environment as described in any one of claims 1 to 3 are implemented.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network transmission control method for a cloud environment as described in any one of claims 1 to 3 are implemented.

Images