Container communication method and device based on multicast technology

Abstract

The invention provides a container communication method and device based on a multicast technology, and the method comprises the steps: receiving a container query instruction, and determining a container group to which the container query instruction belongs; sending the container query instruction to the container group, so that the container group receiving the container query instruction multicasts the container query instruction in the group; and if a certain target container group receiving the container query instruction receives response information fed back by a target container, extracting a container identifier of the target container from the response information, and feeding back the container identifier to an initiator of the container query instruction. According to the technical scheme provided by the invention, the query efficiency of the container in the container network can be improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a container communication method and device based on multicast technology. Background Art

[0002] In current container networks, when a container needs to be queried, the network address of the container is usually required. However, in actual applications, the specific network address of the container may not be available, which makes it impossible to advance the progress of the container query.

[0003] In addition, as the number of containers in the container network continues to increase, the query usually takes a long time. In view of this, a more efficient container query method is currently needed. Summary of the invention

[0004] The present invention provides a container communication method and device based on multicast technology, which can improve the query efficiency of containers in a container network.

[0005] In view of this, the present invention provides a container communication method based on multicast technology on one hand, the method comprising:

[0006] receiving a container query instruction, and determining a container group to which the container query instruction belongs;

[0007] Sending the container query instruction to the container group, so that the container group receiving the container query instruction multicasts the container query instruction within the group;

[0008] If a target container group that receives the container query instruction receives response information fed back by the target container, the container identifier of the target container is extracted from the response information, and the container identifier is fed back to the initiator of the container query instruction.

[0009] In one embodiment, determining the container group to which the container query instruction belongs includes:

[0010] Identify the network segment address carried in the container query instruction, and query the group identifier mapped to the network segment address from a pre-stored group search table;

[0011] The container group represented by each of the group identifiers is used as the container group to which the container query instruction belongs.

[0012] In one embodiment, the method further comprises:

[0013] Each container in the container group monitors the multicast container query instruction on the protocol stack of the operating system kernel;

[0014] When a multicast container query instruction is detected, it is determined whether the source of the container query instruction is allowed according to the pre-configured multicast filtering policy. If not allowed, the container query instruction is filtered and intercepted; otherwise, the container query instruction is allowed to pass.

[0015] In one embodiment, the method further comprises:

[0016] Extract the query instruction for filtering and interception per unit time, wherein the value range of the unit time is 1min-3min;

[0017] The query instructions filtered and intercepted in each unit time are used to obtain the interception instruction abnormality coefficient corresponding to each unit time;

[0018] The interception instruction abnormality coefficient corresponding to each unit time is obtained by the following formula:

[0019]

[0020] Among them, S represents the interception instruction abnormality coefficient corresponding to each unit time; n represents the number of interception instructions corresponding to each unit time; P i represents the recurrence rate of the source corresponding to the i-th intercepted instruction; Pc represents the overall interception success rate corresponding to the intercepted instruction; N represents the total number of instructions corresponding to each unit time; Ф represents the standard deviation of the number of intercepted instructions corresponding to the m unit time that the container query instruction has been running;

[0021] Compare the interception instruction abnormality coefficient corresponding to each unit time with a preset interception instruction abnormality coefficient;

[0022] When the interception instruction abnormality coefficient corresponding to the unit time exceeds the preset interception instruction abnormality coefficient, the interception instruction abnormality coefficients corresponding to all unit times are retrieved;

[0023] Obtaining a comprehensive abnormality coefficient using the interception instruction abnormality coefficients corresponding to all the unit times;

[0024] The comprehensive anomaly coefficient is obtained by the following formula:

[0025]

[0026] Where A represents the comprehensive abnormality coefficient; m represents the number of unit times that the container query instruction has been executed; S i represents the interception instruction abnormality coefficient corresponding to the i-th unit time; k represents the adjustment coefficient, and the value range of the adjustment coefficient is 0.47-0.62; S b represents the standard deviation of the interception instruction abnormality coefficient corresponding to m unit time; S zrepresents the middle value of the interception instruction abnormality coefficient corresponding to m unit time; S p It represents the average value of the abnormal coefficient of interception instructions corresponding to m unit time;

[0027] Comparing the comprehensive abnormal coefficient with a preset abnormal coefficient threshold;

[0028] When the comprehensive abnormality coefficient exceeds a preset abnormality coefficient threshold, the instruction interception is determined to be abnormal, and an abnormality alarm is issued.

[0029] In one embodiment, after receiving the container query instruction, the method further includes:

[0030] Calling the cloud gateway process to parse the container query instruction and obtain a network layer request message;

[0031] When the network layer request message is an HTTP request message for a designated service, the network layer request message is written to the loopback interface using a universal plug and play module defined by the designated service; wherein the designated service is an automatic port mapping service requested by the universal plug and play module.

[0032] In one embodiment, after writing the network layer request message to the loopback interface, the method further includes:

[0033] Responding to the network layer request layer message using the protocol stack of the virtual network port device to generate a connection confirmation message;

[0034] The connection confirmation message is read from the loopback interface, and the connection confirmation message is sent to the initiator of the container query request.

[0035] Another aspect of the present invention provides a container communication device based on multicast technology, the device comprising:

[0036] An instruction processing unit, configured to receive a container query instruction and determine a container group to which the container query instruction belongs;

[0037] An instruction sending unit, configured to send the container query instruction to the container group, so that the container group receiving the container query instruction multicasts the container query instruction within the group;

[0038] The container query unit is used to extract the container identifier of the target container from the response information if a target container group that receives the container query instruction receives the response information fed back by the target container, and feed back the container identifier to the initiator of the container query instruction.

[0039] In one embodiment, the instruction processing unit is specifically used to identify the network segment address carried in the container query instruction, and query the group identifier mapped to the network segment address from a pre-stored group search table; and use the container group represented by each group identifier as the container group to which the container query instruction belongs.

[0040] In one embodiment, the device further comprises:

[0041] A monitoring unit, used for monitoring multicast container query instructions on a protocol stack of an operating system kernel;

[0042] The instruction recognition unit is used to determine whether the source of the container query instruction is allowed according to the pre-configured multicast filtering policy when monitoring the multicast container query instruction. If it is not allowed, the container query instruction is filtered and intercepted; otherwise, the container query instruction is allowed to pass.

[0043] The technical solution provided by the present invention divides different container groups in a container network. After receiving a container query instruction, the container group can be located first, and then a container can be quickly found in the container group, thereby improving the query efficiency of containers in a complex container network.

[0044] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings.

[0045] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0047] Figure 1 This is a schematic diagram of the steps of a container communication method based on multicast technology in an embodiment of the present invention;

[0048] Figure 2 The present invention is a schematic diagram of functional modules of a container communication device based on multicast technology in an embodiment of the present invention. DETAILED DESCRIPTION

[0049] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0050] See also Figure 1 An embodiment of the present application provides a container communication method based on multicast technology, and the method includes the following steps.

[0051] S1: Receive a container query instruction, and determine the container group to which the container query instruction belongs.

[0052] S2: Send the container query instruction to the container group, so that the container group that receives the container query instruction multicasts the container query instruction within the group.

[0053] S3: If a target container group that receives the container query instruction receives response information fed back by the target container, extract the container identifier of the target container from the response information, and feed back the container identifier to the initiator of the container query instruction.

[0054] In this embodiment, the containers in the container network can be grouped according to the network segment address of the container. Among them, the network segment address of the container can be the result of an "AND" operation between a specific network address and a network mask. In practical applications, it may be difficult to obtain the specific network address of the container, but usually the network segment address of the container can be directly obtained. In this way, the network segment address of the container to be queried and the container identifier of the container are added to the container query instruction, and a container query request can be initiated to the container network.

[0055] In this embodiment, after receiving the container query request, the network segment address carried in the container query instruction can be first identified, and the group identifier mapped to the network segment address can be queried from the pre-stored group search table. Specifically, in the group search table, there can be a mapping relationship between the group identifier of the container group and the network segment address. In this way, the mapped group identifier can be queried in the group search table by using the network segment address as the search condition. Subsequently, the container group represented by each of the group identifiers can be used as the container group to which the container query instruction belongs.

[0056] In this embodiment, each container in the container group can monitor the multicast container query instruction on the protocol stack of the operating system kernel; when the multicast container query instruction is monitored, the container can determine whether the source of the container query instruction is allowed according to the pre-configured multicast filtering policy. Among them, the multicast filtering policy may include a source whitelist. When the device of the multicast container query request is in the source whitelist, it indicates that the source is allowed, otherwise it indicates that the source is not allowed. In this embodiment, if it is not allowed, the container query instruction is filtered and intercepted, otherwise the container query instruction is allowed to pass.

[0057] In one embodiment, the method further comprises:

[0058] Each container in the container group monitors the multicast container query instruction on the protocol stack of the operating system kernel;

[0059] When a multicast container query instruction is detected, it is determined whether the source of the container query instruction is allowed according to the pre-configured multicast filtering policy. If not allowed, the container query instruction is filtered and intercepted; otherwise, the container query instruction is allowed to pass.

[0060] In one embodiment, the method further comprises:

[0061] Extract the query instruction for filtering and interception per unit time, wherein the value range of the unit time is 1min-3min;

[0062] The query instructions filtered and intercepted in each unit time are used to obtain the interception instruction abnormality coefficient corresponding to each unit time;

[0063] The interception instruction abnormality coefficient corresponding to each unit time is obtained by the following formula:

[0064]

[0065] Among them, S represents the interception instruction abnormality coefficient corresponding to each unit time; n represents the number of interception instructions corresponding to each unit time; P i represents the recurrence rate of the source corresponding to the i-th intercepted instruction; Pc represents the overall interception success rate corresponding to the intercepted instruction; N represents the total number of instructions corresponding to each unit time; Ф represents the standard deviation of the number of intercepted instructions corresponding to the m unit time that the container query instruction has been running;

[0066] Compare the interception instruction abnormality coefficient corresponding to each unit time with a preset interception instruction abnormality coefficient;

[0067] When the interception instruction abnormality coefficient corresponding to the unit time exceeds the preset interception instruction abnormality coefficient, the interception instruction abnormality coefficients corresponding to all unit times are retrieved;

[0068] Obtaining a comprehensive abnormality coefficient using the interception instruction abnormality coefficients corresponding to all the unit times;

[0069] The comprehensive anomaly coefficient is obtained by the following formula:

[0070]

[0071] Where A represents the comprehensive abnormality coefficient; m represents the number of unit times that the container query instruction has been executed; S irepresents the interception instruction abnormality coefficient corresponding to the i-th unit time; k represents the adjustment coefficient, and the value range of the adjustment coefficient is 0.47-0.62; S b represents the standard deviation of the interception instruction abnormality coefficient corresponding to m unit time; S z represents the middle value of the interception instruction abnormality coefficient corresponding to m unit time; S p It represents the average value of the abnormal coefficient of interception instructions corresponding to m unit time;

[0072] Comparing the comprehensive abnormal coefficient with a preset abnormal coefficient threshold;

[0073] When the comprehensive abnormality coefficient exceeds a preset abnormality coefficient threshold, the instruction interception is determined to be abnormal, and an abnormality alarm is issued.

[0074] The technical effect of the above technical solution is: extracting the query instructions filtered and intercepted per unit time (1min-3min). This time granularity selection enables the system to capture the dynamic changes of instruction interception in a short time, improving the real-time detection. The preset unit time range (1min-3min) provides flexibility for the system, and the time unit can be adjusted according to actual needs to better adapt to different application scenarios and performance requirements. By calculating the interception instruction anomaly coefficient corresponding to each unit time, the number of intercepted instructions, the recurrence rate of the instruction source, the overall interception success rate, and the total number of instructions are comprehensively considered, making the anomaly identification more accurate. The standard deviation (Ф) of the number of intercepted instructions corresponding to the m unit time that the container query instruction has been running is introduced to further enhance the sensitivity of anomaly detection and capture the fluctuation of the number of instruction interception. When the interception instruction anomaly coefficient of a certain unit time exceeds the preset value, the interception instruction anomaly coefficients of all unit times are retrieved for comprehensive evaluation, which helps to comprehensively analyze the abnormal situation and avoid false alarms or omissions. By calculating the comprehensive anomaly coefficient (A) and combining multiple statistics such as the adjustment coefficient (k), standard deviation (Sb), median value (Sz) and average value (Sp), a quantitative assessment of abnormal situations is achieved, which improves the accuracy of early warning. When the comprehensive anomaly coefficient exceeds the preset anomaly coefficient threshold, the system automatically determines that the instruction interception is abnormal and issues an alarm, which helps to promptly discover and deal with potential security threats and ensure the stable operation of the system. The entire technical solution realizes the automatic monitoring and anomaly identification of instruction interception, reduces the need for manual intervention, and improves work efficiency. By introducing multiple statistics and calculation formulas, an intelligent assessment of abnormal situations is achieved, providing a scientific and reliable decision-making basis for system operation and maintenance personnel.

[0075] To sum up, this technical solution realizes accurate identification and timely warning of instruction interception anomalies through real-time extraction and comprehensive analysis of instruction interception situations within unit time, providing strong guarantee for the safe and stable operation of the system.

[0076] In one embodiment, after receiving the container query instruction, the container in the container group can call the cloud gateway process to parse the container query instruction to obtain the network layer request message. Wherein, when the network layer request message is an HTTP request message for a specified service, the network layer request message can be written to the loopback interface using the universal plug and play module defined by the specified service; wherein, the specified service is a request automatic port mapping service of the universal plug and play module.

[0077] In one embodiment, after writing the network layer request message to the loopback interface, the container can use the protocol stack of the virtual network port device to respond to the network layer request layer message to generate a connection confirmation message. Subsequently, the connection confirmation message can be read from the loopback interface and sent to the initiator of the container query request, thereby informing the initiator of the container query request that the container query request has been received.

[0078] See also Figure 2 Another aspect of the present invention provides a container communication device based on multicast technology, the device comprising:

[0079] An instruction processing unit, configured to receive a container query instruction and determine a container group to which the container query instruction belongs;

[0080] An instruction sending unit, configured to send the container query instruction to the container group, so that the container group receiving the container query instruction multicasts the container query instruction within the group;

[0081] The container query unit is used to extract the container identifier of the target container from the response information if a target container group that receives the container query instruction receives the response information fed back by the target container, and feed back the container identifier to the initiator of the container query instruction.

[0082] In one embodiment, the instruction processing unit is specifically used to identify the network segment address carried in the container query instruction, and query the group identifier mapped to the network segment address from a pre-stored group search table; and use the container group represented by each group identifier as the container group to which the container query instruction belongs.

[0083] In one embodiment, the device further comprises:

[0084] A monitoring unit, used for monitoring multicast container query instructions on a protocol stack of an operating system kernel;

[0085] The instruction recognition unit is used to determine whether the source of the container query instruction is allowed according to the pre-configured multicast filtering policy when monitoring the multicast container query instruction. If it is not allowed, the container query instruction is filtered and intercepted; otherwise, the container query instruction is allowed to pass.

[0086] The technical solution provided by the present invention divides different container groups in a container network. After receiving a container query instruction, the container group can be located first, and then a container can be quickly found in the container group, thereby improving the query efficiency of containers in a complex container network.

[0087] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A container communication method based on multicast technology, characterized in that: The method comprises: receiving a container query instruction, and determining a container group to which the container query instruction belongs; Sending the container query instruction to the container group, so that the container group receiving the container query instruction multicasts the container query instruction within the group; If a target container group that receives the container query instruction receives response information fed back by the target container, the container identifier of the target container is extracted from the response information, and the container identifier is fed back to the initiator of the container query instruction.

2. The method according to claim 1, characterized in that Determining the container group to which the container query instruction belongs includes: Identify the network segment address carried in the container query instruction, and query the group identifier mapped to the network segment address from a pre-stored group search table; The container group represented by each of the group identifiers is used as the container group to which the container query instruction belongs.

3. The method according to claim 1, characterized in that The method further comprises: Each container in the container group monitors the multicast container query instruction on the protocol stack of the operating system kernel; When a multicast container query instruction is detected, it is determined whether the source of the container query instruction is allowed according to the pre-configured multicast filtering policy. If not allowed, the container query instruction is filtered and intercepted; otherwise, the container query instruction is allowed to pass.

4. The method according to claim 3, characterized in that The method further comprises: Extract the query instruction for filtering and interception per unit time, wherein the value range of the unit time is 1min-3min; The query instructions filtered and intercepted in each unit time are used to obtain the interception instruction abnormality coefficient corresponding to each unit time; The interception instruction abnormality coefficient corresponding to each unit time is obtained by the following formula: Among them, S represents the interception instruction abnormality coefficient corresponding to each unit time; n represents the number of interception instructions corresponding to each unit time; P i represents the recurrence rate of the source corresponding to the i-th intercepted instruction; Pc represents the overall interception success rate corresponding to the intercepted instruction; N represents the total number of instructions corresponding to each unit time; Ф represents the standard deviation of the number of intercepted instructions corresponding to the m unit time that the container query instruction has been running; Compare the interception instruction abnormality coefficient corresponding to each unit time with a preset interception instruction abnormality coefficient; When the interception instruction abnormality coefficient corresponding to the unit time exceeds the preset interception instruction abnormality coefficient, the interception instruction abnormality coefficients corresponding to all unit times are retrieved; Obtaining a comprehensive abnormality coefficient using the interception instruction abnormality coefficients corresponding to all the unit times; The comprehensive anomaly coefficient is obtained by the following formula: Where A represents the comprehensive abnormality coefficient; m represents the number of unit times that the container query instruction has been executed; S i represents the interception instruction abnormality coefficient corresponding to the i-th unit time; k represents the adjustment coefficient, and the value range of the adjustment coefficient is 0.47-0.62; S b represents the standard deviation of the interception instruction abnormality coefficient corresponding to m unit time; S z represents the middle value of the interception instruction abnormality coefficient corresponding to m unit time; S p It represents the average value of the abnormal coefficient of interception instructions corresponding to m unit time; Comparing the comprehensive abnormal coefficient with a preset abnormal coefficient threshold; When the comprehensive abnormality coefficient exceeds a preset abnormality coefficient threshold, the instruction interception is determined to be abnormal, and an abnormality alarm is issued.

5. The method according to claim 1, characterized in that After receiving the container query instruction, the method further includes: Calling the cloud gateway process to parse the container query instruction and obtain a network layer request message; When the network layer request message is an HTTP request message for a designated service, the network layer request message is written to the loopback interface using a universal plug and play module defined by the designated service; wherein the designated service is an automatic port mapping service requested by the universal plug and play module.

6. The method according to claim 5, characterized in that After writing the network layer request message to the loopback interface, the method further includes: Responding to the network layer request layer message using the protocol stack of the virtual network port device to generate a connection confirmation message; The connection confirmation message is read from the loopback interface, and the connection confirmation message is sent to the initiator of the container query request.

7. A container communication device based on multicast technology, characterized in that: The device comprises: An instruction processing unit, configured to receive a container query instruction and determine a container group to which the container query instruction belongs; An instruction sending unit, configured to send the container query instruction to the container group, so that the container group receiving the container query instruction multicasts the container query instruction within the group; The container query unit is used to extract the container identifier of the target container from the response information if a target container group that receives the container query instruction receives the response information fed back by the target container, and feed back the container identifier to the initiator of the container query instruction.

8. The device according to claim 7, characterized in that The instruction processing unit is specifically used to identify the network segment address carried in the container query instruction, and query the group identifier mapped to the network segment address from a pre-stored group search table; and use the container group represented by each group identifier as the container group to which the container query instruction belongs.

9. The device according to claim 8, characterized in that The device also includes: A monitoring unit, used for monitoring multicast container query instructions on a protocol stack of an operating system kernel; The instruction recognition unit is used to determine whether the source of the container query instruction is allowed according to the pre-configured multicast filtering policy when monitoring the multicast container query instruction. If it is not allowed, the container query instruction is filtered and intercepted; otherwise, the container query instruction is allowed to pass.

Images