Service chain session association method and device

Abstract

The invention discloses a service chain session association method and device, and relates to the technical field of service chains. According to the main technical scheme, the system is used for service chain arrangement equipment, and the service chain arrangement equipment is connected with at least one piece of network element equipment; if a first service data packet to be sent to the target network element equipment is received, target data in a target quintuple of the first service data packet is encoded into a target MAC address of the service data packet, and the target data is data, which can be modified by the target network element equipment, in the quintuple; sending the coded first service data packet to the target network element equipment; if a second service data packet fed back by the target network element equipment for the first service data packet is monitored, decoding target data from a target MAC address of the second service data packet; and associating the second service data packet to a service chain session corresponding to the first service data packet based on the decoded target data and the quintuple of the second service data packet.

Description

Technical Field

[0001] The present application relates to the technical field of service chaining, and in particular to a method and device for associating service chaining sessions. Background Art

[0002] Service Function Chaining (SFC) refers to an ordered network service combination formed by service data packets passing through various network function (NF) devices in a user-defined order based on business logic requirements. The service chain orchestration device is responsible for guiding service data packets through each network element device in order to form a service chain. However, when the service chain orchestration device directs service data packets to certain network elements (such as WAF network elements), these network elements may modify some key data (such as port number and IP address) in the data packet's five-tuple (the five-tuple includes the source IP address, destination IP address, source port number, destination port number, and transport layer protocol) when processing the service data packet based on the business logic. Such modifications can cause inconsistencies in the five-tuple between the processed and unprocessed service data packets. As a result, after the network element device feeds the processed service data packet back to the service chain orchestration device, the service chain orchestration device cannot correctly associate the processed service data packet with the service chain session corresponding to the processed service data packet, potentially causing session interruption or business logic anomalies.

[0003] Therefore, how to ensure that the service chain orchestration device correctly associates the service data packets fed back by the network element device with the service chain session has become an urgent problem that needs to be solved. Summary of the Invention

[0004] This application proposes a service chain session association method and device, the main purpose of which is to ensure that the service chain orchestration device correctly associates the business data packets fed back by the network element device with the service chain session to achieve the continuity and integrity of the service chain orchestration.

[0005] In order to achieve the above objectives, this application mainly provides the following technical solutions:

[0006] In a first aspect, the present application provides a service chain session association method for a service chain orchestration device, wherein the service chain orchestration device is connected to at least one network element device, and the service chain session association method includes at least: if a first business data packet to be sent to a target network element device is received, the target data in the target quintuple of the first business data packet is encoded into the target MAC address of the business data packet, wherein the target data is the data in the quintuple that will be modified by the target network element device; the encoded first business data packet is sent to the target network element device; if a second business data packet fed back by the target network element device for the first business data packet is monitored, the target data is decoded from the target MAC address of the second business data packet; based on the decoded target data and the quintuple of the second business data packet, the second business data packet is associated with the service chain session corresponding to the first business data packet.

[0007] In a second aspect, the present application provides a service chain session association device, which is applied to a service chain orchestration device, wherein the service chain orchestration device is connected to at least one network element device, and the service chain session association device includes:

[0008] an encoding module, configured to, upon receiving a first service data packet to be sent to a target network element device, encode target data in a target quintuple of the first service data packet into a target MAC address of the service data packet, wherein the target data is data in the quintuple that will be modified by the target network element device;

[0009] A sending module, configured to send the encoded first service data packet to the target network element device;

[0010] a decoding module configured to decode the target data from the target MAC address of the second service data packet if a second service data packet fed back by the target network element device in response to the first service data packet is monitored;

[0011] An association module is configured to associate the second business data packet with a service chain session corresponding to the first business data packet based on the decoded target data and the quintuple of the second business data packet.

[0012] In a third aspect, the present application provides a computer-readable storage medium, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the service chain session association method described in the first aspect.

[0013] In a fourth aspect, the present application provides an electronic device, comprising: a memory for storing a program; and a processor coupled to the memory for running the program to execute the service chain session association method described in the first aspect.

[0014] In a fifth aspect, the present application provides a computer program product, which includes: a computer program / computer executable instructions, and the computer program / computer can execute the service chain session association method described in the first aspect.

[0015] The service chain session association method and device provided by the present application, when receiving a first business data packet to be sent to a target network element device connected to a service chain orchestration device, encodes the target data in the target quintuple of the first business data packet (i.e., the original quintuple of the first business data packet) into the target MAC address of the business data packet, and the target data is the data in the quintuple that will be modified by the target network element device. The encoded first business data packet is then sent to the target network element device. If a second business data packet fed back by the target network element device for the first business data packet is monitored, the target data is decoded from the target MAC address of the second business data packet, and based on the decoded target data and the quintuple of the second business data packet, the second business data packet is associated with the service chain session corresponding to the first business data packet. It can be seen that the solution provided in this embodiment encodes the target data that may be modified by the network element device in the quintuple of the service data packet into the MAC address of the service data packet before the service chain orchestration device guides the service data packet to the network element device. In this way, after the service data packet is guided to the network element device, even if the network element device modifies the target data of the service data packet when processing the service data packet based on the service logic, after the network element device feeds back the processed service data packet, the service chain orchestration device can still obtain the original target data by decoding the MAC address, and then restore the original quintuple based on the decoded target data and the quintuple of the processed service data packet, and correctly associate the processed service data packet with the service chain session corresponding to the service data packet before processing based on the original quintuple, thereby achieving the continuity and integrity of the service chain orchestration.

[0016] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0018] Figure 1A flow chart of a service chain session association method provided by an embodiment of the present application is shown;

[0019] Figure 2 An interactive diagram of a service chain orchestration device provided by an embodiment of the present application is shown;

[0020] Figure 3 A schematic diagram of the structure of a service chain session association device provided by an embodiment of the present application is shown;

[0021] Figure 4 A schematic structural diagram of a service chain session association device provided in another embodiment of the present application is shown. DETAILED DESCRIPTION

[0022] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0023] Currently, when service chain orchestration devices direct service data to certain network elements, these elements may modify key data in the data packet's quintuple when processing the data packet based on business logic. This can cause inconsistencies in the quintuples between the processed and unprocessed service packets. However, service chain orchestration devices typically rely on quintuples for session tracking and traffic orchestration. If a network element modifies the quintuple while processing a service packet, the service chain orchestration device cannot correctly associate the processed service packet with the service chain session corresponding to the pre-processed service packet, resulting in session interruption or service packet loss. For example, after receiving the Web business data packet sent by the service chain orchestration device, the WAF (Web Application Firewall) network element device decrypts and re-encapsulates it and modifies the source port number in the five-tuple. After the WAF network element device feeds back the processed Web business data packet to the service chain orchestration device, the service chain orchestration device mistakenly believes that this is a new independent session based on the modified five-tuple, rather than a continuation of the original session. The service chain orchestration device cannot correctly associate the processed business data packet with the service chain session corresponding to the business data packet before processing. This problem seriously affects the reliability and traceability of the service chain, making subsequent traffic scheduling, policy execution and log auditing difficult.

[0024] Based on research findings, service chain orchestration devices and network element devices that may modify the quintuple are typically deployed using a Layer 2 switching approach. In this deployment, when processing a service data packet based on business logic, the network element device will modify some key data in the quintuple of the service data packet, but will not modify the MAC (Media Access Control Address) address of the service data packet. Based on this, before the service chain orchestration device directs the service data packet to the network element device, the target data in the quintuple of the service data packet that may be modified by the network element device can be encoded into the MAC address of the service data packet. In this way, even if the target data of the service data packet is modified after directing the network element device, after the network element device feeds back the processed service data packet, the service chain orchestration device can obtain the original target data by decoding the MAC address. Then, based on the decoded target data and the quintuple of the processed service data packet, the original quintuple is restored. Based on the original quintuple, the processed service data packet is correctly associated with the service chain session corresponding to the pre-processed service data packet, thereby achieving normal interaction and effective orchestration between the service chain orchestration device and such network element devices.

[0025] Based on the above findings, an embodiment of the present application specifically provides a service chain session association technical solution, which specifically includes: if a first business data packet to be sent to a target network element device connected to a service chain orchestration device is received, the target data in the target quintuple of the first business data packet is encoded into the target MAC address of the business data packet, where the target data is the data in the quintuple that will be modified by the target network element device; the encoded first business data packet is sent to the target network element device; if a second business data packet fed back by the target network element device for the first business data packet is monitored, the target data is decoded from the target MAC address of the second business data packet; based on the decoded target data and the quintuple of the second business data packet, the second business data packet is associated with the service chain session corresponding to the first business data packet.

[0026] Based on the above-mentioned service chain session association technical solution, this embodiment specifically provides a service chain session association method and device. The service chain session association method and device provided by this embodiment are specifically described below.

[0027] An embodiment of the present application provides a service chain session association method. The service chain session association method provided in this embodiment is applied to a service chain orchestration device, and the service chain orchestration device is connected to at least one network element device.

[0028] In some embodiments, the number and type of network element devices connected to the service chaining orchestration device can be flexibly selected based on business needs, and this embodiment does not limit this. For example, the network element devices connected to the service chaining orchestration device may include, but are not limited to, at least one of the following: a switch, a router, a load balancer, a border gateway, a security device (e.g., a firewall, an intrusion detection system, a defense system, a deep packet inspection device), a network optimization device, a monitoring and analysis device, etc.

[0029] In some embodiments, the network element devices connected to the service chain orchestration device include target network element devices. A target network element device is a network element device that, when processing a service data packet based on its service logic, may modify some key data in the five-tuple of the service data packet. The target network element device can be flexibly selected based on service needs. In principle, any network element device that may modify some key data in the five-tuple of the service data packet can be determined as a target network element device. Exemplarily, the target network element device may include, but is not limited to, a WAF network element device.

[0030] like Figure 1 As shown, the service chain session association method provided in this embodiment may at least include the following steps 101 to 104.

[0031] 101. If a first service data packet to be sent to a target network element device is received, target data in the target quintuple of the first service data packet is encoded into the target MAC address of the service data packet, where the target data is data in the quintuple that will be modified by the target network element device.

[0032] In some embodiments, the objects connected to the service chain orchestration device may include, but are not limited to, clients, servers, and network element devices. A service data packet received by the service chain orchestration device may be a service data packet to be sent to any of the aforementioned objects. Therefore, in order to promptly and accurately identify the first service data packet to be sent to the target network element device from the service data packets received by the service chain orchestration device, the service chain session association method provided in this embodiment may further include the following steps A to B.

[0033] Step A: If any service data packet is received, the sender of the service data packet is determined, and based on the service chain diversion strategy corresponding to the sender, the target object located next to the sender is determined.

[0034] The client, server, and network element devices connected to the service chain orchestration device may all be senders of business data packets, and as senders, the client, server, and network element devices will have their corresponding service chain diversion strategies. The service chain diversion strategy is used to indicate the calling order of each network element device in the service chain corresponding to the sender. The service chain diversion strategy is an important basis for determining the receiver of the business data packet. Therefore, after determining the sender of the business data packet, the service chain diversion strategy corresponding to the sender is obtained. In principle, the business data packet will carry its sender information and the service chain diversion strategy currently corresponding to the sender. Therefore, based on the information carried by the business data packet, the sender of the business data packet and the service chain diversion strategy corresponding to the sender can be determined.

[0035] Step B: Match the device type of the target object with the target device type, and determine whether the service data packet is the first service data packet to be sent to the target network element device based on the matching result.

[0036] The target device type is the device type of the network element device that will modify the quintuple. If the target object's device type successfully matches the target device type, the service data packet is determined to be the first service data packet received and to be sent to the target network element device. If the target object's device type does not successfully match the target device type, it is determined that the first service data packet to be sent to the target network element device has not been received. In this case, the received service data packet can be directly sent to the target object.

[0037] After confirming that the first service data packet to be sent to the target network element device is received, it is necessary to select target data from the target quintuple of the first service data packet and select the target MAC address from the MAC address of the service data packet. The two selection processes are explained separately below.

[0038] In some embodiments, the target data selected from the target quintuple of the first service data packet can be flexibly determined based on service needs, which is not limited in this embodiment. For example, the target data may include at least one of the following data in the target quintuple: source IP address, destination IP address, source port number, destination port number, and transport layer protocol.

[0039] Specifically, the method of selecting target data from the target quintuple of the first service data packet may at least include the following method A1 and method A2.

[0040] Method A1, the specific process of selecting target data from the target quintuple of the first business data packet may include the following steps: determining the device type of the target network element device and the transmission direction corresponding to the first business data packet (the transmission direction is used to indicate whether the first business data packet is transmitted from the client to the server, or from the server to the client), wherein different device types and transmission directions have corresponding quintuple data types, and the quintuple data type is used to indicate the data in the quintuple that will be modified by the network element device of the corresponding device type; based on the quintuple data type corresponding to the determined device type and transmission direction, selecting the target data from the quintuple of the first business data packet.

[0041] Exemplarily, the five-tuple data type corresponding to the WAF device type and the transmission direction from the client to the server is a source port number type. After determining that the device type of the target network element device is a WAF device type and the transmission direction corresponding to the first service data packet is from the client to the server, the source port number in the five-tuple of the first service data packet is selected as the target data.

[0042] Method A2: If it is known that the target network element device will modify the port number of the first service data packet, the modified port number needs to be selected as the target port number included in the target data. The target port number selection method may include the following two methods:

[0043] One is that if the transmission direction of the first service data packet is from the client to the server, the source port number in the target quintuple of the first service data packet is selected as the target port number. If the transmission direction of the first service data packet is from the server to the client, the destination port number in the target quintuple of the first service data packet is selected as the target port number. Considering that the network element device usually modifies the corresponding port number of the client, and the probability of modifying the corresponding port number of the server is low, based on this, the port number corresponding to the client in the source port number and destination port number of the first service data packet is selected as the target port number based on the transmission direction of the first service data packet.

[0044] Another is that, if it is determined that a target port number selection principle is customized for the target network element device, then based on the target port number selection principle, the target port number is selected from the source port number and the destination port number in the target quintuple of the first service data packet. The target port number selection principle is used to customize the selection of at least one of the source port number and the destination port number as the target port number. Taking into account that some network element devices may modify the source port number when processing service data packets, some network element devices may modify the destination port number when processing service data packets, and some network element devices may modify both the source port number and the destination port number when processing service data packets, corresponding target port number selection principles can be customized for different network element devices. In this way, based on the customized target port number selection principle, a target port number can be selected from the source port number and the destination port number for each network element device in a targeted manner.

[0045] Furthermore, considering that some network element devices not only need the target port number as the target data, but also need other data in the quintuple as the target data. Therefore, after executing method A2, the following steps can also be performed: determine the device type of the target network element device; determine whether there is a corresponding mapping relationship for the device type of the target network element device in the mapping relationship between the preset device type and the selection principle; if so, based on the selection principle corresponding to the device type of the target network element device, select the data that needs to be used as the target data together with the target port number from the source IP address, destination IP address and transport layer protocol included in the quintuple of the first service data packet. The selection principle is used to indicate the selection of at least one of the source IP address, destination IP address and transport layer protocol together with the target port number as the target data.

[0046] Any one of the above methods A1 and A2 can be flexibly selected for use based on business needs, and this embodiment does not limit this.

[0047] In some embodiments, the method of selecting a target MAC address from the MAC address of a service data packet may include at least the following method B1 and method B2.

[0048] Method B1: If the transmission direction of the first service data packet is from client to server, the source MAC address of the first service data packet is selected as the target MAC address. If the transmission direction of the first service data packet is from server to client, the destination MAC address of the first service data packet is selected as the target MAC address. A target MAC address selection principle is defined based on the transmission direction of the first service data packet. This allows the MAC address encoded with the target data to be quickly located during subsequent decoding, enabling faster decoding of the target data.

[0049] Method B2: If it is determined that a target MAC address selection principle is customized for the target network element device, the target MAC address is selected from the source MAC address and destination MAC address of the first service data packet based on the target MAC address selection principle. The target MAC address selection principle is used to customize at least one of the source MAC address and the destination MAC address to be selected as the target MAC address.

[0050] Considering that if some target network element devices are attacked or experience service anomalies, the source MAC address and destination MAC address may be modified. If the target MAC address is modified, the target data encoded therein may also be modified. Based on this, the target MAC address selection principle is customized for different network element devices based on the source MAC address and destination MAC address of different network element devices. In this way, the target MAC address is selected based on the target MAC address selection principle customized for the target network element device. It should be noted that if the target MAC address includes both the source MAC address and the destination MAC address, the target data will be encoded into the source MAC address, and the target data will also be encoded into the destination MAC address.

[0051] The above method B1 and method B2 can be flexibly selected for use based on business needs, and this embodiment does not limit this.

[0052] In some embodiments, after selecting the target data and the target MAC address, a step is performed to encode the target data in the target quintuple of the first business data packet into the target MAC address of the business data packet. The implementation method of this step may include at least the following methods C1 to C4.

[0053] Method C1: encrypt the target data in the target quintuple of the first service data packet into ciphertext data of target length; divide the ciphertext data into at least two segments; assign a corresponding embedding position to each segment in the target MAC address and embed the segment.

[0054] The encryption key, encryption algorithm, and target length used in the encryption process can all be flexibly selected based on business needs. The number of segments and their embedding locations can also be flexibly selected based on business needs. It should be noted that the embedding locations of each segment can be adjacent or non-adjacent within the target MAC address, depending on business needs.

[0055] For example, the target data includes port number 443 and the target MAC address is 00:1A:2B:00:00:00. The target data is encrypted using a preset key and a preset encryption algorithm to generate ciphertext data of a preset length. The ciphertext data is then divided into three segments, each of which is assigned a corresponding embedding position in the target MAC address and embedded therein. The result is 00:1A:2B:38:33:61, which represents the state after encoding the target data into the target MAC address.

[0056] This method uses encryption for the target data. Even if the encoded target MAC address is leaked, the attacker cannot infer the target data from the target MAC address, and the target data will not be leaked, thereby improving security.

[0057] Method C2: assigning a prime number to the target data in the target quintuple of the first service data packet; performing a modular operation on the target data using the prime number as a modulus; assigning a corresponding embedding position for the modular operation result in the target MAC address and embedding the result.

[0058] The prime number assigned to the target data can be determined based on business needs and is not limited in this embodiment. It should be noted that the assigned prime number service chain orchestration device needs to record it for subsequent use when decoding the target data from the target MAC address. For example, when the target data is a target port number, the prime number is greater than the maximum port number of the port corresponding to the target port number.

[0059] For example, the target data is the target port number 443, and the target MAC address is 00:1A:2B:00:00:00. The prime number 65537 is assigned to the target port number. The process of performing a modular operation on the target port using the prime number as the modulus is: (443×65537) mod 2 24 = 12255675. Convert 12255675 to hexadecimal BB02FB, then assign the corresponding embedding position to the modulo operation result in the target MAC address and embed it. The encoded target MAC address is: 00:1A:2B:BB:02:FB.

[0060] This method uses a prime number as the modulus to perform modular operations on the target data. Therefore, even if the encoded target MAC address is leaked, the attacker cannot infer the target data from the target MAC address because he cannot know the assigned prime number, thereby reducing the possibility of target data leakage.

[0061] Method C3: Split the target data in the target quintuple of the first service data packet into three parts; convert the three parts into color intensity values ​​of corresponding color channels respectively; assign a corresponding embedding position to each color intensity value in the target MAC address and embed it.

[0062] Considering that users may control and track corresponding sessions in the monitoring interface when using service chain orchestration equipment, in order to enable the encoding operation to achieve service chain session association while also visually tracking the corresponding service data packets of the session on the monitoring interface, the target data in the target quintuple of the first service data packet is split into three parts, and the three parts are converted into color intensity values ​​of the corresponding RGB color channels. Each color intensity value is assigned a corresponding embedding position in the target MAC address and embedded.

[0063] For example, the target data is the target port number 8080 and the target MAC address is 00:1A:2B:00:00:00. The target port number 8080 is converted to the binary format 00011111 10010000 and split into 00011111, 100100, and 00, corresponding to the three RGB color channels. 00011111 is then converted to a color intensity value of 31 for the R color channel, 100100 is converted to a color intensity value of 36 for the G color channel, and 00 is converted to a color intensity value of 0 for the B color channel. Each color intensity value is then assigned a corresponding embedding position in the target MAC address and embedded. The resulting encoded target MAC address is 00:1A:2B:31:36:0. This way, if a user needs to distinguish current sessions through the monitoring interface during service chain orchestration, these color intensity values ​​can be used to distinguish the path of the service data packet within the service chain.

[0064] Method C4: Encode the target data in the target quintuple of the first service data packet into a field at a specified position in the target MAC address. The specified position can be flexibly selected based on service needs and is not limited in this embodiment.

[0065] Any of the above methods C1 to C4 can be flexibly selected for use based on business needs, and this embodiment does not limit this.

[0066] 102. Send the encoded first service data packet to a target network element device.

[0067] After the encoding is completed, the service chain orchestration device sends the encoded first service data packet to the target network element device, so that the target network element device processes the encoded first service data packet based on its own service logic.

[0068] Furthermore, before sending the encoded first service data packet to the target network element device, the service chain session association method provided in this embodiment may also include any of the following steps: First, encrypting the encoded target MAC address. This makes it difficult for an attacker to decode the target data from the target MAC address even if the target MAC address is leaked. Second, encrypting the encoded target MAC address and second data, where the second data includes at least one data item in the quintuple of the second service data packet that was not selected as the target data. This makes it difficult for an attacker to decode the target data from the target MAC address, and also to obtain the data in the quintuple of the first service data packet from the second data, even if the target MAC address and second data are leaked. It should be noted that the encryption mentioned in the above two steps requires an agreement between the service chain orchestration device and the target network element device. Therefore, after the encoded first service data packet is sent to the target network element device, the target network element device can perform decryption matching the encryption to process the service data packet based on the decoded data and the service logic.

[0069] 103. If a second service data packet fed back by the target network element device in response to the first service data packet is monitored, decode the target data from the target MAC address of the second service data packet.

[0070] After receiving the encoded first service data, the target network element device will process the service data packet based on its own service logic, and will most likely modify some data in the quintuple of the first service data packet during the processing. Based on this, the quintuple of the second service data packet received by the service chain encoding device is most likely inconsistent with the target quintuple of the first service data packet. Therefore, in order to ensure that the service chain orchestration device can associate the second service data packet with the session of the first service data packet, it is necessary to decode the target data from the target MAC address of the second service data packet, so as to restore the quintuple before modification by the target network element device based on the target data and the quintuple of the second service data packet.

[0071] It should be noted that the decoding process of decoding the target data from the target MAC address of the second service data packet is the reverse process of the encoding process in step 101. Therefore, it will not be described in detail here.

[0072] 104. Based on the decoded quintuple of the target data and the second service data packet, associate the second service data packet with the service chain session corresponding to the first service data packet.

[0073] Based on the decoded target port number and the quintuple of the second service data packet, a specific process of associating the second service data packet with the service chain session corresponding to the first service data packet may include the following steps 104A to 104C.

[0074] 104A. Select first data to be compared with the decoded target data from the quintuple of the second service data packet.

[0075] Determine a quintuple data type related to the target data, and then select, from the quintuple of the second service data packet, first data to be compared with the decoded target data based on the quintuple data type. The quintuple data type may include, but is not limited to, at least one of the following: a source IP address type, a destination IP address type, a source port number type, a destination port number type, and a transport layer protocol type.

[0076] Exemplarily, if the target data includes a source port number, the quintuple data type involved is a source port number type. The first data selected from the quintuple of the second service data packet to be compared with the target data to be decoded is the source port number.

[0077] 104B. If the first data is compared to the decoded target data and is identical, then the second service data packet is associated with the service chain session corresponding to the first data packet based on the quintuple of the second service data packet.

[0078] If the comparison shows that the first data is the same as the decoded target data, it means that the target network element device has most likely not modified the quintuple, and the quintuple of the second business data packet is still the same as the target quintuple of the first business data packet. Based on the quintuple of the second business data packet, the second business data packet can be associated with the service chain session corresponding to the first business data packet.

[0079] Furthermore, a session table is maintained in the service chain orchestration device, and the session table records the existing sessions and session states in the service chain orchestration. Based on this, after comparing the first data and the decoded target data to be the same, the service chain session association method provided in this embodiment may also include the following steps: searching for a service chain session corresponding to the five-tuple of the second business data packet in the existing session. If it is determined that a service chain session corresponding to the five-tuple of the second business data packet exists in the existing session, it means that the second business data packet is a business data packet that ensures the continuity and integrity of the corresponding session, and therefore the step of associating the second business data packet with the service chain session corresponding to the first data packet based on the five-tuple of the second business data packet is performed. If it is determined that a service chain session corresponding to the five-tuple of the second business data packet does not exist in the existing session, it means that the second business data packet is an illegal data packet, or the session originally corresponding to the second business data packet is currently invalid, and therefore, in order to avoid the second business data packet affecting other service chain orchestration work of the service chain orchestration device, the second business data packet is discarded.

[0080] 104C. If the comparison shows that the first data is different from the decoded target data, the quintuple of the second business data packet is restored to the target quintuple based on the decoded target data, and the second business data packet is associated with the service chain session corresponding to the first data packet based on the restored target quintuple.

[0081] If the comparison shows that the first data is different from the decoded target data, it means that the target network element device has most likely modified the quintuple, and the quintuple of the second business data packet is inconsistent with the target quintuple of the first business data packet. Therefore, in order to ensure that the second business data packet can be associated with the service chain session corresponding to the first business data packet, it is necessary to restore the quintuple of the second business data packet to the target quintuple based on the decoded target data, and then associate the second business data packet with the service chain session corresponding to the first data packet based on the restored target quintuple.

[0082] Specifically, the specific process of restoring the quintuple of the second service data packet to the target quintuple based on the decoded target data is as follows: determining the data type of the quintuple involved in the decoded target data; and replacing the data corresponding to the quintuple data type in the quintuple of the second service data packet with the corresponding target data. Exemplarily, if it is determined that the data type of the quintuple involved in the decoded target data is a source port number type, then the source port number in the quintuple of the second service data packet is replaced with the source port number included in the target data.

[0083] Furthermore, after comparing the first data and the decoded target data to find out that they are different, the service chain session association method provided in this embodiment may also include the following steps: searching for a service chain session corresponding to the target quintuple in the existing session. If it is determined that a service chain session corresponding to the target quintuple exists in the existing session, it means that the second business data packet is a business data packet that ensures the continuity and integrity of the corresponding session, and therefore the step of associating the second business data packet with the service chain session corresponding to the first data packet based on the restored target quintuple is performed. If it is determined that a service chain session corresponding to the target quintuple does not exist in the existing session, it means that the second business data packet is an illegal data packet, or the session originally corresponding to the target quintuple is currently invalid, and therefore in order to avoid the second business data packet affecting other service chain orchestration work of the service chain orchestration device, the second business data packet is discarded.

[0084] The service chain session association method provided by the embodiment of the present application, when receiving a first business data packet to be sent to a target network element device connected to a service chain orchestration device, encodes the target data in the target quintuple of the first business data packet (i.e., the original quintuple of the first business data packet) into the target MAC address of the business data packet, and the target data is the data in the quintuple that will be modified by the target network element device. The encoded first business data packet is then sent to the target network element device. If a second business data packet fed back by the target network element device for the first business data packet is monitored, the target data is decoded from the target MAC address of the second business data packet, and based on the decoded target data and the quintuple of the second business data packet, the second business data packet is associated with the service chain session corresponding to the first business data packet. It can be seen that the solution provided in this embodiment encodes the target data that may be modified by the network element device in the quintuple of the service data packet into the MAC address of the service data packet before the service chain orchestration device guides the service data packet to the network element device. In this way, after the service data packet is guided to the network element device, even if the network element device modifies the target data of the service data packet when processing the service data packet based on the service logic, after the network element device feeds back the processed service data packet, the service chain orchestration device can still obtain the original target data by decoding the MAC address, and then restore the original quintuple based on the decoded target data and the quintuple of the processed service data packet, and correctly associate the processed service data packet with the service chain session corresponding to the service data packet before processing based on the original quintuple, thereby achieving the continuity and integrity of the service chain orchestration.

[0085] In some embodiments of the present application, in order to improve the service chain orchestration efficiency, after the encoded first service data packet is sent to the target network element device in the above step 102, the service chain session association method provided in this embodiment may also include the following steps: if a second service data packet fed back by the target network element device in response to the first service data packet is monitored, then the MAC address of the second service data packet is detected to be in the target MAC address format.

[0086] The target MAC address format is a predefined format between the service chaining orchestration device and the network element device. It serves as the basis for identifying legitimate service data packets. The target MAC address format can be set based on service needs and is not limited in this embodiment. For example, the target MAC address format is: 0X02:F2:00:Port:AA:BB. Port is the encoded embedded target data (specifically, the port number), and AA and BB are relatively fixed values, such as the fixed ID value of the service chaining orchestration device.

[0087] If it is detected that the MAC address of the second service data packet adopts the target MAC address format, it means that the second service data packet is a legal data packet and subsequent processing can continue. Therefore, the step of decoding the target data from the target MAC address of the second service data packet in step 103 is continued.

[0088] If it is detected that the MAC address of the second business data packet does not adopt the target MAC address format, it means that the second business data packet is most likely an illegal data packet. Therefore, at least one of the following exception handling can be performed on the second business data packet: First, discard the second business data packet to prevent the second business data packet from affecting the service chain orchestration work of the service chain orchestration device and prevent the second business data from occupying the storage space of the service chain orchestration device. Second, inform the target network element device to resend the second business data packet whose MAC address adopts the target MAC address format. In this case, if the target network element device resends the second business data packet that does not adopt the target MAC address format, it will no longer continue to inform and will simply prompt an exception.

[0089] In some embodiments of the present application, after the above step 104, the service chain session association method provided by this embodiment may further include the following steps 105 to 107.

[0090] 105. Based on the service chain diversion strategy corresponding to the target network element device, determine the target object located next to the target network element device. The service chain diversion strategy is used to indicate the calling order of each network element device in the service chain where the target network element device is located.

[0091] The first service data packet carries information about its sender and the service chain diversion strategy currently corresponding to the sender. Therefore, the service chain diversion strategy corresponding to the target network element device is determined based on the information carried by the first service data packet.

[0092] When there is no next network element device in the calling sequence of the target network element device: if the first service data packet is transmitted from the client to the server, the server is determined as the target object; if the first service data packet is transmitted from the server to the client, the client is determined as the target object.

[0093] 106. If the target object is a client or a server, restore the second service data packet and send the restored second service data packet to the target object.

[0094] If the target object is a client or server, it means that the processing flow of the service chain is about to end and the data packet is about to leave the service chain. Therefore, in order to enable the client or server to use the original five-tuple and MAC address of the business data packet, the second business data packet is restored and the restored second business data packet is sent to the target object.

[0095] The restoration process includes two methods: first, restoring the quintuple of the second service data packet to the target quintuple based on the decoded target data; second, restoring the target MAC address of the second service data packet to its original state before the target data was encoded. Through the restoration process, the quintuple of the second service data packet is restored to be identical to the target quintuple of the first service data packet, and the MAC address of the second service data packet is restored to be identical to the MAC address of the first service data packet. In this way, the client or server can process the service data packet based on this restored data.

[0096] 107. If the target object is a network element device, restore the quintuple of the second service data packet to a target quintuple based on the decoded target data, and send the second service data packet with the quintuple to the target object.

[0097] If the target object is a network element device, the target object may still modify the quintuple after the second service data packet is directed to the target object. Therefore, to reduce encoding operations, the encoded target MAC address in the second service data packet remains unchanged. However, to prevent the modified quintuple of the target network element device from affecting the target object's processing of the second service data packet, the quintuple of the second service data packet is restored to the target quintuple based on the decoded target data, and the second service data packet with the quintuple is sent to the target object.

[0098] In some embodiments of the present application, a key factor for the service chain orchestration device to orchestrate the service chain is the successful establishment of a network connection between the service chain orchestration device and the network element device. Based on this, the service chain session association method provided in this embodiment can also include the following methods 1 and 2 to establish a network connection.

[0099] Method 1. The service chain session association method provided in this embodiment may also include the following steps: if it is determined to use the target service chain diversion strategy in the target business scenario, then determine the data packet transmission direction between the client and the server in the target business scenario, and the target service chain diversion strategy is used to indicate the calling order of each network element device in the service chain where the target network element device is located; if the data packet transmission direction includes a first transmission direction from the client to the server, then based on the first transmission direction, a communication connection is established for each network element device in the service chain corresponding to the target service chain diversion strategy, so as to realize the business data packet transmission in the first transmission direction from the client to the server based on the established communication connection; if the data transmission direction includes a second transmission direction from the server to the client, then based on the second transmission direction, a communication connection is established for each network element device in the service chain corresponding to the target service chain diversion strategy, so as to realize the business data packet transmission in the second transmission direction from the server to the client based on the established communication connection.

[0100] In some embodiments, given that the communication status between the service chain orchestration device and the network element device may change in real time, to ensure the success rate of service chain orchestration, a communication connection is established only when it is determined that a transmission direction needs to be enabled. For example, when it is determined that the client needs to send a request service data packet to the server, a communication connection is established in the first transmission direction, and a communication connection is not established in the second transmission direction. Only after the request service data packet arrives at the server and the server generates a corresponding response service data packet is the communication connection established in the second transmission direction.

[0101] Method 2: The service chain session association method provided in this embodiment may further include the following steps: if it is determined that a target service chain traffic diversion policy is used in the target service scenario, the target service chain traffic diversion policy is used to indicate the calling order of each network element device in the service chain where the target network element device is located; if it is determined that a service data packet needs to be transmitted from the client to the server, a communication connection is established with each network element device in the service chain corresponding to the target service chain traffic diversion policy based on the transmission direction from the client to the server; after the establishment is completed, the service chain orchestration device transmits the service data packet from the client to the server based on the established communication connection; when the service data packet is transmitted to the last network element device in the service chain, the service chain orchestration device establishes a communication connection between the last network element device and the server, and after the communication connection is successfully established, transmits the service data packet to the server based on the established communication connection. Then, after the server feeds back a response service data packet, the response service data packet is transmitted back to the client based on the previously established communication connection.

[0102] In some embodiments of the present application, Figure 2 The service chain session association method provided by this embodiment is described by taking the interaction diagram of the service chain orchestration device shown as an example. Figure 2 It includes a service chain orchestration device, a client, a server, and a target network element device NF1 (for example, the target network element device NF1 is a WAF network element device). Figure 2 The service chain session association process from the client to the server and the service chain session association process from the server to the client are shown in FIG. The two service chain session association processes include steps 1 to 20 (these steps are described by taking the target port number as the target data as an example). These 20 steps correspond to Figure 2 The numbers 1-20 in the figure represent the execution order of steps 1 to 20.

[0103] Before explaining steps 1 to 20, first clarify Figure 2The illustrated embodiment involves the following concepts: For forward service data packets, the service chain orchestration device selects the source port number in the five-tuple of the forward service data packet as the destination port number, and the source MAC address of the forward service data packet as the destination MAC address. For reverse service data packets, the service chain orchestration device selects the destination port number in the five-tuple of the reverse service data packet as the destination port number, and the destination MAC address of the reverse service data packet as the destination MAC address.

[0104] Step 1: The client sends a SYN packet of the TCP protocol to the service chain orchestration device.

[0105] For example, in the target business scenario where a user accesses the Web service of a server, the target service chain diversion strategy used in the target business scenario is determined, and the target service chain diversion strategy indicates that the service chain includes the target network element device NF1. It is determined that the first transmission direction from the client to the server is first used in the target business scenario, and it is necessary to establish a communication connection for each network element device in the service chain corresponding to the target service chain diversion strategy based on the first transmission direction, so as to realize the transmission of service data packets in the first transmission direction from the client to the server based on the established communication connection. At this time, in order to establish a communication connection, the client sends a SYN packet to the service chain orchestration device. For the convenience of subsequent explanation, the five-tuple of the SYN packet sent by the client to the service chain orchestration device is defined as the first five-tuple.

[0106] Step 2: The service chain orchestration device receives the SYN packet sent by the client via the ge1 interface, extracts the first quintuple in the SYN packet, and creates a session. It then matches the service chain traffic diversion policy and finds that the SYN packet needs to be sent to the target network element device NF1. Since the target network element device NF1 modifies the quintuple, the device selects the destination port number from the first quintuple in the SYN packet, selects the destination MAC address from the SYN packet's MAC address, encodes the destination port number from the first quintuple in the SYN packet into the destination MAC address in the SYN packet, and then sends the encoded SYN packet to the target network element device NF1 via the ge3 interface.

[0107] Specifically, the original source MAC address and destination MAC address of the SYN packet are first saved to facilitate subsequent recovery. Since the SYN packet is a forward packet, the source port number in the first quintuple of the SYN packet is selected as the destination port number, and the source MAC address of the SYN packet is selected as the destination MAC address.

[0108] Step 3: The target network element device NF1 receives the encoded SYN packet from its internal network port, processes the encoded SYN packet based on the service logic, obtains the SYN_ACK packet of the TCP protocol, and sends the SYN_ACK packet to the service chain orchestration device.

[0109] Step 4: The service chain orchestration device receives a SYN_ACK packet from the target network element device NF1 via the ge3 interface. Since the ge3 interface is connected to the internal network interface of the target network element device NF1, this SYN_ACK packet is a reverse packet. Therefore, the service chain orchestration device decodes the destination port number from the destination MAC address of the second service packet and then compares the decoded destination port number with the destination port number in the quintuple of the SYN_ACK packet. If the comparison shows that the two are different, the destination port in the quintuple of the SYN_ACK packet is modified according to the decoded destination port number, and the quintuple of the SYN_ACK packet is modified to be the same as the first quintuple of the SYN packet in step 1. Then, the session is searched through the first five-tuple. If the session is not found, the SYN_ACK packet is discarded and it is determined that the communication connection is not established successfully. If the session is found, the SYN_ACK packet is associated with the found session, and the target service chain diversion strategy is obtained to determine that there are no other network element devices later. Therefore, the five-tuple of the restored SYN_ACK packet is the same as the first five-tuple, and the source MAC address and destination MAC address of the restored SYN_ACK packet are the same as the SYN packet in step 1, and the restored SYN_ACK packet is sent to the client.

[0110] Step 5: The client receives the SYN_ACK packet sent by the service chain orchestration device, and sends a TCP protocol ACK packet to the service chain orchestration device according to its business logic.

[0111] Step 6. The service chain orchestration device receives the ACK packet sent by the client through the ge1 interface, associates the session and updates the session information, and then matches the target service chain diversion policy to determine that the ACK packet needs to be sent to the target network element device NF1. This ACK packet is a forward packet, and the source port number in its five-tuple is encoded as the destination port number into its source MAC address (the source MAC address here is the selected destination MAC address), and the encoded ACK packet is sent to the target network element device NF1 through the ge3 interface.

[0112] Step 7. The client sends the ACK data packet, indicating that the TCP three-way handshake with the service chain orchestration device is completed, and the communication connection in the first transmission direction has been successfully established. Based on the established communication connection, the client can realize the transmission of business data packets in the first transmission direction from the client to the server. Therefore, the business data packet Packet A is sent to the service chain orchestration device.

[0113] Step 8. The service chain orchestration device receives Packet A sent by the client through the ge1 interface, associates the session and updates the session information, then matches the target service chain diversion policy and determines that Packet A needs to be sent to the target network element device NF1. This Packet A data packet is a forward data packet, so the source port number in its five-tuple is encoded as the destination port number into its source MAC address (the source MAC address here is the selected destination MAC address), and then the encoded Packet A is sent to the target network element device NF1 through the ge3 interface.

[0114] Step 9: Target NE device NF1 receives Packet A from its internal network port and processes Packet A according to its service logic. To transmit Packet A to the server, a communication connection must be established between target NE device NF1 and the server. Therefore, target NE device NF1 sends a SYN packet to the service chain orchestration device through its external network port to establish a communication connection with the server. The source port number of this SYN packet is different from the source port number of the SYN packet in step 2.

[0115] Step 10. The service chain orchestration device receives a SYN packet sent by the target network element device NF1 from the ge4 interface. Since the ge4 interface is connected to the external network interface of the target network element device NF1, this SYN packet is a forward packet. The service chain orchestration device decodes the source MAC address of the SYN packet to obtain the port number, and compares the decoded port number with the source port number of the five-tuple of the SYN packet. If the two are different, the source port number of the five-tuple of the SYN packet is modified according to the decoded port number. Then, a session search is performed according to the modified five-tuple. If the session cannot be found, the SYN packet is discarded. If the session is found, the session is associated and the session information is updated. Then, the target service chain diversion policy information is obtained. After confirming that there are no other network element devices, the original MAC address of the SYN packet (including the source MAC address and the destination MAC address) is restored, and the SYN packet is sent to the server-side device through the ge2 interface.

[0116] Step 11: The server receives a SYN packet from the service chaining device and returns a SYN_ACK packet to the service chaining device according to the server's business logic.

[0117] Step 12. After the service chain orchestration device receives the SYN_ACK packet through the ge2 interface, it associates the session and updates the session information, and then matches the target service chain diversion policy to determine that this SYN_ACK packet needs to be sent to the target network element device NF1. This SYN_ACK packet is a reverse packet, so the destination port of the SYN_ACK packet is encoded as the destination port number into its destination MAC address (the destination MAC address here is the selected target MAC address), and then sent to the target network element device NF1 through the ge4 interface.

[0118] Step 13: The target network element device NF1 receives a SYN_ACK packet from its external network port. According to the service logic of the target network element device NF1, the target network element device NF1 sends an ACK packet to the service chain orchestration device through its external network port.

[0119] Step 14: The service chain orchestration device receives an ACK packet sent by the target network element device NF1 from the ge4 interface. Since the ge4 interface is connected to the external network interface of the target network element device NF1, this ACK packet is a forward packet. The service chain orchestration device decodes the source MAC address of the ACK packet and extracts the source port number. The decoded source port number is compared with the source port number of the ACK packet. If the comparison is inconsistent, the source port number of the ACK packet is modified according to the decoded source port number. Then, a session search is performed based on the modified five-tuple. If the session cannot be found, the ACK packet is discarded. If the session is found, the session is associated and the session information is updated. Then, the target service chain diversion strategy is obtained to determine that there are no other network element devices in the future. The original MAC address (source MAC address and destination MAC address) of the ACK packet is restored, and the ACK packet is sent to the server-side device through the ge2 interface.

[0120] Step 15: Target network element device NF1 sends an ACK data packet through its external network port, indicating that the three-way handshake with the service chaining orchestration device has been completed and the communication connection has been successfully established. Therefore, according to its business logic, it continues to send the processed Packet A data packet to the service chaining orchestration device.

[0121] Step 16. The service chain orchestration device receives the Packet A data packet sent by the target network element device NF1 from the ge4 interface. Since the ge4 interface is connected to the external network interface of the target network element device NF1, this ACK data packet is a forward data packet. The service chain orchestration device decodes the source MAC address of the Packet A data packet to obtain the source port number, and compares the decoded source port number with the source port number of the Packet A data packet. If the comparison shows inconsistency, the source port number of the Packet A data packet is modified according to the decoded source port number. Then, a session search is performed based on the modified five-tuple. If the session cannot be found, the Packet A data packet is discarded. If it is found, the session is associated and the session information is updated. Then, its service chain diversion strategy is obtained. If it is found that there are no other network element devices, the original MAC address of the Packet A data packet (including the source MAC address and the destination MAC address) is restored, and the Packet A data packet is sent to the server through the ge2 interface.

[0122] Step 17: The server-side device receives Packet A from the service chain orchestration device and returns Packet B to the service chain orchestration device according to the business logic of the Web server.

[0123] Step 18. After the service chain orchestration device receives the Packet B data packet sent by the server device from the ge2 interface, it associates the session and updates the session information, and then matches the target service chain diversion policy. It finds that this Packet B data packet needs to be sent to the target network element device NF1. This Packet B data packet is a reverse data packet. The destination port number of the Packet B data packet is encoded as the destination port number into its destination MAC address (the destination MAC address here is the selected target MAC address) and sent to the target network element device NF1 through the ge4 interface.

[0124] Step 19. The service chain orchestration device receives Packet B data packet sent by the target network element device NF1 from the ge3 interface. Since the ge3 interface is connected to the intranet interface of the target network element device NF1, this Packet B data packet is a reverse data packet. The service chain orchestration device decodes the destination MAC address of this Packet B data packet to obtain the destination port number, and compares the decoded destination port number with the destination port of the Packet B data packet. If the comparison is inconsistent, the destination port data in this Packet B data packet is modified according to the decoded destination port number. Then, a session search is performed based on the modified five-tuple. If the session cannot be found, this Packet B data packet is discarded. If a session is found, the session is associated and the session information is updated. Then, its service chain diversion strategy is obtained to determine that there are no other network element devices in the future. Then, the original MAC address of this Packet B data packet (including source MAC and destination MAC) is restored and sent to the client through the ge1 interface.

[0125] Step 20: The client receives Packet B from the service chain orchestration device and continues processing according to its business logic.

[0126] In some embodiments of the present application, the service chain session association method provided in this embodiment may be applied to service data packets of any protocol, which is not limited in this embodiment. Exemplary protocols may include but are not limited to: TCP protocol, UDP protocol and SCTP protocol.

[0127] Furthermore, an embodiment of the present application further provides a service chain session association device, which is applied to a service chain orchestration device, wherein the service chain orchestration device is connected to at least one network element device, such as Figure 3 As shown, the service chain session association device may include at least:

[0128] an encoding module 21 configured to, upon receiving a first service data packet to be sent to a target network element device, encode target data in a target quintuple of the first service data packet into a target MAC address of the service data packet, wherein the target data is data in the quintuple that will be modified by the target network element device;

[0129] A sending module 22, configured to send the encoded first service data packet to the target network element device;

[0130] The decoding module 23 is configured to decode the target data from the target MAC address of the second service data packet if a second service data packet fed back by the target network element device in response to the first service data packet is monitored;

[0131] The association module 24 is configured to associate the second service data packet with the service chain session corresponding to the first service data packet based on the decoded target data and the quintuple of the second service data packet.

[0132] The service chain session association device provided in an embodiment of the present application, when receiving a first business data packet to be sent to a target network element device connected to a service chain orchestration device, encodes the target data in the target quintuple of the first business data packet into the target MAC address of the business data packet, where the target data is the data in the quintuple that will be modified by the target network element device. The encoded first business data packet is then sent to the target network element device. If a second business data packet fed back by the target network element device in response to the first business data packet is monitored, the target data is decoded from the target MAC address of the second business data packet, and based on the decoded target data and the quintuple of the second business data packet, the second business data packet is associated with the service chain session corresponding to the first business data packet. It can be seen that the solution provided in this embodiment encodes the target data that may be modified by the network element device in the quintuple of the service data packet into the MAC address of the service data packet before the service chain orchestration device guides the service data packet to the network element device. In this way, after the service data packet is guided to the network element device, even if the network element device modifies the target data of the service data packet when processing the service data packet based on the service logic, after the network element device feeds back the processed service data packet, the service chain orchestration device can still obtain the original target data by decoding the MAC address, and then restore the original quintuple based on the decoded target data and the quintuple of the processed service data packet, and correctly associate the processed service data packet with the service chain session corresponding to the service data packet before processing based on the original quintuple, thereby achieving the continuity and integrity of the service chain orchestration.

[0133] In some embodiments of the present application, Figure 4 As shown, the encoding module 21 may include: a first encoding unit 211, used to encrypt the target data in the target quintuple of the first business data packet into ciphertext data of a target length; divide the ciphertext data into at least two segments; assign a corresponding embedding position to each segment in the target MAC address and embed it.

[0134] In some embodiments of the present application, Figure 4 As shown, the encoding module 21 may include: a second encoding unit 212, used to assign a prime number to the target data in the target quintuple of the first business data packet; perform a modular operation on the target data with the prime number as the modulus; and assign a corresponding embedding position to the modular operation result in the target MAC address and embed it.

[0135] In some embodiments of the present application, Figure 4As shown, the encoding module 21 may include: a third encoding unit 213, used to split the target data in the target quintuple of the first business data packet into three parts; convert the three parts into color intensity values ​​of corresponding color channels respectively; assign a corresponding embedding position to each color intensity value in the target MAC address and embed it.

[0136] In some embodiments of the present application, Figure 4 As shown, the association module 24 is specifically used to select the first data to be compared with the decoded target data from the quintuple of the second business data packet; if the first data is the same as the decoded target data, then the second business data packet is associated with the service chain session corresponding to the first business data packet based on the quintuple of the second business data packet; if the first data is different from the decoded target data, then the quintuple of the second business data packet is restored to the target quintuple based on the decoded target data, and the second business data packet is associated with the service chain session corresponding to the first data packet based on the restored target quintuple.

[0137] In some embodiments of the present application, Figure 4 As shown, the association module 24 can also be used to search whether there is a service chain session corresponding to the quintuple of the second business data packet in the existing session; if so, the step of associating the second business data packet to the service chain session corresponding to the first data packet based on the quintuple of the second business data packet is executed; if not, the second business data packet is discarded.

[0138] In some embodiments of the present application, Figure 4 As shown, the association module 24 can also be used to search whether there is a service chain session corresponding to the target quintuple in the existing session; if so, the step of associating the second business data packet to the service chain session corresponding to the first data packet based on the restored target quintuple is executed; if not, the second business data packet is discarded.

[0139] In some embodiments of the present application, Figure 4 As shown, the service chain session association device provided in this embodiment may further include:

[0140] A determination module 25 is configured to determine a target object located next to the target network element device based on a service chain diversion strategy corresponding to the target network element device, wherein the service chain diversion strategy is used to indicate a calling order of each network element device in the service chain where the target network element device is located;

[0141] a first sending module 26 configured to, if the target object is a client or a server, restore the second service data packet and send the restored second service data packet to the target object, wherein the restoration process includes: restoring the quintuple of the second service data to the target quintuple based on the target data decoded by the decoding module 23, and restoring the target MAC address of the second service data packet to the state before the target data was encoded;

[0142] The second sending module 27 is used to restore the quintuple of the second business data packet to the target quintuple based on the target data decoded by the decoding module 23 if the target object is a network element device, and send the second business data packet with the quintuple to the target object.

[0143] In some embodiments of the present application, the target data includes at least one of the following data in the target quintuple: source IP address, destination IP address, source port number, destination port number, and transport layer protocol.

[0144] In some embodiments of the present application, Figure 4 As shown, if the target data includes a target port number, the encoding module 21 may also include: a first selection unit 214, used to select the target port number through any of the following processes: if the transmission direction of the first business data packet is from client to server, the source port number in the target quintuple of the first business data packet is selected as the target port number; if the transmission direction of the first business data packet is from server to client, the destination port number in the target quintuple of the first business data packet is selected as the target port number; or, if it is determined that a target port number selection principle is customized for the target network element device, the target port number is selected from the source port number and the destination port number in the target quintuple of the first business data packet based on the target port number selection principle, and the target port number selection principle is used to customize the selection of at least one of the source port number and the destination port number as the target port number.

[0145] In some embodiments of the present application, Figure 4As shown, the encoding module 21 may also include: a second selection unit 215, used to select the target MAC address through any of the following processes: if the transmission direction of the first business data packet is from the client to the server, the source MAC address of the first business data packet is selected as the target MAC address; if the transmission direction of the first business data packet is from the server to the client, the destination MAC address of the first business data packet is selected as the target MAC address; or, if it is determined that a target MAC address selection principle is customized for the target network element device, the target MAC address is selected from the source MAC address and the destination MAC address of the first business data packet based on the target MAC address selection principle, and the target MAC address selection principle is used to customize the selection of at least one of the source MAC address and the destination MAC address as the target MAC address.

[0146] In some embodiments of the present application, Figure 4 As shown, the service chain session association device provided in this embodiment may also include: a detection module 28, which is used to detect whether the MAC address of the second business data packet adopts the target MAC address format if it monitors the second business data packet fed back by the target network element device for the first business data packet; if it adopts, it triggers the decoding module 23 to execute the step of decoding the target data from the target MAC address of the second business data packet; if it does not adopt, it performs at least one of the following abnormal handling on the second business data packet: discarding the second business data packet, informing the target network element device to send the second business data packet whose MAC address adopts the target MAC address format again.

[0147] In some embodiments of the present application, Figure 4 As shown, the sending module 22 can also be used to encrypt the encoded target MAC address before sending the encoded first business data packet to the target network element device, or to encrypt the encoded target MAC address and second data, where the second data includes at least one data in the five-tuple of the second business data packet that is not selected as target data.

[0148] In some embodiments of the present application, Figure 4As shown, the service chain session association device provided in this embodiment may also include: an establishment module 29, which is used to determine the data packet transmission direction between the client and the server in the target business scenario if it is determined to use the target service chain diversion strategy in the target business scenario, and the target service chain diversion strategy is used to indicate the calling order of each network element device in the service chain where the target network element device is located; if the data packet transmission direction includes a first transmission direction from the client to the server, then based on the first transmission direction, a communication connection is established for each network element device in the service chain corresponding to the target service chain diversion strategy, so as to realize the business data packet transmission in the first transmission direction from the client to the server based on the established communication connection; if the data transmission direction includes a second transmission direction from the server to the client, then based on the second transmission direction, a communication connection is established for each network element device in the service chain corresponding to the target service chain diversion strategy, so as to realize the business data packet transmission in the second transmission direction from the server to the client based on the established communication connection.

[0149] In the service chain session association device provided in the embodiment of the present application, the detailed explanations used during the operation of each functional module can be found in the corresponding detailed explanations of the above-mentioned service chain session association method embodiment, and will not be repeated here.

[0150] Furthermore, an embodiment of the present application also provides a computer-readable storage medium, which includes a stored program, wherein when the program is executed, the device where the storage medium is located is controlled to execute the above-mentioned service chain session association method.

[0151] Furthermore, an embodiment of the present application provides an electronic device, comprising: a memory for storing a program; and a processor coupled to the memory for running the program to execute the above-mentioned service chain session association method.

[0152] Furthermore, an embodiment of the present application also provides a computer program product, which includes: a computer program / computer-executable instructions, and the computer program / computer can execute the above-mentioned service chain session association method.

[0153] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0154] It is understood that the relevant features of the above methods and devices can be referenced to each other. In addition, the terms "first" and "second" in the above embodiments are used to distinguish between the embodiments, and do not represent the advantages and disadvantages of the embodiments.

[0155] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0156] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general-purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing such systems. In addition, the application is not directed to any specific programming language. It should be understood that various programming languages ​​can be utilized to implement the content of the application described herein, and the above description of specific languages ​​is for the purpose of disclosing the preferred embodiment of the application.

[0157] In addition, the memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0158] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0159] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data cutover device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data cutover device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0160] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data switching device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0161] These computer program instructions can also be loaded onto a computer or other programmable data switching device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0162] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0163] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0164] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0165] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0166] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0167] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A service chain session association method, characterized in that: Applied to a service chain orchestration device, the service chain orchestration device being connected to at least one network element device, the method comprising: If a first service data packet to be sent to a target network element device is received, encoding target data in the target quintuple of the first service data packet into the target MAC address of the service data packet, the target data being data in the quintuple that will be modified by the target network element device; Sending the encoded first service data packet to the target network element device; If a second service data packet fed back by the target network element device in response to the first service data packet is monitored, the target data is decoded from the target MAC address of the second service data packet; Based on the decoded quintuple of the target data and the second service data packet, the second service data packet is associated with the service chain session corresponding to the first service data packet.

2. The method according to claim 1, characterized in that Encoding the target data in the target quintuple of the first service data packet into the target MAC address of the service data packet includes: Encrypting the target data in the target quintuple of the first service data packet into ciphertext data of a target length; dividing the ciphertext data into at least two segments; assigning a corresponding embedding position to each segment in the target MAC address and embedding the segment; Alternatively, a prime number is assigned to the target data in the target quintuple of the first service data packet; a modular operation is performed on the target data using the prime number as a modulus; and a corresponding embedding position is assigned to the result of the modular operation in the target MAC address and the result is embedded therein; Alternatively, the target data in the target quintuple of the first service data packet is split into three parts; the three parts are respectively converted into color intensity values ​​of corresponding color channels; and a corresponding embedding position is assigned to each color intensity value in the target MAC address and embedded.

3. The method according to claim 1, characterized in that Associating the second service data packet with the service chain session corresponding to the first service data packet based on the decoded target data and the quintuple of the second service data packet includes: Selecting, from the quintuple of the second service data packet, first data to be compared with the decoded target data; If the first data is compared to the decoded target data and is identical to the decoded target data, then associating the second service data packet with the service chain session corresponding to the first service data packet based on the quintuple of the second service data packet; If the comparison shows that the first data is different from the decoded target data, the quintuple of the second business data packet is restored to the target quintuple based on the decoded target data, and the second business data packet is associated with the service chain session corresponding to the first data packet based on the restored target quintuple.

4. The method according to claim 3, characterized in that The method further comprises: Searching in existing sessions whether there is a service chain session corresponding to the quintuple of the second service data packet; if so, performing a step of associating the second service data packet with the service chain session corresponding to the first data packet based on the quintuple of the second service data packet; if not, discarding the second service data packet; and / or, Search the existing sessions to see whether there is a service chain session corresponding to the target quintuple; if so, execute the step of associating the second business data packet to the service chain session corresponding to the first data packet based on the restored target quintuple; if not, discard the second business data packet.

5. The method according to claim 1, characterized in that The method further comprises: Determine the target object located next to the target network element device based on the service chain diversion strategy corresponding to the target network element device, wherein the service chain diversion strategy is used to indicate the calling order of each network element device in the service chain where the target network element device is located; If the target object is a client or a server, performing restoration processing on the second service data packet and sending the restored second service data packet to the target object, the restoration processing comprising: restoring the quintuple of the second service data to the target quintuple based on the decoded target data, and restoring the target MAC address of the second service data packet to the state before the target data was encoded; If the target object is a network element device, the quintuple of the second service data packet is restored to the target quintuple based on the decoded target data, and the second service data packet with the quintuple is sent to the target object.

6. The method according to claim 1, characterized in that The target data includes at least one of the following data in the target quintuple: source IP address, destination IP address, source port number, destination port number, and transport layer protocol; and / or, If the target data includes a target port number, the method further includes: selecting the target port number through any of the following processes: if the transmission direction of the first business data packet is from the client to the server, selecting the source port number in the target quintuple of the first business data packet as the target port number; if the transmission direction of the first business data packet is from the server to the client, selecting the destination port number in the target quintuple of the first business data packet as the target port number; or, if it is determined that a target port number selection principle is customized for the target network element device, selecting the target port number from the source port number and the destination port number in the target quintuple of the first business data packet based on the target port number selection principle, wherein the target port number selection principle is used to customize the selection of at least one of the source port number and the destination port number as the target port number; and / or, The method also includes: selecting the target MAC address through any of the following processes: if the transmission direction of the first business data packet is from the client to the server, the source MAC address of the first business data packet is selected as the target MAC address; if the transmission direction of the first business data packet is from the server to the client, the destination MAC address of the first business data packet is selected as the target MAC address; or, if it is determined that a target MAC address selection principle is customized for the target network element device, the target MAC address is selected from the source MAC address and destination MAC address of the first business data packet based on the target MAC address selection principle, and the target MAC address selection principle is used to customize the selection of at least one of the source MAC address and the destination MAC address as the target MAC address.

7. The method according to any one of claims 1 to 6, characterized in that The method further includes: if a second service data packet fed back by the target network element device in response to the first service data packet is monitored, detecting whether the MAC address of the second service data packet adopts the target MAC address format; if so, performing the step of decoding the target data from the target MAC address of the second service data packet; if not, performing at least one of the following abnormal handling on the second service data packet: discarding the second service data packet, informing the target network element device to resend the second service data packet whose MAC address adopts the target MAC address format; and / or, Before sending the encoded first service data packet to the target network element device, the method further includes: encrypting the encoded target MAC address, or encrypting the encoded target MAC address and second data, where the second data includes at least one data in the quintuple of the second service data packet that is not selected as the target data; and / or, The method also includes: if it is determined to use the target service chain diversion strategy in the target business scenario, then determining the data packet transmission direction between the client and the server in the target business scenario, and the target service chain diversion strategy is used to indicate the calling order of each network element device in the service chain where the target network element device is located; if the data packet transmission direction includes a first transmission direction from the client to the server, then based on the first transmission direction, a communication connection is established for each network element device in the service chain corresponding to the target service chain diversion strategy, so as to realize the business data packet transmission in the first transmission direction from the client to the server based on the established communication connection; if the data transmission direction includes a second transmission direction from the server to the client, then based on the second transmission direction, a communication connection is established for each network element device in the service chain corresponding to the target service chain diversion strategy, so as to realize the business data packet transmission in the second transmission direction from the server to the client based on the established communication connection.

8. A service chain session association device, characterized in that: Applied to a service chain orchestration device, the service chain orchestration device is connected to at least one network element device, and the device includes: an encoding module, configured to, upon receiving a first service data packet to be sent to a target network element device, encode target data in a target quintuple of the first service data packet into a target MAC address of the service data packet, wherein the target data is data in the quintuple that will be modified by the target network element device; A sending module, configured to send the encoded first service data packet to the target network element device; a decoding module configured to decode the target data from the target MAC address of the second service data packet if a second service data packet fed back by the target network element device in response to the first service data packet is monitored; An association module is configured to associate the second business data packet with a service chain session corresponding to the first business data packet based on the decoded target data and the quintuple of the second business data packet.

9. A computer-readable storage medium, characterized in that The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the service chain session association method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: The electronic device includes: a memory for storing a program; and a processor coupled to the memory for running the program to execute the service chain session association method according to any one of claims 1 to 7.

11. A computer program product, characterized in that The computer program product includes: a computer program / computer-executable instructions, and the computer program / computer-executable instructions can execute the service chain session association method according to any one of claims 1 to 7.

Images