Cluster Network Traffic Control Method, Product, Device and Medium

Abstract

The present invention discloses a method, product, device and medium for cluster network traffic control, which relates to the field of computer technology, and includes: collecting current subnet information, current access control rule files and current malicious network traffic characteristics in a container cluster; dividing the subnet addresses in the current subnet information into each subnet address set, classifying the current access control rule files to obtain each rule address set, and obtaining the container addresses corresponding to the current malicious network traffic characteristics; respectively generating each new access control rule based on each subnet address set, each rule address set and the container addresses, and determining the priority of each new access control rule; and sending each new access control rule to the kernel of each virtual switch in the container cluster according to the priority, so that each virtual switch controls the network traffic according to each new access control rule. The access control rules are adjusted more reasonably, thereby improving the control reliability of the cluster network traffic.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and particularly to a method, product, device and medium for controlling cluster network traffic. Background Art

[0002] With the rapid development of cloud computing and container technology, Kubernetes, as a mainstream container orchestration platform, has been widely applied to various large-scale distributed systems. Kubernetes provides powerful functions for automatic deployment, expansion and management, enabling applications to run more efficiently and elastically. However, with the expansion of the scale of the Kubernetes cluster and the complication of usage scenarios, network security issues have become increasingly prominent.

[0003] In a Kubernetes cluster, network communication mainly depends on the interconnection between containers, which makes access control the key to ensuring system security. Therefore, access control lists (ACLs) are usually deployed in the Kubernetes cluster to manage and control network traffic.

[0004] However, with the dynamic changes of applications, the sharp increase in network traffic and the increase in potential threats, the traditional static access control rule management method has been difficult to meet the actual needs. This static method is not only difficult to cope with the dynamically changing network environment, but also easily leads to redundancy and conflicts of access control rules, resulting in low reliability of cluster network traffic control, thus affecting system performance and security.

[0005] It can be seen that how to more reasonably adjust access control rules to improve the reliability of cluster network traffic control is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0006] The purpose of the embodiments of the present invention is to provide a method, device, equipment and medium for controlling cluster network traffic, which can more reasonably adjust access control rules to improve the reliability of cluster network traffic control. The specific solutions are as follows:

[0007] In a first aspect, the present invention discloses a method for controlling cluster network traffic, including:

[0008] Collecting current subnet information, current access control rule files and current malicious network traffic characteristics in a container cluster;

[0009] Dividing the subnet addresses in the current subnet information into each subnet address set, classifying the current access control rule file to obtain each rule address set, and obtaining the container addresses corresponding to the current malicious network traffic characteristics;

[0010] Generate respective new access control rules based on each of the subnet address sets, each of the rule address sets, and the container address, and determine the priorities of each of the new access control rules;

[0011] Distribute each of the new access control rules to the kernels of each virtual switch in the container cluster according to the priorities, so that each virtual switch controls network traffic according to each of the new access control rules.

[0012] Optionally, collect the current subnet information in the container cluster, including:

[0013] Collect the current private subnet information of each private subnet and the current public subnet information of each public subnet in the container cluster; wherein, the current private subnet information includes the whitelist address set and the whitelist namespace set of each private subnet, and the current public subnet information includes the blacklist address set and the blacklist namespace set of each public subnet.

[0014] Optionally, the dividing the subnet addresses in the current subnet information into each subnet address set includes:

[0015] Divide all the subnet addresses in the current private subnet information into a first subnet address set;

[0016] Take the difference between the first address corresponding to the whitelist namespace set and the second address in the whitelist address set, and divide the obtained first differential subnet address into a second subnet address set.

[0017] Optionally, generating each new access control rule based on each of the subnet address sets includes:

[0018] Determine a source address set and a destination address set based on the first subnet address set and the second subnet address set to generate a new access control rule of the allow - passing type;

[0019] Determine the address set other than the first subnet address set and the second subnet address set as the target address set, and determine a source address set and a destination address set based on the target address set and the first subnet address set to generate a new access control rule of the deny - passing type.

[0020] Optionally, the dividing the subnet addresses in the current subnet information into each subnet address set includes:

[0021] Divide all the subnet addresses in the current public subnet information into a third subnet address set, take the difference between the third address corresponding to the blacklist namespace set and the fourth address in the blacklist address set, and divide the obtained second differential subnet address into a fourth subnet address set.

[0022] Optionally, generating new access control rules based on each of the subnet address sets includes:

[0023] Determining a source address set and a destination address set based on the third subnet address set and the address set other than the fourth subnet address set to generate a new access control rule of the allow - passage type;

[0024] Using the third subnet address set and the fourth subnet address set as the source address set and the destination address set respectively to generate a new access control rule of the deny - passage type.

[0025] Optionally, the information recorded in the current access control rule file includes the in - direction of traffic and the out - direction of traffic, and each of the rule address sets includes a scope - of - action network segment rule address set and an access control rule address set;

[0026] Correspondingly, generating new access control rules based on each of the rule address sets includes:

[0027] Determining a destination address set and a source address set based on the scope - of - action network segment rule address set and the access control rule address set to generate new access control rules of the allow - passage type, new access control rules of the deny - passage type, and new access control rules of the discard type respectively for the in - direction of traffic and the out - direction of traffic.

[0028] Optionally, determining a destination address set and a source address set based on the scope - of - action network segment rule address set and the access control rule address set to generate new access control rules of the allow - passage type for the in - direction of traffic and the out - direction of traffic respectively includes:

[0029] For the in - direction of traffic, using the scope - of - action network segment rule address set as the destination address set and the access control rule address set as the source address set to generate a new access control rule of the allow - passage type;

[0030] Using the scope - of - action network segment rule address set as the source address set and the access control rule address set as the destination address set to generate a new access control rule of the allow - passage type for the out - direction of traffic.

[0031] Optionally, generating new access control rules of the deny - passage type and new access control rules of the discard type for the in - direction of traffic and the out - direction of traffic respectively includes:

[0032] Generating initial access control rules of the deny - passage type and initial access control rules of the discard type for the in - direction of traffic and the out - direction of traffic respectively;

[0033] Differentiate the initial access control rules of the denied access type from the current access control rules of the denied access type to obtain new access control rules of the denied access type, and differentiate the initial access control rules of the discard type from the current access control rules of the discard type to obtain new access control rules of the discard type.

[0034] Optionally, the current malicious network traffic corresponding to the current malicious network traffic characteristics includes any one or several types of traffic among distributed denial of service attack traffic, duplicate packet traffic, malformed packet traffic, asymmetric traffic, non-compliant traffic, and abnormal traffic;

[0035] Correspondingly, generating each new access control rule based on the container address includes:

[0036] Convert the current malicious network traffic characteristics into new access control rules of the denied access type based on the container address.

[0037] Optionally, the types of each new access control rule include the allowed access type, the denied access type, and the discard type;

[0038] Correspondingly, determining the priority of each new access control rule includes:

[0039] Determine the priorities of the new access control rules of the denied access type, the new access control rules of the allowed access type, and the new access control rules of the discard type as the highest priority, the second highest priority, and the lowest priority respectively.

[0040] Optionally, each virtual switch controls network traffic according to each new access control rule, including:

[0041] Each virtual switch saves each new access control rule as an entry in the current flow table according to the priority, and matches the network traffic with each entry in the current flow table in descending order of the priority to obtain a target access control rule that matches the network traffic, and controls the network traffic according to the target access control rule.

[0042] In a second aspect, the present invention discloses a computer program product, including a computer program / instructions, which when executed by a processor implement the steps of the foregoing disclosed cluster network traffic control method.

[0043] In a third aspect, the present invention discloses an electronic device, including:

[0044] A memory for storing a computer program;

[0045] A processor for executing a computer program to implement the steps of the aforementioned cluster network traffic control method.

[0046] In a fourth aspect, the present invention discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the steps of the aforementioned cluster network traffic control method are implemented.

[0047] Thus, the present invention collects the current subnet information, the current access control rule file, and the current malicious network traffic characteristics in the container cluster; divides the subnet addresses in the current subnet information into respective subnet address sets, classifies the current access control rule file to obtain respective rule address sets, and obtains the container addresses corresponding to the current malicious network traffic characteristics; respectively generates respective new access control rules based on each of the subnet address sets, each of the rule address sets, and the container addresses, and determines the priorities of each of the new access control rules; and distributes each of the new access control rules to the kernels of each virtual switch in the container cluster according to the priorities, so that each virtual switch controls network traffic according to each of the new access control rules.

[0048] The beneficial effects are as follows: The present invention collects various information related to network traffic in the container cluster in real time, namely the current subnet information, the current access control rule file, and the current malicious network traffic characteristics, and performs address division on different information, thereby respectively obtaining the subnet address set, the rule address set, and the container address. Further, corresponding new access control rules are respectively generated for different addresses, that is, respective new access control rules are generated based on each of the subnet address sets, each of the rule address sets, and the container address, so as to perform refined and reasonable control on various network traffic according to the new access control rules in the subsequent process; further, the priorities of each of the new access control rules are also determined, and both the rule distribution and the rule execution are completed according to the priorities, that is, each of the new access control rules is distributed to the kernels of each virtual switch in the container cluster according to the priorities, so that each virtual switch controls network traffic according to each of the new access control rules. That is to say, through the priority mechanism, reasonable processing and management of different network traffic are ensured, adapting to complex network environments and improving the reliability of cluster network traffic control. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the embodiments of the present invention, the following will briefly introduce the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0050] Figure 1Flowchart of a method for controlling cluster network traffic provided by an embodiment of the present invention;

[0051] Figure 2 Flowchart of a specific method for controlling cluster network traffic provided by an embodiment of the present invention;

[0052] Figure 3 Schematic diagram of a specific rule generation provided by an embodiment of the present invention;

[0053] Figure 4 Schematic diagram of a specific network traffic control system provided by an embodiment of the present invention;

[0054] Figure 5 Schematic diagram of the structure of a cluster network traffic control device provided by an embodiment of the present invention;

[0055] Figure 6 Structure diagram of an electronic device provided by an embodiment of the present invention. Specific embodiments

[0056] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the protection scope of the present invention.

[0057] The terms "including" and "having" in the specification of the present invention and any variations related to "including" and "having" are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may include steps or units that are not listed.

[0058] In order to enable those skilled in the art of the present technology to better understand the solution of the present invention, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments.

[0059] Next, a cluster network traffic control solution provided by an embodiment of the present invention will be introduced in detail. Figure 1 A method for controlling cluster network traffic provided by an embodiment of the present invention includes:

[0060] Step S11: Collect the current subnet information, the current access control rule file, and the current malicious network traffic characteristics in the container cluster.

[0061] The container cluster can specifically be Kubernetes. As a mainstream container orchestration platform, Kubernetes has been widely used in various large-scale distributed systems. Kubernetes provides powerful automated deployment, scaling, and management functions, enabling applications to run more efficiently and elastically. During the process of cluster network traffic control, it is also necessary to initialize the cluster, that is, to create private and public subnets and access control lists.

[0062] In this embodiment, the current subnet information in the container cluster is collected, including: collecting the current private subnet information of each private subnet and the current public subnet information of each public subnet in the container cluster; wherein, the current private subnet information includes the whitelist address set and whitelist namespace set of each private subnet, and the current public subnet information includes the blacklist address set and blacklist namespace set of each public subnet.

[0063] Collecting the current subnet information in the container cluster means collecting all IP (address) information of services and pods under the current subnet. Since the container cluster includes two types of subnets, one is a private subnet and the other is each public subnet, the subnet information collected is different for different types of subnets. For the private subnet, specifically collect the whitelist address set and whitelist namespace set (namespace) of each private subnet, and for the public subnet, specifically collect the blacklist address set and blacklist namespace set of the public subnet.

[0064] In this embodiment, the current malicious network traffic corresponding to the current malicious network traffic characteristics includes any one or several of distributed denial-of-service attack traffic, duplicate packet traffic, malformed packet traffic, asymmetric traffic, non-compliant traffic, and abnormal traffic. It can be understood that distributed denial-of-service attack traffic, duplicate packet traffic, malformed packet traffic, asymmetric traffic, non-compliant traffic, and abnormal traffic are all malicious network traffic. Then, collecting the current malicious network traffic characteristics is the characteristics of any one or several of distributed denial-of-service attack traffic, duplicate packet traffic, malformed packet traffic, asymmetric traffic, non-compliant traffic, and abnormal traffic.

[0065] Furthermore, it is also necessary to obtain the current access control rule (ACL) file. It can be understood that the current access control rule file includes the scope of action network segment and the ACL rule set. The ACL rule set includes the in and out directions of the traffic, the ACL rule matching expression, and the action of the rule. The action of the rule is divided into allow, deny, and discard.

[0066] Step S12: Divide the subnet addresses in the current subnet information into each subnet address set, classify the current access control rule file to obtain each rule address set, and obtain the container addresses corresponding to the current malicious network traffic characteristics.

[0067] In this embodiment, the dividing the subnet addresses in the current subnet information into each subnet address set includes: dividing all the subnet addresses in the current private subnet information into a first subnet address set; taking the difference between the first address corresponding to the whitelist namespace set and the second address in the whitelist address set, and dividing the obtained first differential subnet address into a second subnet address set.

[0068] The address division result of the private subnet mainly includes two types of subnet address sets, namely the first subnet address set A and the second subnet address set B. Among them, all the subnet addresses in the current private subnet information are divided into the first subnet address set A, that is, the first subnet address set A stores all the IP information of services and pods under the current private subnet; taking the difference between the first address corresponding to the whitelist namespace set and the second address in the whitelist address set, and dividing the obtained first differential subnet address into the second subnet address set B. That is to say, according to the whitelist namespace, all the IP information of the corresponding services and pods is obtained, and the difference is made with the subnet whitelist IP set and stored in the second subnet address set B.

[0069] In this embodiment, the dividing the subnet addresses in the current subnet information into each subnet address set includes: dividing all the subnet addresses in the current public subnet information into a third subnet address set, taking the difference between the third address corresponding to the blacklist namespace set and the fourth address in the blacklist address set, and dividing the obtained second differential subnet address into a fourth subnet address set.

[0070] The subnet addresses in the public subnet information are divided into two sets, namely the third subnet address set C and the fourth subnet address set D. Among them, all the subnet addresses in the current public subnet information are divided into the third subnet address set C, and all the IP information of services and pods under the current public subnet is obtained and stored in the third subnet address set C. Further, taking the difference between the third address corresponding to the blacklist namespace set and the fourth address in the blacklist address set, and dividing the obtained second differential subnet address into the fourth subnet address set. According to the blacklist namespace, all the IP information of the corresponding services and pods is obtained, and the difference is made with the subnet blacklist IP set and stored in the fourth subnet address set D.

[0071] In this embodiment, the information recorded in the current access control rule file includes the incoming direction and the outgoing direction of traffic, and each of the rule address sets includes a scope of action network segment rule address set and an access control rule address set. It can be understood that the information recorded in the current access control rule file includes the incoming direction and the outgoing direction of traffic, and each rule address set includes a scope of action network segment rule address set and an access control rule address set. Further, in this embodiment, the container address corresponding to the current malicious network traffic feature is obtained, that is, the corresponding pod ip information is obtained.

[0072] Step S13: Generate respective new access control rules based on each of the subnet address sets, each of the rule address sets, and the container address, and determine the priorities of the respective new access control rules.

[0073] The ACL priority rule generator first generates corresponding new access control rules for the private subnet, the public subnet, the traffic incoming and outgoing directions of the access control rule file, and the malicious network traffic feature respectively. That is to say, in this embodiment, refined rule generation is performed so as to perform refined control on traffic according to the generated rules subsequently.

[0074] In this embodiment, generating respective new access control rules based on each of the subnet address sets includes: determining a source address set and a destination address set based on the first subnet address set and the second subnet address set to generate a new access control rule of the allow-pass type; determining the address set other than the first subnet address set and the second subnet address set as the target address set, and determining a source address set and a destination address set based on the target address set and the first subnet address set to generate a new access control rule of the deny-pass type.

[0075] The new access control rules generated for the private subnet are mainly divided into two parts, that is, the new access control rule ACL of the allow-pass type OP and the new access control rule ACL of the deny-pass type RP ; For the first part, the generation process of the new access control rule of the allow-pass type for the private subnet is specifically as follows: Generate the new access control rule ACL of the allow-pass type with the first subnet address set as the source address set and the second subnet address set as the destination address set OP 1, and generate the new access control rule ACL of the allow-pass type with the second subnet address set as the source address set and the first subnet address set as the destination address set OP2. The specific process for generating new access control rules of the deny access type for the private subnet is as follows: Determine the target address set as the address set other than the first subnet address set and the second subnet address set, and generate a new access control rule ACL of the deny access type with the target address set as the source address set and the first subnet address set as the destination address set. RP 1. And generate a new access control rule ACL of the deny access type with the first subnet address set and the target address set as the destination address set. RP 2.

[0076] In this embodiment, generating each new access control rule based on each of the subnet address sets includes: determining the source address set and the destination address set based on the third subnet address set and the address set other than the fourth subnet address set to generate a new access control rule of the allow access type; using the third subnet address set and the fourth subnet address set as the source address set and the destination address set respectively to generate a new access control rule of the deny access type.

[0077] For the public subnet, generate two types of new access control rules, namely, a new access control rule ACL of the allow access type OP and a new access control rule ACL of the deny access type RP . Among them, when generating the new access control rule of the allow access type, use the third subnet address set C as the source address set and the non-fourth subnet address set D, that is, the address set other than the fourth subnet address set, as the destination address set to generate a new access control rule ACL of the allow access type OP 1. Use the non-fourth subnet address set D, that is, the address set other than the fourth subnet address set, as the source address set and the third subnet address set C as the destination address set to generate a new access control rule ACL of the allow access type OP 2. When generating the new access control rule of the deny access type, use the third subnet address set C as the source address set and the fourth subnet address set D as the destination address set to generate a new access control rule ACL of the deny access type RP 1. Use the fourth subnet address set D as the source address set and the third subnet address set C as the destination address set to generate a new access control rule ACL of the deny access type RP 2.

[0078] In this embodiment, generating each new access control rule based on each of the rule address sets includes: determining the destination address set and the source address set based on the action domain segment rule address set and the access control rule address set, and respectively generating a new access control rule of the allow access type, a new access control rule of the deny access type, and a new access control rule of the discard type for the in direction and the out direction of the traffic.

[0079] In the generation of new access control rules for an access control rule file, three types of access control rules need to be generated, namely new access control rules of the allow - passage type, new access control rules of the deny - passage type, and new access control rules of the discard type. And each type of access control rule also needs to be divided into two categories, that is, the in - direction of traffic and the out - direction of traffic. Using the acting network segment rule address set and the access control rule address set as the destination address set and the source address set respectively, different types of access control rules in different traffic directions are obtained.

[0080] In this embodiment, based on the acting network segment rule address set and the access control rule address set, a destination address set and a source address set are determined to generate new access control rules of the allow - passage type for the in - direction of the traffic and the out - direction of the traffic respectively, including: for the in - direction of the traffic, using the acting network segment rule address set as the destination address set and the access control rule address set as the source address set to generate new access control rules of the allow - passage type; using the acting network segment rule address set as the source address set and the access control rule address set as the destination address set to generate new access control rules of the allow - passage type for the out - direction of the traffic.

[0081] The access control rule file is divided into two categories during the generation of rules of the allow - passage type. The first category is for the in - direction of the traffic, and the second category is for the out - direction of the traffic. In the generation of rules for the in - direction of the traffic, the acting network segment rule address set is used as the destination address set and the access control rule address set is used as the source address set to generate new access control rules of the allow - passage type. In the generation of rules for the out - direction of the traffic, the access control rule address set is used as the destination address set and the acting network segment rule address set is used as the source address set to generate new access control rules of the allow - passage type.

[0082] The access control rule file is also divided into two categories during the generation of rules of the deny - passage type and the discard type. The first category is for the in - direction of the traffic, and the second category is for the out - direction of the traffic. Specifically, in the generation of rules of the deny - passage type and the discard type for the in - direction of the traffic, the acting network segment rule address set is used as the source address set and the access control rule address set is used as the destination address set. In the generation of rules of the deny - passage type and the discard type for the out - direction of the traffic, the acting network segment rule address set is used as the destination address set and the access control rule address set is used as the source address set.

[0083] In this embodiment, new access control rules of the deny access type and new access control rules of the discard type are generated respectively for the incoming direction and the outgoing direction of the traffic, including: generating initial access control rules of the deny access type and initial access control rules of the discard type respectively for the incoming direction and the outgoing direction of the traffic; taking the difference between the initial access control rules of the deny access type and the current access control rules of the deny access type to obtain new access control rules of the deny access type, and taking the difference between the initial access control rules of the discard type and the current access control rules of the discard type to obtain new access control rules of the discard type.

[0084] Initial access control rules of the deny access type and initial access control rules of the discard type are generated respectively for the incoming direction and the outgoing direction of the traffic, that is, for the incoming direction of the traffic, initial access control rules of the deny access type and initial access control rules of the discard type are generated respectively with the network segment rule address set as the source address set and the access control rule address set as the destination address set, and for the outgoing direction of the traffic, initial access control rules of the deny access type and initial access control rules of the discard type are generated respectively with the network segment rule address set as the destination address set and the access control rule address set as the source address set; further, the initial access control rules of the deny access type and the initial access control rules of the discard type for different directions of the traffic need to be regenerated, that is, the initial access control rules of the deny access type and the initial access control rules of the discard type are respectively taken the difference with the current access control rules of the deny access type and the current access control rules of the discard type. It can be understood that the current access control rules are the access control rules of the deny access type and the discard type for the incoming and outgoing directions of the traffic existing in the virtual switch (Open vSwitch, i.e., OVS). Then the difference process is specifically as follows:

[0085] 1) Take the difference between the initial access control rules of the deny access type and the current access control rules of the deny access type to obtain new access control rules of the deny access type;

[0086] 2) Take the difference between the initial access control rules of the discard type and the current access control rules of the discard type to obtain new access control rules of the discard type.

[0087] In this embodiment, each new access control rule is generated based on the container address, including: converting the current malicious network traffic characteristics into new access control rules of the deny access type based on the container address. For the rule generation of malicious network traffic, the current malicious network traffic characteristics are converted into new access control rules of the deny access type based on the container address, that is, for malicious network traffic, only new access control rules of the deny access type are generated.

[0088] Determine the priority of the new access control rules according to the type of the new access control rules. Specifically, determine the priority of the new access control rules of the deny access type, the allow access type, and the discard type as the highest priority, the second highest priority, and the lowest priority respectively. That is, in this embodiment, the priority of the access control rules is dynamically adjusted, so that the system can flexibly adjust the traffic policy according to the changes in the actual network environment, ensuring the efficiency and flexibility of network management.

[0089] Step S14: Send each of the new access control rules to the kernel of each virtual switch in the container cluster according to the priority, so that each virtual switch controls the network traffic according to each of the new access control rules.

[0090] After determining the priority of each new access control rule, send each of the new access control rules to the kernel of each virtual switch in the container cluster according to the priority. The sending order is the highest priority, the second highest priority, and the lowest priority. Each virtual switch controls the network traffic according to each of the new access control rules. During the traffic control process, it is necessary to match the network traffic with each new access control rule. Then the matching order also corresponds to the order of the priority. That is to say, the network traffic is first matched with the access control rule of the highest priority, then the access control rule of the second highest priority, and finally the access control rule of the lowest priority. In this way, based on the priority-based access control rule sending and matching mechanism, it is ensured that the critical service traffic is processed first, improving the usage efficiency of network resources and reducing latency and congestion.

[0091] The beneficial effects are as follows: The present invention collects various information related to network traffic in the container cluster in real time, that is, the current subnet information, the current access control rule file, and the current malicious network traffic characteristics, and performs address division on different information, so as to obtain the subnet address set, the rule address set, and the container address respectively. Further, generate corresponding new access control rules for different addresses respectively, that is, generate each new access control rule based on each subnet address set, each rule address set, and the container address, so as to perform refined and reasonable control on various network traffic according to the new access control rules in the follow-up; further, determine the priority of each new access control rule, and complete rule sending and rule execution based on the priority, that is, send each of the new access control rules to the kernel of each virtual switch in the container cluster according to the priority, so that each virtual switch controls the network traffic according to each of the new access control rules. That is to say, through the priority mechanism, it is ensured that different network traffic is reasonably processed and managed, adapting to complex network environments and improving the reliability of cluster network traffic control.

[0092] See Figure 2 An embodiment of the present invention discloses a specific method for controlling cluster network traffic. Compared with the previous embodiment, this embodiment further explains and optimizes the technical solution. It includes:

[0093] Step S21: Collect the current subnet information, the current access control rule file, and the current malicious network traffic characteristics in the container cluster.

[0094] For example Figure 3 As shown in a specific rule generation schematic diagram, collect the current subnet information, the current access control rule file, and the current malicious network traffic characteristics in the container cluster, where the current subnet information includes the current private subnet information of each private subnet and the current public subnet information of each public subnet.

[0095] Step S22: Divide the subnet addresses in the current subnet information into each subnet address set, classify the current access control rule file to obtain each rule address set, and obtain the container addresses corresponding to the current malicious network traffic characteristics.

[0096] The access control list file includes the scope of action network segment, the ACL rule set. The ACL rule set specifically includes the traffic in and out directions, the ACL rule matching expressions, and the actions of the rules, that is, the allow action, the deny action, and the discard action. Classify and merge the ACL file according to the scope of action network segment.

[0097] Divide all subnet addresses in the current private subnet information into the first subnet address set A; take the difference between the first address corresponding to the whitelist namespace set and the second address in the whitelist address set, and divide the obtained first differential subnet address into the second subnet address set B.

[0098] Divide all subnet addresses in the current public subnet information into the third subnet address set C, take the difference between the third address corresponding to the blacklist namespace set and the fourth address in the blacklist address set, and divide the obtained second differential subnet address into the fourth subnet address set D.

[0099] The current malicious network traffic corresponding to the current malicious network traffic characteristics includes distributed denial of service attack traffic, duplicate packet traffic, malformed packet traffic, asymmetric traffic, non-compliant traffic, and abnormal traffic.

[0100] Step S23: Generate each new access control rule based on each of the subnet address sets, each of the rule address sets, and the container addresses respectively; the types of each new access control rule include the allow-pass type, the deny-pass type, and the discard type.

[0101] For the private subnet, taking the first subnet address set A as the source address set and the second subnet address set B as the destination address set, and taking the second subnet address set B as the source address set and the first subnet address set A as the destination address set, allow - passing ACL rules are respectively generated; taking the first subnet address set A as the source address set and any IP (the address set other than the first subnet address set and the second subnet address set, that is, the destination address set) as the destination address set, and taking any IP as the source address set and the first subnet address set A as the destination address set, deny - passing ACL rules are respectively generated.

[0102] For the public subnet, taking the third subnet address set C as the source address set and the non - fourth subnet address set D as the destination address set, and taking the non - fourth subnet address set D as the source address set and the third subnet address set C as the destination address set, allow - passing ACL rules are respectively generated; taking the third subnet address set C as the source address set and the fourth subnet address set D as the destination address set, and taking the fourth subnet address set D as the source address set and the third subnet address set C as the destination address set, deny - passing ACL rules are respectively generated.

[0103] For the ACL rule file, for the traffic incoming direction, taking the scope of action network segment as the destination address set and the ACL rule set as the source address set, allow - passing ACL rules are generated; for the traffic outgoing direction, taking the scope of action network segment as the source address set and the ACL rule set as the destination address set, allow - passing ACL rules are generated. For the traffic outgoing direction, taking the scope of action network segment as the destination address set and the ACL rule set as the source address set, deny - or - discard ACL rules are generated; for the traffic incoming direction, taking the scope of action network segment as the source address set and the ACL rule set as the destination address set, deny - or - discard ACL rules are generated. The deny - or - discard ACL rules are differentiated from the existing third - priority kernel of OVS to generate new deny - or - discard ACL rules.

[0104] For malicious traffic, based on the container address, the current malicious network traffic characteristics are converted into new access control rules of the deny - passing type.

[0105] Step S24: Determine the priorities of the new access control rules of the deny - passing type, the new access control rules of the allow - passing type, and the new access control rules of the discard type as the highest priority, the second - highest priority, and the lowest priority respectively.

[0106] For the private subnet, determine the priority of the new access control rule of the allow - traffic type as the second priority (i.e., the second - highest priority), and determine the priority of the new access control rule of the deny - traffic type as the third priority (i.e., the lowest priority). For the public subnet, determine the priority of the new access control rule of the allow - traffic type as the second priority (i.e., the second - highest priority), and determine the priority of the new access control rule of the deny - traffic type as the third priority (i.e., the lowest priority). For the current access control rule file, regardless of whether it is the inbound or outbound direction of the traffic, determine the priority of the new access control rule of the allow - traffic type as the second priority (i.e., the second - highest priority), and determine the priority of the new access control rule of the deny - traffic type and the new access control rule of the discard - traffic type as the third priority (i.e., the lowest priority). For the current malicious network traffic characteristics, determine the priority of the new access control rule of the deny - traffic type as the first priority (i.e., the highest priority).

[0107] Step S25: According to the priorities, distribute each of the new access control rules to the kernels of each virtual switch in the container cluster, so that each virtual switch controls the network traffic according to each of the new access control rules.

[0108] In this embodiment, each virtual switch controls the network traffic according to each of the new access control rules, including: each virtual switch saves each of the new access control rules as each entry in the current flow table according to the priorities, and matches the network traffic with each entry in the current flow table in the order from the highest priority to the lowest priority to obtain the target access control rule that matches the network traffic, and controls the network traffic according to the target access control rule.

[0109] Each virtual switch stores the newly generated access control rules in the form of entries in the current flow table according to the priorities, and follows the order from the highest priority to the lowest priority to compare the network traffic with each entry in the flow table in turn until the target access control rule that matches it is found, and finally controls the network traffic according to this rule.

[0110] Furthermore, each virtual switch can determine the priority value label of the new access control rule according to the priority, and then save each new access control rule as an entry in the current flow table according to the priority, and add the corresponding priority value label at the corresponding position of each entry. In this way, when matching the network traffic with each entry in the current flow table, the entry with the highest priority in the current flow table is locked according to the priority value label, and the entry with the highest priority is matched with the network traffic. If the match is successful, the target access control rule matching the network traffic is obtained. If the match is unsuccessful, the entry with the second highest priority in the current flow table is locked according to the priority value label, and the entry with the highest priority is matched with the network traffic. If the match is successful, the target access control rule matching the network traffic is obtained. If the match is unsuccessful, the entry with the lowest priority in the current flow table is locked according to the priority value label, and the entry with the lowest priority is matched with the network traffic. If the match is successful, the target access control rule matching the network traffic is obtained. The flow table of this embodiment can support dynamic addition and deletion of rules, and has a lower maintenance cost compared with the current method that relies on physical location sorting and does not require explicit sorting and storage.

[0111] It can be seen that the present invention sets a high-priority rejection rule, and the system can effectively identify and intercept malicious traffic, prevent potential network threats, and ensure the overall security of the network environment. The priority-based ACL rule distribution mechanism ensures that critical business traffic is processed first, improves the utilization efficiency of network resources, and reduces latency and congestion. Dynamically adjusting the priority of ACL rules enables the system to flexibly adjust traffic policies according to changes in the actual network environment, ensuring the efficiency and flexibility of network management. It is applicable to fine-grained control of traffic in complex network environments, and ensures the reasonable processing and management of different types of traffic through the priority mechanism.

[0112] Next, take Figure 4Taking the schematic diagram of a specific network traffic control system shown as an example, the present invention will be described accordingly. The network traffic control system includes a subnet collector, an access control list (ACL) collector, a malicious traffic collector, an intelligent ACL controller, a synchronization controller, an ACL priority rule generator, a rule distribution and executor, and a traffic monitoring, collection, and analyzer. Among them, the traffic monitoring, collection, and analyzer are responsible for continuously monitoring the traffic behavior in the cluster network, collecting and analyzing traffic data, and finally reporting it to the malicious traffic collector; the subnet collector is responsible for collecting all Pod IP information of the private subnet and public subnet in the Kubernetes cluster, that is, collecting the current private subnet information of each private subnet and the current public subnet information of each public subnet in the container cluster, and classifying and storing them for use by the intelligent ACL controller; the access control list collector is used to obtain the existing access control rule set in the cluster, that is, the current access control rule file, and classify and merge it to further generate new ACL rules; the malicious traffic collector monitors the traffic behavior in the network such as Pod, virtual switch protocol stack, and host in real time, identifies and captures abnormal traffic, obtains the current malicious network traffic characteristics, and maps its characteristics to access control rules; the intelligent ACL controller is the core of the system, responsible for summarizing subnet information, access control rules, and malicious traffic characteristics, generating and classifying address sets, and using them to generate priority access control rules; the synchronization controller is responsible for synchronizing the address set generated by the intelligent ACL controller to the ACL priority rule generator; the priority rule generator generates ACL rules with different priorities according to traffic data and security policies, and passes the rules to the rule distribution and executor for application to network traffic management; after receiving the newly generated rules, the rule distribution and executor applies them to the virtual switch kernel to achieve the control and management of network traffic.

[0113] Figure 5 The following is a schematic structural diagram of a cluster network traffic control device provided by an embodiment of the present invention, including:

[0114] An information collection module 11, configured to collect the current subnet information, the current access control rule file, and the current malicious network traffic characteristics in the container cluster.

[0115] An address acquisition module 12, configured to divide the subnet addresses in the current subnet information into each subnet address set, classify the current access control rule file to obtain each rule address set, and acquire the container addresses corresponding to the current malicious network traffic characteristics.

[0116] A priority determination module 13, configured to generate each new access control rule based on each of the subnet address sets, each of the rule address sets, and the container addresses respectively, and determine the priority of each of the new access control rules.

[0117] The traffic control module 14 is configured to send each of the new access control rules to the kernels of the virtual switches in the container cluster according to the priority, so that each virtual switch controls network traffic according to each new access control rule.

[0118] The beneficial effects are as follows: The present invention collects various information related to network traffic in the container cluster in real time, namely the current subnet information, the current access control rule file, and the current malicious network traffic characteristics, and performs address partitioning on different information to respectively obtain a subnet address set, a rule address set, and a container address. Further, corresponding new access control rules are respectively generated for different addresses, that is, each new access control rule is generated based on each subnet address set, each rule address set, and the container address, so as to perform refined and reasonable control on various network traffic according to the new access control rules in the follow-up. Further, the priority of each new access control rule is also determined, and both the rule distribution and the rule execution are completed based on the priority, that is, each new access control rule is sent to the kernels of the virtual switches in the container cluster according to the priority, so that each virtual switch controls network traffic according to each new access control rule. That is to say, through the priority mechanism, reasonable processing and management of different network traffic are ensured, adapting to complex network environments and improving the reliability of the control of the cluster network traffic.

[0119] Further, an embodiment of the present application also discloses an electronic device. Figure 6 It is a structural diagram of an electronic device shown according to an exemplary embodiment, and the content in the figure cannot be considered as any limitation on the scope of use of the present application. The electronic device may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. Among them, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the cluster network traffic control method disclosed in any of the foregoing embodiments. In addition, the electronic device in this embodiment may specifically be an electronic computer.

[0120] In this embodiment, the power supply 23 is used to provide operating voltages for each hardware device on the electronic device; the communication interface 24 can create a data transmission channel between the electronic device and external devices, and the communication protocol it follows is any communication protocol applicable to the technical solution of the present application, and no specific limitation is made thereto here; the input / output interface 25 is used to obtain external input data or output data to the outside, and its specific interface type can be selected according to specific application requirements, and no specific limitation is made here.

[0121] In addition, as a carrier for storing resources, the memory 22 can be a read-only memory, a random access memory, a magnetic disk, an optical disc, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc. The storage method can be transient storage or permanent storage.

[0122] Among them, the operating system 221 is used to manage and control each hardware device and the computer program 222 on the electronic device, and it can be Windows Server, Netware, Unix, Linux, etc. In addition to the computer program capable of implementing the cluster network traffic control method executed by the electronic device disclosed in any of the foregoing embodiments, the computer program 222 can further include computer programs capable of performing other specific tasks.

[0123] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the cluster network traffic control method disclosed above is implemented. For the specific steps of this method, reference can be made to the corresponding content disclosed in the foregoing embodiments, and details will not be repeated here.

[0124] Furthermore, the embodiments of the present application also disclose a computer program product, including a computer program / instructions, and when the computer program / instructions are executed by a processor, the steps of the cluster network traffic control method disclosed in any of the foregoing embodiments are implemented.

[0125] In this specification, the various embodiments are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. For the same or similar parts among the various embodiments, reference can be made to each other. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and reference can be made to the description of the method part for the relevant parts.

[0126] Those skilled in the art can further realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been generally described according to their functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present application.

[0127] The steps of the methods or algorithms described in connection with the embodiments disclosed in this specification may be implemented directly in hardware, in software modules executed by a processor, or in a combination thereof. The software modules may be located in a random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium well-known in the art.

[0128] Finally, it should also be noted that in this document, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variation thereof is intended to cover non-exclusive inclusion, such that a process, method, article or device comprising a series of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article or device. Without further limitation, an element defined by the phrase "comprising a..." does not exclude the presence of additional identical elements in the process, method, article or device comprising the element.

[0129] The technical solutions provided in this application have been introduced in detail above. Specific examples are used in this document to illustrate the principles and implementation manners of this application. The description of the above embodiments is only used to help understand the method and its core idea of this application; at the same time, for those of ordinary skill in the art, according to the idea of this application, there will be changes in the specific implementation manners and application scopes. In summary, the content of this specification should not be construed as a limitation to this application.

Claims

1. A method for controlling cluster network traffic, characterized in that, Including: Collecting the current subnet information, the current access control rule file, and the current malicious network traffic characteristics in the container cluster; Dividing the subnet addresses in the current subnet information into each subnet address set, classifying the current access control rule file to obtain each rule address set, and obtaining the container addresses corresponding to the current malicious network traffic characteristics; Generating each new access control rule based on each of the subnet address sets, each of the rule address sets, and the container addresses respectively, and determining the priority of each of the new access control rules; Sending each of the new access control rules to the kernels of each virtual switch in the container cluster according to the priority, so that each virtual switch controls the network traffic according to each of the new access control rules; Collecting the current subnet information in the container cluster, including: Collecting the current private subnet information of each private subnet and the current public subnet information of each public subnet in the container cluster; wherein, the current private subnet information includes the white list address set and the white list namespace set of each private subnet, and the current public subnet information includes the black list address set and the black list namespace set of each public subnet; The dividing the subnet addresses in the current subnet information into each subnet address set includes: Dividing all the subnet addresses in the current private subnet information into a first subnet address set; making a difference between the first address corresponding to the white list namespace set and the second address in the white list address set, and dividing the obtained first differential subnet address into a second subnet address set; Generating each new access control rule based on each of the subnet address sets includes: Determining a source address set and a destination address set based on the first subnet address set and the second subnet address set to generate a new access control rule of the allow - passing type; determining the address set other than the first subnet address set and the second subnet address set as the target address set, and determining the source address set and the destination address set based on the target address set and the first subnet address set to generate a new access control rule of the deny - passing type; The dividing the subnet addresses in the current subnet information into each subnet address set further includes: Dividing all the subnet addresses in the current public subnet information into a third subnet address set, making a difference between the third address corresponding to the black list namespace set and the fourth address in the black list address set, and dividing the obtained second differential subnet address into a fourth subnet address set; Generating each new access control rule based on each of the subnet address sets further includes: Determining a source address set and a destination address set based on the third subnet address set and the address set other than the fourth subnet address set to generate a new access control rule of the allow - passing type; using the third subnet address set and the fourth subnet address set as the source address set and the destination address set respectively to generate a new access control rule of the deny - passing type; The information recorded in the current access control rule file includes the incoming direction and the outgoing direction of the traffic, and each of the rule address sets includes a scope-of-action network segment rule address set and an access control rule address set; Accordingly, generating each new access control rule based on each of the rule address sets includes: Determining a destination address set and a source address set based on the scope-of-action network segment rule address set and the access control rule address set, and respectively generating a new access control rule of the allow-pass type, a new access control rule of the deny-pass type, and a new access control rule of the discard type for the incoming direction and the outgoing direction of the traffic; Respectively generating a new access control rule of the deny-pass type and a new access control rule of the discard type for the incoming direction and the outgoing direction of the traffic includes: Respectively generating an initial access control rule of the deny-pass type and an initial access control rule of the discard type for the incoming direction and the outgoing direction of the traffic; taking the difference between the initial access control rule of the deny-pass type and the current access control rule of the deny-pass type to obtain a new access control rule of the deny-pass type, and taking the difference between the initial access control rule of the discard type and the current access control rule of the discard type to obtain a new access control rule of the discard type; Generating each new access control rule based on the container address includes: Converting the current malicious network traffic feature into a new access control rule of the deny-pass type based on the container address.

2. The cluster network traffic control method according to claim 1, wherein, Determining a destination address set and a source address set based on the scope-of-action network segment rule address set and the access control rule address set, and respectively generating a new access control rule of the allow-pass type for the incoming direction and the outgoing direction of the traffic includes: For the incoming direction of the traffic, using the scope-of-action network segment rule address set as the destination address set and the access control rule address set as the source address set to generate a new access control rule of the allow-pass type; Using the scope-of-action network segment rule address set as the source address set and the access control rule address set as the destination address set, and generating a new access control rule of the allow-pass type for the outgoing direction of the traffic.

3. The cluster network traffic control method according to claim 1, wherein The current malicious network traffic corresponding to the current malicious network traffic feature includes any one or several types of traffic among distributed denial-of-service attack traffic, duplicate packet traffic, malformed packet traffic, asymmetric traffic, non-compliant traffic, and abnormal traffic.

4. The cluster network traffic control method according to claim 1, wherein The types of each new access control rule include the allow-pass type, the deny-pass type, and the discard type; Accordingly, determining the priority of each new access control rule includes: Determining the priorities of the new access control rule of the deny-pass type, the new access control rule of the allow-pass type, and the new access control rule of the discard type as the highest priority, the second highest priority, and the lowest priority respectively.

5. The cluster network traffic control method according to claim 4, characterized in that, Each virtual switch controls network traffic according to each new access control rule, including: Each of the virtual switches stores each of the new access control rules as entries in the current flow table according to the priority, and matches the network traffic with each of the entries in the current flow table in descending order of the priority to obtain a target access control rule that matches the network traffic, and controls the network traffic according to the target access control rule.

6. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by a processor, the steps of the cluster network traffic control method according to any one of claims 1 to 5 are implemented.

7. An electronic device, characterized in that, Including: A memory for storing a computer program; A processor for executing the computer program to implement the steps of the cluster network traffic control method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the steps of the cluster network traffic control method according to any one of claims 1 to 5 are implemented.

Images