A service chain session association method and apparatus

Abstract

The application discloses a service chain session association method and device, and relates to the technical field of service chains; the main technical scheme comprises: a service chain arrangement device, the service chain arrangement device is connected with at least one network element device; if a first service data packet to be sent to a target network element device is received, target data in a target quintuple of the first service data packet is encoded into a target MAC address of the service data packet, the target data is data in the quintuple to be modified by the target network element device; the encoded first service data packet is sent to the target network element device; if a second service data packet fed back by the target network element device to the first service data packet is monitored, the target data is decoded from the target MAC address of the second service data packet; based on the decoded target data and the quintuple of the second service data packet, the second service data packet is associated to a service chain session corresponding to the first service data packet.

Description

Technical Field

[0001] This application relates to the field of service chain technology, and in particular to a service chain session association method and apparatus. Background Technology

[0002] Service Function Chaining (SFC) refers to the orderly combination of network services formed by service data packets passing through various network functions (NFs) in a user-defined order according to business logic requirements. The service chain orchestration device is responsible for guiding service data packets sequentially through these network functions to form the service chain. However, when the service chain orchestration device guides service data packets to some network functions (e.g., WAF network functions), these network functions may modify some key data (e.g., port number, IP address) in the five-tuple (source IP address, destination IP address, source port number, destination port number, and transport layer protocol) of the data packet when processing it based on business logic. This modification leads to inconsistencies in the five-tuples of the service data packets before and after processing. Consequently, after the network function returns the processed service data packets to the service chain orchestration device, the orchestration device cannot correctly associate the processed service data packets with the service chain session corresponding to the original service data packets, potentially causing session interruption or business logic anomalies.

[0003] Therefore, ensuring that the service chain orchestration device correctly associates the service data packets fed back by the network element device with the service chain session has become an urgent problem to be solved. Summary of the Invention

[0004] This application proposes a service chain session association method and apparatus, the main purpose of which is to ensure that the service chain orchestration device correctly associates the service data packets fed back by the network element device with the service chain session, so as to achieve the continuity and integrity of the service chain orchestration.

[0005] To achieve the above objectives, this application mainly provides the following technical solutions:

[0006] In a first aspect, this application provides a service chain session association method for a service chain orchestration device connected to at least one network element device. The service chain session association method includes at least the following steps: if a first service data packet to be sent to a target network element device is received, then the target data in the target 5-tuple of the first service data packet is encoded into the target MAC address of the service data packet, wherein the target data is data in the 5-tuple that will be modified by the target network element device; the encoded first service data packet is sent to the target network element device; if a second service data packet is detected as feedback from the target network element device in response to the first service data packet, then the target data is decoded from the target MAC address of the second service data packet; based on the decoded target data and the 5-tuple of the second service data packet, the second service data packet is associated with the service chain session corresponding to the first service data packet.

[0007] Secondly, this application provides a service chain session association device, applied to a service chain orchestration device, the service chain orchestration device being connected to at least one network element device, the service chain session association device comprising:

[0008] The encoding module is used to encode the target data in the target 5-tuple of the first service data packet into the target MAC address of the service data packet if a first service data packet to be sent to the target network element device is received. The target data is the data in the 5-tuple that will be modified by the target network element device.

[0009] The sending module is used to send the encoded first service data packet to the target network element device;

[0010] The decoding module is used to decode the target data from the target MAC address of the second service data packet if the target network element device detects a second service data packet fed back by the first service data packet.

[0011] The association module is used to associate the second service data packet with the service chain session corresponding to the first service data packet based on the decoded target data and the five-tuple of the second service data packet.

[0012] Thirdly, this application provides a computer-readable storage medium including a stored program, wherein the program, when running, controls the device where the storage medium is located to execute the service chain session association method described in the first aspect.

[0013] Fourthly, this application provides an electronic device, the electronic device comprising: a memory for storing a program; and a processor coupled to the memory for running the program to perform the service chain session association method described in the first aspect.

[0014] Fifthly, this application provides a computer program product comprising: a computer program / computer executable instructions, wherein the computer program / computer executable is the service chain session association method described in the first aspect.

[0015] The service chain session association method and apparatus provided in this application, upon receiving a first service data packet to be sent to a target network element device connected to the service chain orchestration device, encodes the target data in the target 5-tuple (i.e., the original 5-tuple of the first service data packet) into the target MAC address of the service data packet. The target data is the data in the 5-tuple that will be modified by the target network element device. Then, the encoded first service data packet is sent to the target network element device. If a second service data packet is detected from the target network element device in response to the first service data packet, the target data is decoded from the target MAC address of the second service data packet. Based on the decoded target data and the 5-tuple of the second service data packet, the second service data packet is associated with the service chain session corresponding to the first service data packet. As can be seen, the solution provided in this embodiment encodes the target data that may be modified by the network element device in the five-tuple of the service data packet into the MAC address of the service data packet before the service chain orchestration device guides the service data packet to the network element device. In this way, even if the network element device modifies the target data of the service data packet when processing the service data packet based on the service logic after the service data packet is guided to the network element device, the service chain orchestration device can still obtain the original target data by decoding the MAC address after the network element device returns the processed service data packet. Then, based on the decoded target data and the five-tuple of the processed service data packet, the original five-tuple is restored, and the processed service data packet is correctly associated with the service chain session corresponding to the service data packet before processing based on the original five-tuple, thereby realizing the continuity and integrity of service chain orchestration.

[0016] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1A flowchart of a service chain session association method provided in one embodiment of this application is shown;

[0019] Figure 2 This illustration shows an interactive diagram of a service chain orchestration device according to an embodiment of this application;

[0020] Figure 3 This illustration shows a structural schematic diagram of a service chain session association device according to an embodiment of this application;

[0021] Figure 4 A schematic diagram of the structure of a service chain session association device provided in another embodiment of this application is shown. Detailed Implementation

[0022] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0023] Currently, when service chain orchestration devices direct service data to certain network elements, these network elements may modify some key data in the five-tuple of the data packet when processing the service data packet based on service logic. This can lead to inconsistencies in the five-tuple of the service data packet before and after processing. However, service chain orchestration devices typically rely on the five-tuple for session tracking and traffic orchestration. If a network element modifies the five-tuple while processing a service data packet, the service chain orchestration device cannot correctly associate the processed service data packet with the service chain session corresponding to the original service data packet, resulting in session interruption or loss of service data packets. For example, after receiving a web service data packet from a service chain orchestration device, the WAF (Web Application Firewall) network element device decrypts and re-encapsulates it, and modifies the source port number in the 5-tuple. After the WAF network element device sends the processed web service data packet back to the service chain orchestration device, the service chain orchestration device mistakenly believes that this is a new independent session based on the modified 5-tuple, rather than a continuation of the original session. The service chain orchestration device cannot correctly associate the processed service data packet with the service chain session corresponding to the original service data packet. This problem seriously affects the reliability and traceability of the service chain, making subsequent traffic scheduling, policy enforcement, and log auditing difficult.

[0024] Research has revealed that service chain orchestration devices and network elements that may modify the 5-tuple are typically deployed using Layer 2 switching. In this deployment, network elements modify some key data within the 5-tuple of service data packets when processing them based on business logic, but do not modify the MAC (Media Access Control Address) address. Therefore, before the service chain orchestration device directs service data packets to the network element, the target data that might be modified by the network element can be encoded into the MAC address of the service data packet. This way, even if the target data is modified after the service data packet is directed to the network element, the service chain orchestration device can still obtain the original target data by decoding the MAC address after the network element returns the processed service data packet. Based on the decoded target data and the 5-tuple of the processed service data packet, the original 5-tuple can be reconstructed, and the processed service data packet can be correctly associated with the service chain session corresponding to the original service data packet. This enables normal interaction and effective orchestration between the service chain orchestration device and such network elements.

[0025] Based on the above findings, this application provides a specific service chain session association technical solution, which includes: if a first service data packet to be sent to a target network element device connected to the service chain orchestration device is received, then the target data in the target 5-tuple of the first service data packet is encoded into the target MAC address of the service data packet, wherein the target data is the data in the 5-tuple that will be modified by the target network element device; the encoded first service data packet is sent to the target network element device; if a second service data packet is detected from the target network element device in response to the first service data packet, then the target data is decoded from the target MAC address of the second service data packet; based on the decoded target data and the 5-tuple of the second service data packet, the second service data packet is associated with the service chain session corresponding to the first service data packet.

[0026] Based on the above service chain session association technology solution, this embodiment specifically provides a service chain session association method and apparatus. The service chain session association method and apparatus provided in this embodiment will be described in detail below.

[0027] This application provides a service chain session association method. The service chain session association method provided in this embodiment is applied to a service chain orchestration device, which is connected to at least one network element device.

[0028] In some embodiments, the number and type of network element devices connected to the service chain orchestration device can be flexibly selected based on business needs, and this embodiment does not limit this. For example, the network element devices connected to the service chain orchestration device may include, but are not limited to, at least one of the following: switches, routers, load balancers, border gateways, security devices (e.g., firewalls, intrusion detection systems, defense systems, deep packet inspection devices), network optimization devices, monitoring and analysis devices, etc.

[0029] In some embodiments, the network element devices connected to the service chain orchestration device include target network element devices. A target network element device is one that, when processing service data packets based on its service logic, may modify some key data in the five-tuple of the service data packet. The target network element device can be flexibly selected based on service needs; in principle, any network element device that may modify some key data in the five-tuple of the service data packet can be identified as a target network element device. For example, the target network element device may include, but is not limited to, WAF network element devices.

[0030] like Figure 1 As shown, the service chain session association method provided in this embodiment may include at least the following steps 101 to 104.

[0031] 101. If a first service data packet to be sent to the target network element is received, the target data in the target 5-tuple of the first service data packet is encoded into the target MAC address of the service data packet. The target data is the data in the 5-tuple that will be modified by the target network element.

[0032] In some embodiments, the objects connected to the service chain orchestration device may include, but are not limited to, clients, servers, and network element devices. The service data packets received by the service chain orchestration device may be service data packets to be sent to any of the aforementioned objects. Therefore, in order to promptly and accurately identify the first service data packet to be sent to the target network element device from the service data packets received by the service chain orchestration device, the service chain session association method provided in this embodiment may further include the following steps A to B.

[0033] Step A: If any service data packet is received, determine the sender of the service data packet, and determine the target object next to the sender based on the service chain diversion strategy corresponding to the sender.

[0034] Clients, servers, and network elements connected to the service chain orchestration device can all be senders of service data packets. Each sender has its own corresponding service chain routing strategy. The service chain routing strategy indicates the calling order of each network element in the sender's service chain. It is a crucial basis for determining the receiver of the service data packet. Therefore, after determining the sender of the service data packet, the corresponding service chain routing strategy is obtained. In principle, the service data packet carries its sender information and the sender's current corresponding service chain routing strategy. Therefore, based on the information carried by the service data packet, the sender and its corresponding service chain routing strategy can be determined.

[0035] Step B: Match the device type of the target object with the target device type, and determine whether the service data packet is the first service data packet to be sent to the target network element device based on the matching result.

[0036] The target device type is the device type of the network element that modifies the five-tuple. If the target device type successfully matches the target device type, the service data packet is identified as the first service data packet received and to be sent to the target network element. If the target device type does not successfully match the target device type, it is determined that the first service data packet to be sent to the target network element has not been received, and the received service data packet can be directly sent to the target device.

[0037] After confirming that the first service data packet to be sent to the target network element has been received, it is necessary to select the target data from the target 5-tuple of the first service data packet and select the target MAC address from the MAC address of the service data packet. The following will explain these two selection processes separately.

[0038] In some embodiments, the target data selected from the target 5-tuple of the first service data packet can be flexibly determined based on service needs, and this embodiment does not limit this. For example, the target data may include at least one of the following data in the target 5-tuple: source IP address, destination IP address, source port number, destination port number, and transport layer protocol.

[0039] Specifically, the method for selecting target data from the target quintuple of the first service data packet can include at least the following method A1 and method A2.

[0040] Method A1, the specific process of selecting target data from the target 5-tuple of the first service data packet may include the following steps: determining the device type of the target network element and the transmission direction corresponding to the first service data packet (the transmission direction is used to indicate whether the first service data packet is transmitted from the client to the server or from the server to the client), wherein different device types and transmission directions have corresponding 5-tuple data types, and the 5-tuple data types are used to indicate the data in the 5-tuple that the network element device of the corresponding device type will modify; based on the 5-tuple data type corresponding to the determined device type and transmission direction, selecting the target data from the 5-tuple of the first service data packet.

[0041] For example, the data type of the five-tuple corresponding to the WAF device type and the transmission direction from the client to the server is the source port number type. If the target network element device is determined to be a WAF device type and the transmission direction corresponding to the first service data packet is from the client to the server, then the source port number in the five-tuple of the first service data packet is selected as the target data.

[0042] Method A2: If it is known that the target network element will modify the port number of the first service data packet, then the port number to be modified should be selected as the target port number included in the target data. The selection of the target port number can include the following two methods:

[0043] One approach is to select the source port number from the destination 5-tuple of the first service data packet as the destination port number if the transmission direction of the first service data packet is from the client to the server. Conversely, if the transmission direction of the first service data packet is from the server to the client, the destination port number from the destination 5-tuple of the first service data packet is selected as the destination port number. Considering that network elements typically modify the corresponding port number for the client, and the probability of modifying the corresponding port number for the server is low, the destination port number is selected based on the transmission direction of the first service data packet, choosing the port number corresponding to the client from both the source and destination port numbers.

[0044] Another approach is to select a target port number based on a predetermined target port number selection principle for the target network element. This principle is used to select the target port number from the source and destination port numbers in the target 5-tuple of the first service data packet. The target port number selection principle is used to customize the selection of at least one of the source and destination port numbers as the target port number. Considering that some network elements may modify the source port number, some may modify the destination port number, and some may modify both the source and destination port numbers when processing service data packets, corresponding target port number selection principles can be customized for different network elements. This allows for targeted selection of the target port number from the source and destination port numbers for each network element based on the customized principle.

[0045] Furthermore, considering that some network elements require not only the target port number as target data, but also other data in the five-tuple as target data, the following steps can be performed after executing method A2: determine the device type of the target network element; determine whether there is a corresponding mapping relationship between the preset device type and selection principle for the target network element's device type; if so, based on the selection principle corresponding to the device type of the target network element, select data that needs to be used together with the target port number as target data from the source IP address, destination IP address, and transport layer protocol included in the five-tuple of the first service data packet. The selection principle is used to indicate the selection of at least one of the source IP address, destination IP address, and transport layer protocol together with the target port number as target data.

[0046] The above methods A1 and A2 can be flexibly selected and used based on business needs, and this embodiment does not limit this.

[0047] In some embodiments, the method for selecting a target MAC address from the MAC addresses of a service data packet may include at least the following methods B1 and B2.

[0048] Method B1: If the transmission direction of the first service data packet is from the client to the server, then the source MAC address of the first service data packet is selected as the destination MAC address. If the transmission direction of the first service data packet is from the server to the client, then the destination MAC address of the first service data packet is selected as the destination MAC address. Based on the transmission direction of the first service data packet, the selection principle of the destination MAC address is defined. This allows for quick location of the MAC address containing the target data during subsequent decoding, thus enabling faster decoding of the target data.

[0049] Method B2: If it is determined that there is a target MAC address selection principle for the target network element device, then the target MAC address is selected from the source MAC address and destination MAC address of the first service data packet based on the target MAC address selection principle. The target MAC address selection principle is used to customize the selection of at least one of the source MAC address and destination MAC address as the target MAC address.

[0050] Considering that the source and destination MAC addresses of some target network elements may be modified if they are attacked or experience service anomalies, and if the destination MAC address is modified, the target data encoded within it may also be modified. Therefore, a target MAC address selection principle is customized for different network elements based on their source and destination MAC addresses. This principle selects the target MAC address based on the customized target MAC address selection principle for each network element. It should be noted that if the destination MAC address includes both the source and destination MAC addresses, the target data will be encoded into both the source and destination MAC addresses.

[0051] The above methods B1 and B2 can be flexibly selected and used based on business needs, and this embodiment does not limit this.

[0052] In some embodiments, after selecting the target data and the target MAC address, the step of encoding the target data in the target 5-tuple of the first service data packet into the target MAC address of the service data packet is performed. The implementation method of this step may include at least the following methods C1 to C4.

[0053] Method C1: Encrypt the target data in the target quintuple of the first service data packet into ciphertext data of the target length; divide the ciphertext data into at least two segments; allocate a corresponding embedding position for each segment in the target MAC address and embed it.

[0054] The encryption key, encryption algorithm, and target length can all be flexibly selected based on business needs. The number of segments and their embedding positions can also be flexibly selected based on business needs. It should be noted that the embedding position of each segment can be adjacent to the target MAC address or not adjacent within the target MAC address; the specific situation can be determined based on business requirements.

[0055] For example, the target data includes port number 443 and target MAC address 00:1A:2B:00:00:00. The target data is encrypted using a preset key and a preset encryption algorithm to obtain ciphertext data of a preset length. Then, the ciphertext data is divided into three segments, and each segment is assigned a corresponding embedding position in the target MAC address and embedded, resulting in the following result: 00:1A:2B:38:33:61. This result represents the state after the target data is encoded into the target MAC address.

[0056] Because the target data is encrypted, this method ensures that even if the encoded target MAC address is leaked, attackers cannot deduce the target data from the target MAC address, and the target data will not be leaked, thus improving security.

[0057] Method C2: Assign a prime number to the target data in the target quintuple of the first service data packet; perform a modulo operation on the target data using the prime number as the modulus; and assign and embed the corresponding embedding position in the target MAC address for the modulo operation result.

[0058] The prime number assigned to the target data can be determined based on business needs, and this embodiment does not impose any limitations. It should be noted that the assigned prime number needs to be recorded by the service chain orchestration device for subsequent use when decoding the target data from the target MAC address. For example, when the target data is a target port number, the prime number is greater than the maximum port number of the corresponding port.

[0059] For example, the target data is target port number 443, and the target MAC address is 00:1A:2B:00:00:00. A prime number 65537 is assigned to the target port number. The process of performing a modulo operation on the target port number using the prime number as the modulus is: (443 × 65537) mod 2. 24 =12255675. Convert 12255675 to hexadecimal BB02FB, then allocate the corresponding embedding position for the modulo operation result in the target MAC address and embed it, resulting in the encoded target MAC address: 00:1A:2B:BB:02:FB.

[0060] This method uses prime numbers as the modulus to perform modular arithmetic on the target data. Even if the encoded target MAC address is leaked, the attacker cannot deduce the target data from the target MAC address because they do not know the assigned prime number, thus reducing the possibility of target data leakage.

[0061] Method C3: Split the target data in the target quintuple of the first service data packet into three parts; convert the three parts into color intensity values ​​of the corresponding color channels; allocate and embed the corresponding embedding position for each color intensity value in the target MAC address.

[0062] Considering that users may manage and track corresponding sessions in the monitoring interface when using service chain orchestration equipment, in order to enable the encoding operation to achieve service chain session association while also enabling visual tracking of the corresponding business data packets in the monitoring interface, the target data in the target quintuple of the first business data packet is split into three parts, and the three parts are converted into color intensity values ​​of the corresponding RGB three color channels. A corresponding embedding position is assigned to each color intensity value in the target MAC address and embedded.

[0063] For example, the target data is target port number 8080, and the target MAC address is 00:1A:2B:00:00:00. The target port number 8080 is converted to binary 00011111 10010000, and then split into 00011111, 100100, and 00, corresponding to the RGB color channels respectively. Then, 00011111 is converted to an R color channel intensity value of 31, 100100 to a G color channel intensity value of 36, and 00 to a B color channel intensity value of 0. Each color intensity value is then embedded into the target MAC address, resulting in the encoded target MAC address: 00:1A:2B:31:36:0. Thus, if a user needs to distinguish the current session through the monitoring interface during service chain orchestration, these color intensity values ​​can be used to identify the path of the business data packets within the service chain.

[0064] Method C4: Encode the target data in the target 5-tuple of the first service data packet into a field at a specified location in the target MAC address. The specified location can be flexibly selected based on service needs, and this embodiment does not limit it.

[0065] The above methods C1 to C4 can be flexibly selected and used according to business needs, and this embodiment does not limit this.

[0066] 102. Send the encoded first service data packet to the target network element device.

[0067] After encoding is completed, the service chain orchestration device sends the encoded first service data packet to the target network element device, so that the target network element device can process the encoded first service data packet based on its own business logic.

[0068] Furthermore, before sending the encoded first service data packet to the target network element device, the service chain session association method provided in this embodiment may also include any of the following steps: First, encrypting the encoded target MAC address. This makes it difficult for an attacker to decode the target data from the target MAC address even if it is leaked. Second, encrypting the encoded target MAC address and second data, wherein the second data includes at least one piece of data from the five-tuple of the second service data packet that was not selected as target data. This makes it difficult for an attacker to decode the target data from the target MAC address even if it is leaked, and also difficult to obtain the data from the five-tuple of the first service data packet from the second data. It should be noted that the encryption processes mentioned in the above two steps need to be agreed upon by the service chain orchestration device and the target network element device. After the encoded first service data packet is sent to the target network element device, the target network element device can perform decryption processing matching the encryption processing, enabling it to process the service data packet based on the decoded data and business logic.

[0069] 103. If a second service data packet is detected from the target network element device in response to the first service data packet, the target data is decoded from the target MAC address of the second service data packet.

[0070] After receiving the encoded first service data, the target network element will process the service data packet based on its own service logic. During this processing, it is highly likely that some data in the five-tuple of the first service data will be modified. Therefore, the five-tuple of the second service data packet received by the service chain encoding device is likely inconsistent with the target five-tuple of the first service data packet. Thus, to ensure that the service chain orchestration device can associate the second service data packet with the session of the first service data packet, it needs to decode the target data from the target MAC address of the second service data packet. Based on the target data and the five-tuple of the second service data packet, it needs to reconstruct the five-tuple before it was modified by the target network element.

[0071] It should be noted that the decoding process of extracting the target data from the target MAC address of the second service data packet is the reverse of the encoding process in step 101. Therefore, it will not be described in detail here.

[0072] 104. Based on the decoded target data and the quintuple of the second service data packet, associate the second service data packet with the service chain session corresponding to the first service data packet.

[0073] The specific process of associating the second service data packet with the service chain session corresponding to the first service data packet based on the decoded target port number and the five-tuple of the second service data packet may include the following steps 104A to 104C.

[0074] 104A. Select the first data to be compared with the decoded target data from the five-tuple of the second service data packet.

[0075] The data type of the five-tuple involved in the target data is determined. Then, based on the data type of the five-tuple, the first data to be compared with the decoded target data is selected from the five-tuples of the second service data packet. The data type of the five-tuple may include, but is not limited to, at least one of the following: source IP address type, destination IP address type, source port number type, destination port number type, and transport layer protocol type.

[0076] For example, if the target data includes a source port number, then the data type of the 5-tuple involved is the source port number type. The first data selected from the 5-tuple of the second service data packet to be compared with the target data to be decoded is the source port number.

[0077] 104B. If the first data is found to be the same as the decoded target data, then the second service data packet is associated with the service chain session corresponding to the first data packet based on the five-tuple of the second service data packet.

[0078] If the first data is found to be the same as the decoded target data, it means that the target network element device has most likely not modified the 5-tuple. The 5-tuple of the second service data packet is still the same as the target 5-tuple of the first service data packet. Based on the 5-tuple of the second service data packet, the second service data packet can be associated with the service chain session corresponding to the first service data packet.

[0079] Furthermore, the service chain orchestration device maintains a session table, which records existing sessions and session states in the service chain orchestration. Based on this, after comparing the first data with the decoded target data, the service chain session association method provided in this embodiment may further include the following steps: Searching for the existence of a service chain session corresponding to the five-tuple of the second service data packet in the existing sessions. If it is determined that a service chain session corresponding to the five-tuple of the second service data packet exists in the existing sessions, it indicates that the second service data packet is a service data packet that guarantees the continuity and integrity of the corresponding session. Therefore, the step of associating the second service data packet with the service chain session corresponding to the first data packet based on the five-tuple of the second service data packet is executed. If it is determined that a service chain session corresponding to the five-tuple of the second service data packet does not exist in the existing sessions, it indicates that the second service data packet is an invalid data packet, or the session originally corresponding to the second service data packet has expired. Therefore, to avoid the second service data packet affecting other service chain orchestration operations of the service chain orchestration device, the second service data packet is discarded.

[0080] 104C. If the first data is found to be different from the decoded target data, the five-tuple of the second service data packet is restored to the target five-tuple based on the decoded target data, and the second service data packet is associated with the service chain session corresponding to the first data packet based on the restored target five-tuple.

[0081] If the first data is found to be different from the decoded target data, it means that the target network element device has most likely modified the 5-tuple. The 5-tuple of the second service data packet is inconsistent with the target 5-tuple of the first service data packet. Therefore, in order to ensure that the second service data packet can be associated with the service chain session corresponding to the first service data packet, it is necessary to restore the 5-tuple of the second service data packet to the target 5-tuple based on the decoded target data, and then associate the second service data packet with the service chain session corresponding to the first data packet based on the restored target 5-tuple.

[0082] Specifically, the process of restoring the five-tuple of the second service data packet to the target five-tuple based on the decoded target data is as follows: determine the data type of the five-tuple involved in the decoded target data; replace the corresponding data of the data type in the five-tuple of the second service data packet with the corresponding target data. For example, if the data type of the five-tuple involved in the decoded target data is determined to be a source port number type, then the source port number in the five-tuple of the second service data packet is replaced with the source port number included in the target data.

[0083] Furthermore, after comparing the first data with the decoded target data, the service chain session association method provided in this embodiment may further include the following steps: Searching for the existence of a service chain session corresponding to the target 5-tuple in existing sessions. If it is determined that a service chain session corresponding to the target 5-tuple exists in existing sessions, it indicates that the second service data packet is a service data packet that guarantees the continuity and integrity of the corresponding session. Therefore, the step of associating the second service data packet with the service chain session corresponding to the first data packet based on the restored target 5-tuple is executed. If it is determined that a service chain session corresponding to the target 5-tuple does not exist in existing sessions, it indicates that the second service data packet is an invalid data packet, or the session originally corresponding to the target 5-tuple has expired. Therefore, to avoid the second service data packet affecting other service chain orchestration work of the service chain orchestration device, the second service data packet is discarded.

[0084] The service chain session association method provided in this application, upon receiving a first service data packet to be sent to a target network element device connected to the service chain orchestration device, encodes the target data in the target 5-tuple (i.e., the original 5-tuple of the first service data packet) into the target MAC address of the service data packet. The target data is the data in the 5-tuple that will be modified by the target network element device. Then, the encoded first service data packet is sent to the target network element device. If a second service data packet is detected from the target network element device in response to the first service data packet, the target data is decoded from the target MAC address of the second service data packet. Based on the decoded target data and the 5-tuple of the second service data packet, the second service data packet is associated with the service chain session corresponding to the first service data packet. As can be seen, the solution provided in this embodiment encodes the target data that may be modified by the network element device in the five-tuple of the service data packet into the MAC address of the service data packet before the service chain orchestration device guides the service data packet to the network element device. In this way, even if the network element device modifies the target data of the service data packet when processing the service data packet based on the service logic after the service data packet is guided to the network element device, the service chain orchestration device can still obtain the original target data by decoding the MAC address after the network element device returns the processed service data packet. Then, based on the decoded target data and the five-tuple of the processed service data packet, the original five-tuple is restored, and the processed service data packet is correctly associated with the service chain session corresponding to the service data packet before processing based on the original five-tuple, thereby realizing the continuity and integrity of service chain orchestration.

[0085] In some embodiments of this application, in order to improve the service chain orchestration efficiency, after sending the encoded first service data packet to the target network element device in step 102 above, the service chain session association method provided in this embodiment may further include the following steps: if a second service data packet is detected from the target network element device in response to the first service data packet, then it is detected whether the MAC address of the second service data packet adopts the target MAC address format.

[0086] The target MAC address format is a pre-defined format used by the service chain orchestration device and network element devices, and it serves as the basis for identifying legitimate service data packets. The target MAC address format can be set based on service needs, and this embodiment does not limit this. For example, the target MAC address format is: 0X02:F2:00:Port:AA:BB. Port is the encoded embedded target data (specifically, the port number), and AA and BB are relatively fixed values ​​such as the fixed ID value of the service chain orchestration device.

[0087] If the MAC address of the second service data packet is detected to be in the format of the target MAC address, it means that the second service data packet is a legitimate data packet and can continue to be processed. Therefore, the step of decoding the target data from the target MAC address of the second service data packet in step 103 is continued.

[0088] If the MAC address of the second service data packet is detected to be not in the target MAC address format, it indicates that the second service data packet is likely invalid. Therefore, at least one of the following abnormal handling methods can be applied to the second service data packet: First, discard the second service data packet to prevent it from affecting the service chain orchestration work of the service chain orchestration equipment and to prevent the second service data from occupying the storage space of the service chain orchestration equipment. Second, instruct the target network element to resend the second service data packet with the MAC address in the target MAC address format. In this case, if the target network element resends the second service data packet without using the target MAC address format, no further notification is needed; simply display an error message.

[0089] In some embodiments of this application, the service chain session association method provided in this embodiment may further include the following steps 105 to 107 after step 104 above.

[0090] 105. Based on the service chain traffic redirection strategy corresponding to the target network element device, determine the target object located next to the target network element device. The service chain traffic redirection strategy is used to indicate the calling order of each network element device in the service chain where the target network element device is located.

[0091] The first service data packet carries its sender information and the current service chain redirection strategy of the sender. Therefore, the service chain redirection strategy corresponding to the target network element device is determined based on the information carried by the first service data packet.

[0092] If there is no next network element in the call sequence for the target network element: if the first service data packet is transmitted from the client to the server, then the server is identified as the target object; if the first service data packet is transmitted from the server to the client, then the client is identified as the target object.

[0093] 106. If the target object is a client or a server, the second business data packet is restored, and the restored second business data packet is sent to the target object.

[0094] If the target object is a client or server, it means that the service chain processing is about to end and the data packet is about to leave the service chain. Therefore, in order for the client or server to use the original five-tuple and MAC address of the business data packet, the second business data packet is restored and the restored second business data packet is sent to the target object.

[0095] The restoration process includes two steps: first, restoring the 5-tuple of the second service data to the target 5-tuple based on the decoded target data; second, restoring the target MAC address of the second service data packet to its position before encoding the target data. Through this restoration process, the 5-tuple of the second service data packet is restored to be identical to the target 5-tuple of the first service data packet, and the MAC address of the second service data packet is restored to be identical to the MAC address of the first service data packet. In this way, the client or server can process the service data packets based on this restored data.

[0096] 107. If the target object is a network element device, the five-tuple of the second service data packet is restored to the target five-tuple based on the decoded target data, and the second service data packet with the five-tuple is sent to the target object.

[0097] If the target is a network element device, it means that after the second service data packet is directed to the target device, the target device may still modify the 5-tuple. Therefore, to reduce encoding operations, the encoded target MAC address in the second service data packet remains unchanged. However, to prevent the modified 5-tuple of the target network element device from affecting the target device's processing of the second service data packet, the 5-tuple of the second service data packet is restored to the target 5-tuple based on the decoded target data, and the second service data packet with the 5-tuple is sent to the target device.

[0098] In some embodiments of this application, a key factor in the service chain orchestration device orchestrating service chains is the successful establishment of a network connection between the service chain orchestration device and the network element device. Based on this, the service chain session association method provided in this embodiment may further include the following methods one and two for establishing a network connection.

[0099] Method 1: The service chain session association method provided in this embodiment may further include the following steps: If it is determined that a target service chain traffic redirection strategy is used in the target business scenario, then the data packet transmission direction between the client and the server in the target business scenario is determined. The target service chain traffic redirection strategy is used to indicate the calling order of each network element device in the service chain where the target network element device is located. If the data packet transmission direction includes a first transmission direction from the client to the server, then a communication connection is established for each network element device in the service chain corresponding to the target service chain traffic redirection strategy based on the first transmission direction, so as to realize the transmission of business data packets from the client to the server in the first transmission direction based on the established communication connection. If the data transmission direction includes a second transmission direction from the server to the client, then a communication connection is established for each network element device in the service chain corresponding to the target service chain traffic redirection strategy based on the second transmission direction, so as to realize the transmission of business data packets from the server to the client in the second transmission direction based on the established communication connection.

[0100] In some embodiments, considering that the communication status of the service chain orchestration device and the network element device may change in real time, in order to ensure the success rate of service chain orchestration, a communication connection is established only when it is determined that the transmission direction needs to be enabled. For example, when it is determined that the client needs to send a request service data packet to the server, a communication connection is established in the first transmission direction, and a communication connection is not established in the second transmission direction at this time. Only after the request service data packet arrives at the server and the server generates a corresponding response service data packet does the establishment of a communication connection in the second transmission direction begin.

[0101] Method 2, the service chain session association method provided in this embodiment may further include the following steps: If it is determined that a target service chain traffic redirection strategy is used in the target business scenario, the target service chain traffic redirection strategy is used to indicate the calling order of each network element device in the service chain where the target network element device is located; if it is determined that a business data packet needs to be transmitted from the client to the server, a communication connection is established for each network element device in the corresponding service chain of the target service chain traffic redirection strategy based on the transmission direction from the client to the server; after the establishment is completed, the service chain orchestration device transmits the business data packet from the client to the server based on the established communication connection; when the business data packet is transmitted to the last network element device in the service chain, the service chain orchestration device establishes a communication connection between the last network element device and the server, and after the communication connection is successfully established, the business data packet is transmitted to the server based on the established communication connection. Then, after the server sends back a response business data packet, the response business data packet is transmitted back to the client based on the previously established communication connection.

[0102] In some embodiments of this application, the following are used as examples. Figure 2 Using the interactive schematic diagram of the service chain orchestration device shown as an example, this embodiment illustrates the service chain session association method. Figure 2 This includes service chain orchestration equipment, clients, servers, and target network element device NF1 (for example, target network element device NF1 is a WAF network element device). Figure 2 The document illustrates the service chain session association process from client to server and from server to client. These two service chain session association processes include steps 1 to 20 (these steps are illustrated using the target port number as the target data as an example). These 20 steps correspond to... Figure 2 The numbers 1-20 in the table represent the execution order of steps 1 to 20.

[0103] Before explaining steps 1 to 20, let's clarify... Figure 2The illustrated embodiment involves the following concepts: For forward service data packets, the service chain orchestration device selects the source port number from the 5-tuple of the forward service data packet as the destination port number and the source MAC address of the forward service data packet as the destination MAC address. For reverse service data packets, the service chain orchestration device selects the destination port from the 5-tuple of the reverse service data packet as the destination port number and the destination MAC address of the reverse service data packet as the destination MAC address.

[0104] Step 1: The client sends a TCP SYN packet to the service chain orchestration device.

[0105] For example, in the target business scenario of a user accessing a server's web service, a target service chain referral strategy is determined, which indicates that the service chain includes the target network element device NF1. It is determined that in the target business scenario, the client first uses a first transmission direction to the server. Based on this first transmission direction, communication connections need to be established for each network element device in the corresponding service chain of the target service chain referral strategy to achieve the transmission of business data packets from the client to the server in the first transmission direction. At this time, to establish a communication connection, the client sends a SYN data packet to the service chain orchestration device. For ease of explanation later, the five-tuple of the SYN data packet sent by the client to the service chain orchestration device is defined as the first five-tuple.

[0106] Step 2: The service chain orchestration device receives the SYN packet sent by the client through the ge1 interface, extracts the first 5-tuple from the SYN packet, and creates a session. Then, it performs service chain traffic redirection strategy matching. The matching reveals that this SYN packet needs to be sent to the target network element device NF1. Since the target network element device NF1 is a device that modifies the 5-tuple, it selects the target port number from the first 5-tuple of the SYN packet, selects the target MAC address from the MAC address of the SYN packet, and encodes the target port number from the first 5-tuple of the SYN packet into the target MAC address of the SYN packet. Then, it sends the encoded SYN packet to the target network element device NF1 through the ge3 interface.

[0107] Specifically, the original source and destination MAC addresses of the SYN packet are first saved for later recovery. Since the SYN packet is a forward packet, the source port number in the first 5-tuple of the SYN packet is selected as the destination port number, and the source MAC address of the SYN packet is selected as the destination MAC address.

[0108] Step 3: The target network element device NF1 receives the encoded SYN data packet from its internal network port, processes the encoded SYN data packet based on business logic to obtain the TCP protocol SYN_ACK data packet, and sends the SYN_ACK data packet to the service chain orchestration device.

[0109] Step 4: The service chain orchestration device receives the SYN_ACK data packet sent by the target network element device NF1 from the ge3 interface. Since the ge3 interface is connected to the internal network interface of the target network element device NF1, this SYN_ACK data packet is a reverse data packet. Therefore, the service chain orchestration device decodes the destination port number from the destination MAC address of the second service data packet, and then compares the decoded destination port number with the destination port number in the five-tuple of the SYN_ACK data packet. If the two are different, the destination port in the five-tuple of the SYN_ACK data packet is modified according to the decoded destination port number, and the five-tuple of the SYN_ACK data packet is modified to be the same as the first five-tuple of the SYN data packet in Step 1. Then, the session is searched through the first 5-tuple. If no session is found, the SYN_ACK packet is discarded and it is determined that the communication connection was not successfully established. If a session is found, the SYN_ACK packet is associated with the searched session. The target service chain redirection policy is obtained to determine that there are no other network element devices. Therefore, the 5-tuple of the restored SYN_ACK packet is the same as the first 5-tuple, and the source MAC address and destination MAC address of the restored SYN_ACK packet are the same as those of the SYN packet in step 1. The restored SYN_ACK packet is then sent to the client.

[0110] Step 5: The client receives the SYN_ACK data packet sent by the service chain orchestration device and, according to its business logic, sends an ACK data packet in TCP protocol to the service chain orchestration device.

[0111] Step 6: The service chain orchestration device receives the ACK data packet sent by the client through the ge1 interface, associates the session and updates the session information, then matches the target service chain traffic redirection strategy to determine that the ACK data packet needs to be sent to the target network element device NF1. This ACK data packet is a forward data packet, and the source port number in its five-tuple is encoded as the target port number into its source MAC address (the source MAC address here is the selected target MAC address). The encoded ACK data packet is then sent to the target network element device NF1 through the ge3 interface.

[0112] Step 7: After the client sends the ACK packet, it indicates that the TCP three-way handshake has been completed with the service chain orchestration device, and the communication connection in the first transmission direction has been successfully established. Based on the established communication connection, the client can transmit business data packets to the server in the first transmission direction. Therefore, the client sends business data packet A to the service chain orchestration device.

[0113] Step 8: The service chain orchestration device receives Packet A sent by the client through the ge1 interface, associates the session and updates the session information, then matches the target service chain traffic redirection strategy to determine that Packet A needs to be sent to the target network element device NF1. Since this Packet A data packet is a forward data packet, the source port number in its five-tuple is encoded as the target port number into its source MAC address (the source MAC address here is the selected target MAC address), and then the encoded Packet A is sent to the target network element device NF1 through the ge3 interface.

[0114] Step 9: Target network element device NF1 receives Packet A from its internal network port and processes Packet A according to its business logic. To transmit Packet A to the server, a communication connection needs to be established between NF1 and the server. Therefore, NF1 sends a SYN packet to the service chain orchestration device through its external network port to establish a communication connection with the server. The source port number of this SYN packet is different from the source port number of the SYN packet in Step 2.

[0115] Step 10: The service chain orchestration device receives the SYN packet sent by the target network element device NF1 from the ge4 interface. Since the ge4 interface is connected to the external network interface of the target network element device NF1, this SYN packet is a forward packet. The service chain orchestration device decodes the source MAC address of this SYN packet to obtain the port number, and compares the decoded port number with the source port number of the 5-tuple of this SYN packet. If the two are different, the source port number of the 5-tuple of this SYN packet is modified according to the decoded port number. Then, a session lookup is performed according to the modified 5-tuple. If no session is found, the SYN packet is discarded. If a session is found, the session is associated and the session information is updated. Then, the target service chain redirection policy information is obtained. If it is determined that there are no other network elements, the original MAC address of this SYN packet (including the source MAC address and the destination MAC address) is restored, and then this SYN packet is sent to the server device through the ge2 interface.

[0116] Step 11: The server receives the SYN data packet from the service chain orchestration device and, according to the server's business logic, returns a SYN_ACK data packet to the service chain orchestration device.

[0117] Step 12: After receiving the SYN_ACK packet through the ge2 interface, the service chain orchestration device associates the session and updates the session information. Then, it performs target service chain traffic redirection strategy matching to determine that this SYN_ACK packet needs to be sent to the target network element device NF1. Since this SYN_ACK packet is a reverse packet, the destination port of the SYN_ACK packet is encoded as the destination port number into its destination MAC address (the destination MAC address here is the selected target MAC address), and then sent to the target network element device NF1 through the ge4 interface.

[0118] Step 13: The target network element device NF1 receives the SYN_ACK data packet from its external network interface. According to the business logic of the target network element device NF1, the target network element device NF1 sends the ACK data packet to the service chain orchestration device through its external network interface.

[0119] Step 14: The service chain orchestration device receives the ACK packet sent by the target network element device NF1 from the ge4 interface. Since the ge4 interface is connected to the external network interface of the target network element device NF1, this ACK packet is a forward packet. The service chain orchestration device decodes the source MAC address of this ACK packet and extracts the source port number. It compares the decoded source port number with the source port number of this ACK packet. If they are inconsistent, the source port number of the ACK packet is modified according to the decoded source port number. Then, a session lookup is performed based on the modified 5-tuple. If no session is found, the ACK packet is discarded. If a session is found, the session is associated and the session information is updated. The target service chain redirection policy is then obtained. After confirming that there are no other network elements, the original MAC address (source MAC address and destination MAC address) of this ACK packet is restored. Finally, this ACK packet is sent to the server device through the ge2 interface.

[0120] Step 15: After the target network element device NF1 sends the ACK data packet through its external network port, it indicates that the three-way handshake with the service chain orchestration device has been completed and the communication connection has been successfully established. Therefore, according to its business logic, it continues to send the processed Packet A data packet to the service chain orchestration device.

[0121] Step 16: The service chain orchestration device receives the Packet A data packet sent by the target network element device NF1 from the ge4 interface. Since the ge4 interface is connected to the external network interface of the target network element device NF1, this ACK data packet is a forward data packet. The service chain orchestration device decodes the source MAC address of this Packet A data packet to obtain the source port number, and compares the decoded source port number with the source port number of this Packet A data packet. If they are inconsistent, the source port number of this Packet A data packet is modified according to the decoded source port number. Then, a session lookup is performed based on the modified 5-tuple. If no session is found, this Packet A data packet is discarded. If a session is found, the session is associated and the session information is updated. Then, its service chain redirection policy is obtained. If no other network element devices are found, the original MAC address of this Packet A data packet (including the source MAC address and the destination MAC address) is restored, and then this Packet A data packet is sent to the server through the ge2 interface.

[0122] Step 17: The server-side device receives the Packet A data packet from the service chain orchestration device and, according to the business logic of the web server, returns the Packet B data packet to the service chain orchestration device.

[0123] Step 18: After receiving the Packet B data packet sent by the server device from the ge2 interface, the service chain orchestration device associates the session and updates the session information. Then, it performs target service chain traffic redirection strategy matching and finds that this Packet B data packet needs to be sent to the target network element device NF1. Since this Packet B data packet is a reverse data packet, the destination port number of the Packet B data packet is encoded as the destination port number into its destination MAC address (the destination MAC address here is the selected target MAC address) and sent to the target network element device NF1 through the ge4 interface.

[0124] Step 19: The service chain orchestration device receives the Packet B data packet sent by the target network element device NF1 from the ge3 interface. Since the ge3 interface is connected to the internal network interface of the target network element device NF1, this Packet B data packet is a reverse data packet. The service chain orchestration device decodes the destination MAC address of this Packet B data packet to obtain the destination port number, and compares the decoded destination port number with the destination port of the Packet B data packet. If the comparison is inconsistent, the destination port data in the Packet B data packet is modified according to the decoded destination port number. Then, a session lookup is performed based on the modified 5-tuple. If no session is found, the Packet B data packet is discarded. If a session is found, the session is associated and the session information is updated. Then, its service chain redirection policy is obtained to ensure that there are no other network elements subsequently. Then, the original MAC address of this Packet B data packet (including source MAC and destination MAC) is restored, and then it is sent to the client through the ge1 interface.

[0125] Step 20: The client receives the Packet B data packet sent by the service chain orchestration device and continues processing according to its business logic.

[0126] In some embodiments of this application, the service chain session association method provided in this embodiment may be applied to service data packets of any protocol, and this embodiment does not limit this. For example, the protocol may include, but is not limited to, TCP, UDP and SCTP protocols.

[0127] Furthermore, one embodiment of this application also provides a service chain session association device, which is applied to a service chain orchestration device connected to at least one network element device, such as... Figure 3 As shown, the service chain session association device may include at least:

[0128] Encoding module 21 is used to encode the target data in the target 5-tuple of the first service data packet into the target MAC address of the service data packet if a first service data packet to be sent to the target network element device is received. The target data is the data in the 5-tuple that will be modified by the target network element device.

[0129] The sending module 22 is used to send the encoded first service data packet to the target network element device;

[0130] Decoding module 23 is used to decode target data from the target MAC address of the second service data packet if the target network element device detects a second service data packet fed back by the first service data packet.

[0131] The association module 24 is used to associate the second service data packet with the service chain session corresponding to the first service data packet based on the five-tuple of the decoded target data and the second service data packet.

[0132] The service chain session association device provided in this application, upon receiving a first service data packet to be sent to a target network element device connected to the service chain orchestration device, encodes the target data in the target 5-tuple of the first service data packet into the target MAC address of the service data packet. The target data is the data in the 5-tuple that will be modified by the target network element device. Then, the encoded first service data packet is sent to the target network element device. If a second service data packet is detected from the target network element device in response to the first service data packet, the target data is decoded from the target MAC address of the second service data packet, and based on the decoded target data and the 5-tuple of the second service data packet, the second service data packet is associated with the service chain session corresponding to the first service data packet. As can be seen, the solution provided in this embodiment encodes the target data that may be modified by the network element device in the five-tuple of the service data packet into the MAC address of the service data packet before the service chain orchestration device guides the service data packet to the network element device. In this way, even if the network element device modifies the target data of the service data packet when processing the service data packet based on the service logic after the service data packet is guided to the network element device, the service chain orchestration device can still obtain the original target data by decoding the MAC address after the network element device returns the processed service data packet. Then, based on the decoded target data and the five-tuple of the processed service data packet, the original five-tuple is restored, and the processed service data packet is correctly associated with the service chain session corresponding to the service data packet before processing based on the original five-tuple, thereby realizing the continuity and integrity of service chain orchestration.

[0133] In some embodiments of this application, such as Figure 4 As shown, the encoding module 21 may include: a first encoding unit 211, used to encrypt the target data in the target quintuple of the first service data packet into ciphertext data of the target length; divide the ciphertext data into at least two segments; and allocate a corresponding embedding position for each segment in the target MAC address and embed it.

[0134] In some embodiments of this application, such as Figure 4 As shown, the encoding module 21 may include: a second encoding unit 212, used to allocate prime numbers to target data in the target quintuple of the first service data packet; perform modulo operation on the target data using the prime numbers as modulo; allocate and embed the modulo operation result in the target MAC address.

[0135] In some embodiments of this application, such as Figure 4As shown, the encoding module 21 may include: a third encoding unit 213, used to split the target data in the target quintuple of the first service data packet into three parts; convert the three parts into color intensity values ​​of the corresponding color channels respectively; and allocate and embed a corresponding embedding position for each color intensity value in the target MAC address.

[0136] In some embodiments of this application, such as Figure 4 As shown, the association module 24 is specifically used to select first data to be compared with the decoded target data from the five-tuple of the second service data packet; if the comparison shows that the first data is the same as the decoded target data, then the second service data packet is associated with the service chain session corresponding to the first service data packet based on the five-tuple of the second service data packet; if the comparison shows that the first data is different from the decoded target data, then the five-tuple of the second service data packet is restored to the target five-tuple based on the decoded target data, and the second service data packet is associated with the service chain session corresponding to the first data packet based on the restored target five-tuple.

[0137] In some embodiments of this application, such as Figure 4 As shown, the association module 24 can also be used to search in the existing sessions for whether there is a service chain session corresponding to the five-tuple of the second service data packet; if it exists, then the step of associating the second service data packet with the service chain session corresponding to the first data packet based on the five-tuple of the second service data packet is executed; if it does not exist, then the second service data packet is discarded.

[0138] In some embodiments of this application, such as Figure 4 As shown, the association module 24 can also be used to search in the existing sessions whether there is a service chain session corresponding to the target quintuple; if it exists, then the step of associating the second service data packet with the service chain session corresponding to the first data packet based on the restored target quintuple is executed; if it does not exist, then the second service data packet is discarded.

[0139] In some embodiments of this application, such as Figure 4 As shown, the service chain session association device provided in this embodiment may further include:

[0140] The determination module 25 is used to determine the target object located next to the target network element device based on the service chain traffic redirection strategy corresponding to the target network element device. The service chain traffic redirection strategy is used to indicate the calling order of each network element device in the service chain where the target network element device is located.

[0141] The first sending module 26 is used to perform restoration processing on the second service data packet if the target object is a client or a server, and send the restored second service data packet to the target object. The restoration processing includes: restoring the five-tuple of the second service data to the target five-tuple based on the target data decoded by the decoding module 23, and restoring the target MAC address of the second service data packet to the position before the target data is encoded.

[0142] The second sending module 27 is used to, if the target object is a network element device, restore the five-tuple of the second service data packet to the target five-tuple based on the target data decoded by the decoding module 23, and send the second service data packet with the five-tuple to the target object.

[0143] In some embodiments of this application, the target data includes at least one of the following data in the target quintuple: source IP address, destination IP address, source port number, destination port number, and transport layer protocol.

[0144] In some embodiments of this application, such as Figure 4 As shown, if the target data includes a target port number, the encoding module 21 may further include: a first selection unit 214, used to select the target port number through any of the following processes: if the transmission direction of the first service data packet is from the client to the server, then the source port number in the target 5-tuple of the first service data packet is selected as the target port number; if the transmission direction of the first service data packet is from the server to the client, then the destination port number in the target 5-tuple of the first service data packet is selected as the target port number; or, if it is determined that there is a target port number selection principle customized for the target network element device, then the target port number is selected from the source port number and the destination port number in the target 5-tuple of the first service data packet based on the target port number selection principle, wherein the target port number selection principle is used to customize the selection of at least one of the source port number and the destination port number as the target port number.

[0145] In some embodiments of this application, such as Figure 4As shown, the encoding module 21 may further include: a second selection unit 215, used to select a target MAC address through any of the following processes: if the transmission direction of the first service data packet is from the client to the server, then the source MAC address of the first service data packet is selected as the target MAC address; if the transmission direction of the first service data packet is from the server to the client, then the destination MAC address of the first service data packet is selected as the target MAC address; or, if it is determined that a target MAC address selection principle is customized for the target network element device, then the target MAC address is selected from the source MAC address and the destination MAC address of the first service data packet based on the target MAC address selection principle, wherein the target MAC address selection principle is used to customize the selection of at least one of the source MAC address and the destination MAC address as the target MAC address.

[0146] In some embodiments of this application, such as Figure 4 As shown, the service chain session association device provided in this embodiment may further include: a detection module 28, configured to detect whether the MAC address of the second service data packet adopts the target MAC address format if the target network element device detects a second service data packet fed back by the first service data packet; if it adopts the target MAC address format, the decoding module 23 is triggered to perform the step of decoding the target data from the target MAC address of the second service data packet; if it does not adopt the target MAC address format, the second service data packet is subjected to at least one of the following abnormal handling: discarding the second service data packet, and informing the target network element device to resend the second service data packet with the MAC address adopting the target MAC address format.

[0147] In some embodiments of this application, such as Figure 4 As shown, the sending module 22 can also be used to encrypt the encoded target MAC address or encrypt the encoded target MAC address and the second data before sending the encoded first service data packet to the target network element device. The second data includes at least one piece of data in the five-tuple of the second service data packet that was not selected as target data.

[0148] In some embodiments of this application, such as Figure 4As shown, the service chain session association device provided in this embodiment may further include: an establishment module 29, used to determine the data packet transmission direction between the client and the server in the target business scenario if it is determined that a target service chain traffic diversion strategy is used in the target business scenario, wherein the target service chain traffic diversion strategy is used to indicate the calling order of each network element device in the service chain where the target network element device is located; if the data packet transmission direction includes a first transmission direction from the client to the server, then a communication connection is established for each network element device in the service chain corresponding to the target service chain traffic diversion strategy based on the first transmission direction, so as to realize the transmission of business data packets from the client to the server in the first transmission direction based on the established communication connection; if the data transmission direction includes a second transmission direction from the server to the client, then a communication connection is established for each network element device in the service chain corresponding to the target service chain traffic diversion strategy based on the second transmission direction, so as to realize the transmission of business data packets from the server to the client in the second transmission direction based on the established communication connection.

[0149] For a detailed explanation of the various functional modules used in the service chain session association device provided in this application embodiment, please refer to the corresponding detailed explanation of the above service chain session association method embodiment, which will not be repeated here.

[0150] Furthermore, one embodiment of this application also provides a computer-readable storage medium, the storage medium including a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to execute the above-described service chain session association method.

[0151] Furthermore, one embodiment of this application also provides an electronic device, the electronic device comprising: a memory for storing a program; and a processor coupled to the memory for running the program to execute the above-described service chain session association method.

[0152] Furthermore, one embodiment of this application also provides a computer program product, the computer program product comprising: a computer program / computer executable instructions, the computer program / computer executable of the above-described service chain session association method.

[0153] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0154] It is understood that the relevant features in the above methods and apparatus can be referenced interchangeably. Furthermore, the terms "first," "second," etc., in the above embodiments are used to distinguish between embodiments and do not represent the superiority or inferiority of any particular embodiment.

[0155] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0156] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, this application is not directed to any particular programming language. It should be understood that the content of this application described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing preferred embodiments of this application.

[0157] In addition, the memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0158] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0159] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data cutover device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data cutover device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0160] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data cutover device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxesFigure 1 The function specified in one or more boxes.

[0161] These computer program instructions can also be loaded onto a computer or other programmable data cutover device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0162] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0163] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0164] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0165] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0166] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0167] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A service chain session association method, characterized in that, The method, applied to a service chain orchestration device connected to at least one network element device, includes: If a first service data packet to be sent to the target network element device is received, the target data in the target 5-tuple of the first service data packet is encoded into the target MAC address of the service data packet. The target data is the data in the 5-tuple that will be modified by the target network element device. The encoded first service data packet is sent to the target network element device; If the target network element device detects a second service data packet in response to the first service data packet, then the target data is decoded from the target MAC address of the second service data packet. Based on the decoded target data and the quintuple of the second service data packet, the second service data packet is associated with the service chain session corresponding to the first service data packet.

2. The method according to claim 1, characterized in that, Encoding the target data in the target 5-tuple of the first service data packet into the target MAC address of the service data packet includes: The target data in the target quintuple of the first service data packet is encrypted into ciphertext data of the target length; the ciphertext data is divided into at least two segments; and a corresponding embedding position is assigned to each segment in the target MAC address and embedded therein. Alternatively, assign a prime number to the target data in the target quintuple of the first service data packet; perform a modulo operation on the target data using the prime number as the modulus; and allocate and embed the modulo operation result in the target MAC address. Alternatively, the target data in the target quintuple of the first service data packet is split into three parts; the three parts are converted into color intensity values ​​of the corresponding color channels; and a corresponding embedding position is assigned to each color intensity value in the target MAC address and embedded.

3. The method according to claim 1, characterized in that, Based on the decoded target data and the five-tuple of the second service data packet, the second service data packet is associated with the service chain session corresponding to the first service data packet, including: Select the first data from the five-tuple of the second service data packet to be compared with the decoded target data; If the first data is found to be the same as the decoded target data, then the second service data packet is associated with the service chain session corresponding to the first service data packet based on the five-tuple of the second service data packet. If the first data is found to be different from the decoded target data, the five-tuple of the second service data packet is restored to the target five-tuple based on the decoded target data, and the second service data packet is associated with the service chain session corresponding to the first data packet based on the restored target five-tuple.

4. The method according to claim 3, characterized in that, The method further includes: In the existing sessions, check if there exists a service chain session corresponding to the five-tuple of the second service data packet; if it exists, perform the step of associating the second service data packet with the service chain session corresponding to the first data packet based on the five-tuple of the second service data packet; if it does not exist, discard the second service data packet. And / or, Check if a service chain session corresponding to the target quintuple exists in the existing sessions; if it exists, perform the step of associating the second service data packet with the service chain session corresponding to the first data packet based on the restored target quintuple; if it does not exist, discard the second service data packet.

5. The method according to claim 1, characterized in that, The method further includes: Based on the service chain traffic redirection strategy corresponding to the target network element device, the target object located next to the target network element device is determined. The service chain traffic redirection strategy is used to indicate the calling order of each network element device in the service chain where the target network element device is located. If the target object is a client or a server, the second service data packet is restored, and the restored second service data packet is sent to the target object. The restoration process includes: restoring the five-tuple of the second service data to the target five-tuple based on the decoded target data, and restoring the target MAC address of the second service data packet to the position before the target data was encoded. If the target object is a network element device, then the five-tuple of the second service data packet is restored to the target five-tuple based on the decoded target data, and the second service data packet with the five-tuple is sent to the target object.

6. The method according to claim 1, characterized in that, The target data includes at least one of the following data from the target quintuple: source IP address, destination IP address, source port number, destination port number, and transport layer protocol; And / or, If the target data includes a target port number, the method further includes: selecting the target port number through any of the following processes: if the transmission direction of the first service data packet is from the client to the server, then the source port number in the target 5-tuple of the first service data packet is selected as the target port number; if the transmission direction of the first service data packet is from the server to the client, then the destination port number in the target 5-tuple of the first service data packet is selected as the target port number; or, if it is determined that there is a target port number selection principle customized for the target network element device, then the target port number is selected from the source port number and the destination port number in the target 5-tuple of the first service data packet based on the target port number selection principle, wherein the target port number selection principle is used to customize the selection of at least one of the source port number and the destination port number as the target port number; And / or, The method further includes selecting a target MAC address through any of the following processes: if the transmission direction of the first service data packet is from the client to the server, then the source MAC address of the first service data packet is selected as the target MAC address; if the transmission direction of the first service data packet is from the server to the client, then the destination MAC address of the first service data packet is selected as the target MAC address; or, if it is determined that a target MAC address selection principle is customized for the target network element device, then the target MAC address is selected from the source MAC address and the destination MAC address of the first service data packet based on the target MAC address selection principle, wherein the target MAC address selection principle is used to customize the selection of at least one of the source MAC address and the destination MAC address as the target MAC address.

7. The method according to any one of claims 1-6, characterized in that, The method further includes: if a second service data packet is detected from the target network element device in response to the first service data packet, then detecting whether the MAC address of the second service data packet uses the target MAC address format; if it does, then executing the step of decoding the target data from the target MAC address of the second service data packet; if it does not, then performing at least one of the following abnormal handling actions on the second service data packet: discarding the second service data packet, or informing the target network element device to resend a second service data packet with the MAC address using the target MAC address format; And / or, Before sending the encoded first service data packet to the target network element device, the method further includes: encrypting the encoded target MAC address, or encrypting the encoded target MAC address and second data, wherein the second data includes at least one data in the five-tuple of the second service data packet that was not selected as target data; And / or, The method further includes: if it is determined that a target service chain traffic redirection strategy is used in the target business scenario, then determining the data packet transmission direction between the client and the server in the target business scenario, wherein the target service chain traffic redirection strategy is used to indicate the calling order of each network element device in the service chain where the target network element device is located; if the data packet transmission direction includes a first transmission direction from the client to the server, then establishing a communication connection for each network element device in the service chain corresponding to the target service chain traffic redirection strategy based on the first transmission direction, so as to realize the transmission of business data packets from the client to the server in the first transmission direction based on the established communication connection; if the data transmission direction includes a second transmission direction from the server to the client, then establishing a communication connection for each network element device in the service chain corresponding to the target service chain traffic redirection strategy based on the second transmission direction, so as to realize the transmission of business data packets from the server to the client in the second transmission direction based on the established communication connection.

8. A service chain session association device, characterized in that, An apparatus for use in a service chain orchestration device, wherein the service chain orchestration device is connected to at least one network element device, the apparatus comprising: The encoding module is used to encode the target data in the target 5-tuple of the first service data packet into the target MAC address of the service data packet if a first service data packet to be sent to the target network element device is received. The target data is the data in the 5-tuple that will be modified by the target network element device. The sending module is used to send the encoded first service data packet to the target network element device; The decoding module is used to decode the target data from the target MAC address of the second service data packet if the target network element device detects a second service data packet fed back by the first service data packet. The association module is used to associate the second service data packet with the service chain session corresponding to the first service data packet based on the decoded target data and the five-tuple of the second service data packet.

9. A computer-readable storage medium, characterized in that, The storage medium includes a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to execute the service chain session association method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, The electronic device includes: a memory for storing a program; and a processor coupled to the memory for running the program to perform the service chain session association method according to any one of claims 1 to 7.

11. A computer program product, characterized in that, The computer program product includes: a computer program / computer executable instructions, wherein the computer program / computer executable is the service chain session association method according to any one of claims 1 to 7.

Images