Security group configuration method and device, electronic equipment, storage medium and computer program product

Abstract

The invention provides a security group configuration method and device, electronic equipment, a storage medium and a computer program product, and relates to the technical field of cloud computing big data, and the method comprises the following steps: detecting security group update information corresponding to a current service session; wherein the security group update information is the same as the communication metadata of the current service session; determining a current security group flow table corresponding to the current service session in a preset information set based on the security group update information; wherein the preset information set comprises a corresponding relationship between the communication metadata of each service session and the corresponding security group flow table; and deleting the current security group flow table, and configuring the security group update information based on the current service session.

Description

Technical Field

[0001] This application relates to the field of cloud computing and big data technology, and in particular to a security group configuration method, apparatus, electronic device, storage medium and computer program product. Background Technology

[0002] In related technologies, security groups play a crucial role in the new generation of integrated hardware and software virtual architectures. They serve as both the first line of defense for cloud services and a key tool for implementing flexible, efficient, and comprehensive security strategies. By properly configuring and managing security groups, users can effectively prevent network attacks and ensure the stable and secure operation of cloud-based business systems. Security groups enable fine-grained control over network traffic entering and leaving cloud server instances. Through preset rule sets, security groups can allow or deny network access requests from specific Internet Protocol (IP) address ranges, ports, or protocols. Security group rules can be adjusted and updated at any time to adapt to constantly changing security needs and threat landscapes, ensuring the real-time nature and effectiveness of protection strategies.

[0003] When business traffic is being forwarded by hitting flow tables in the dedicated hardware, even though the new OpenFlow has been distributed to the virtual switch after the security group configuration is modified, the modified security group configuration will not take effect immediately because customer traffic will continue to hit the forwarding logic that has been offloaded to the dedicated hardware. Summary of the Invention

[0004] This application provides a security group configuration method, apparatus, electronic device, storage medium, and computer program product.

[0005] The technical solution of this application is implemented as follows: This application provides a security group configuration method, including: Security group update information corresponding to the current service session is detected; wherein, the security group update information is the same as the communication metadata of the current service session; Based on the security group update information, the current security group flow table corresponding to the current service session is determined in a preset information set; wherein, the preset information set includes: the correspondence between the communication metadata of each service session and the corresponding security group flow table; Delete the current security group flow table and configure the security group update information based on the current service session.

[0006] In the above scheme, the communication metadata includes: a first quintuple; the method further includes: Obtain the identification information of the security group flow table of different nodes corresponding to each service session; wherein, the security group flow table of different nodes includes: new state flow table, new+track state flow table, and establish state flow table. Based on the correspondence between the first five-tuple corresponding to each service session and the identification information of the corresponding security group flow table, the preset information set is constructed.

[0007] In the above scheme, determining the current security group flow table corresponding to the current service session based on the security group update information in a preset information set includes: Based on the second quintuple corresponding to the security group update information, the current identification information is determined in the preset information set; wherein, the second quintuple is the same as the first quintuple; The current security group flow table for different nodes corresponding to the current service session is determined based on the current identification information.

[0008] In the above scheme, configuring the security group update information based on the current service session includes: Based on the current service session, the first packet sent for the security group update information is unloaded, and the new state update flow table and the established state update flow table corresponding to the security group update information are unloaded to the preset hardware.

[0009] The method in the above scheme further includes: If a first security group flow table is detected to be hit, then other security group flow tables corresponding to the first service session are determined in the preset information set based on the first communication metadata of the first service session corresponding to the first security group flow table. Update the hit status of the other security group flow tables.

[0010] In the above scheme, the detection of security group update information corresponding to the current service session Receive the configuration information corresponding to the current service session, match the configuration information with the current security group flow table corresponding to the current service session, and determine the matching result; Based on the matching result, the configuration information is determined to be the security group update information.

[0011] This application also provides a security group configuration device, including: The detection unit is used to detect security group update information corresponding to the current service session; wherein the security group update information is the same as the communication metadata of the current service session; The determining unit is configured to determine the current security group flow table corresponding to the current service session based on the security group update information in a preset information set; wherein, the preset information set includes: the correspondence between the communication metadata of each service session and the corresponding security group flow table; The configuration unit is used to delete the current security group flow table and configure the security group update information based on the current service session.

[0012] This application also provides an electronic device, including a memory and a processor. The memory stores a computer program that can run on the processor, and the processor executes the computer program to implement the steps in the above-described method.

[0013] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps in the above-described method.

[0014] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps in the above-described method.

[0015] In this embodiment, security group update information corresponding to the current service session is detected; wherein, the security group update information is identical to the communication metadata of the current service session; based on the security group update information, the current security group flow table corresponding to the current service session is determined from a preset information set; wherein, the preset information set includes: the correspondence between the communication metadata of each service session and the corresponding security group flow table; the current security group flow table is deleted, and configuration is performed based on the security group update information for the current service session. Thus, by detecting the security group update information corresponding to the current service session and searching for the current security group flow table corresponding to the current service session in the preset information set based on this update information, the flow table that needs to be modified can be quickly located, thereby enabling the deletion of the old flow table and the timely application of the new configuration. Compared to the problem in the prior art where flow tables cannot take effect immediately after being unloaded to hardware, this solution ensures that configuration modifications are reflected in the flow table immediately by matching the security group update information with the communication metadata, improving the real-time performance and security of security group configuration. Attached Figure Description

[0016] Figure 1 Illustration of the effects of the related technologies provided in the embodiments of this application Figure 1 ; Figure 2 Illustration of the effects of the related technologies provided in the embodiments of this application Figure 2 ; Figure 3 A flowchart illustrating the security group configuration method provided in this application embodiment. Figure 1 ; Figure 4 A flowchart illustrating the security group configuration method provided in this application embodiment. Figure 2 ; Figure 5 This application provides an example of the effect of the security group configuration method. Figure 1 ; Figure 6 This application provides an example of the effect of the security group configuration method. Figure 2 ; Figure 7 A flowchart illustrating the security group configuration method provided in this application embodiment. Figure 3 ; Figure 8 This application provides an example of the effect of the security group configuration method. Figure 3 ; Figure 9 This is a schematic diagram of the security group configuration device provided in the embodiments of this application; Figure 10 This is a schematic diagram of a hardware entity of an electronic device provided in an embodiment of this application.

[0017] It should be noted that the terms "first" and "second" mentioned above are only used to distinguish between different options and do not represent the degree of superiority or inferiority of the options or their priority in the implementation process. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application are further described in detail below with reference to the accompanying drawings and embodiments. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0020] If the application documents contain similar descriptions such as "first / second", the following explanation shall be added: In the following description, the terms "first / second / third" are used only to distinguish similar objects and do not represent a specific order of objects. It is understood that "first / second / third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0022] To facilitate understanding of the technical solution of this invention, several technical terms involved in this invention will first be explained: 1) Security Group: A network security control mechanism used to define a set of rules for external communication of cloud server instances. By setting access conditions such as allowing or denying specific source IP addresses, destination ports, and protocols, fine-grained control over network traffic entering and leaving the cloud server can be achieved.

[0023] 2) OpenFlow Flow Table: A data structure defined by the OpenFlow protocol, used to configure packet forwarding logic in network devices. Each flow table entry contains matching fields, actions, and other information to determine how to handle arriving packets. In this invention, security group configurations are converted into corresponding OpenFlow flow tables and distributed to the virtual switch, thereby affecting the forwarding behavior of service traffic.

[0024] 3) Five-Tuple: In computer networks, a five-tuple is a set of five key parameters commonly used to identify a network connection or session, including the source IP address, destination IP address, source port number, destination port number, and transport layer protocol type. In this invention, the five-tuple serves as a unique identifier for a service session and is used to associate flow tables with different states.

[0025] 4) New state flow table: This represents the flow table generated when a connection is first established. It is the head node of the entire connection process and is usually used to handle the initial matching and processing after the first packet is sent.

[0026] 5) Established state flow table: This is a flow table generated when the connection has been established and entered a stable state. It is the tail node in the connection process and is usually used for fast forwarding of subsequent data packets.

[0027] 6) New+Track State Flow Table: This represents a state flow table in the intermediate stage of a connection. It is used to track changes in the connection state, but does not participate in the final hardware offloading process. Therefore, it is easily aged out and deleted due to failure to update the hit state.

[0028] 7) Hardware Offloading: This refers to transferring network traffic forwarding tasks originally handled by software to dedicated hardware (such as a Data Processing Unit (DPU)) for execution, in order to improve processing efficiency and reduce the load on the Central Processing Unit (CPU). In this invention, flow tables in the New and Established states are merged and offloaded to hardware for high-speed forwarding.

[0029] 8) Hit State: Indicates whether a flow table has been successfully matched by the current business traffic. It is an important basis for flow table lifecycle management. Only flow tables that are continuously matched will remain active; otherwise, they may be aged out and deleted.

[0030] 9) Predefined Information Set: Stores the mapping relationship between the communication metadata corresponding to each business session and its related flow table, which is used to quickly locate and clear the relevant old flow table when a security group update is detected.

[0031] In related technologies, combined Figure 1 The security group rules configured by cloud server customers are converted into OpenFlow flow tables and sent to the virtual switch. The virtual switch then looks up the OpenFlow flow table based on the first packet sent, offloading the network data forwarding logic to dedicated hardware. Subsequent network packet processing will then be performed at high speed on the dedicated hardware. Therefore, the security group configurations of cloud server customers are ultimately offloaded to the hardware in the form of flow tables, enabling the allowance or denial of specific network traffic and achieving fine-grained access control for cloud servers. Figure 2 The first packet of a cloud host customer's service traffic is sent to the virtual machine switch for processing. Due to the different states processed by the virtual switch's state tracking module, multiple flow tables are generated (new state flow table - head node, new+track state flow table - intermediate node, established state flow table - tail node). Ultimately, the head and tail node flow tables are merged and offloaded to hardware, while the new+track state flow table of the intermediate node is aged out and deleted by the virtual machine switch. Subsequent packets can then directly use the head and tail nodes offloaded to hardware for forwarding.

[0032] In one scenario, cloud server customer service traffic is being forwarded by hitting flow tables in dedicated hardware. When a customer modifies the security group configuration, the security group configuration is subsequently converted into an OpenFlow flow table and sent to the virtual switch. However, because the old flow table that has been offloaded to the dedicated hardware by the virtual switch is being hit by the customer's flow table, the new flow table cannot be offloaded again. As a result, the modification of the security group configuration cannot take effect immediately. It will only take effect after the current customer service traffic stops and the old flow table ages out and is deleted from the dedicated hardware.

[0033] This application provides a method for quickly taking effect changes to security groups on cloud servers. By designing a flow table statistics and association device, multiple flow tables generated from a single customer service traffic session are associated. When a customer modifies the security group configuration, the flow tables whose configuration has taken effect are used to find all other related flow tables and thoroughly clear them. Then, the customer's service traffic is re-uploaded to the virtual switch to offload the flow tables to dedicated hardware. This device can achieve the cleanup of old flow tables and the offloading of new flows at the microsecond level, enabling security group configuration changes to take effect immediately, improving the security of DPU cloud server customer systems and enhancing the user's network experience.

[0034] Please see Figure 3 This is a flowchart illustrating the security group configuration method provided in this application embodiment. Figure 1 , will combine Figure 3 The steps shown are explained below: S101. Security group update information corresponding to the current service session is detected; wherein, the security group update information is the same as the communication metadata of the current service session.

[0035] In this embodiment, when a user modifies the security group configuration through the control plane, the system sends the security group update information to the virtual switch in the form of an OpenFlow flow table. Subsequently, the virtual switch can match the information in the OpenFlow flow table with the information in the old flow table of the current service session, and after determining that the configuration item has changed, determine the security group update information.

[0036] Communication metadata refers to the set of key parameters that identify a network connection, typically including a five-tuple (source IP address, destination IP address, source port number, destination port number, and protocol type). Communication metadata is used to uniquely identify a network session, thereby ensuring accurate matching and processing of specific service traffic.

[0037] The security group update information refers to the OpenFlow flow table content generated by the user's modified security group configuration. Since the security group update information is consistent with the communication metadata of the current service session, all flow table entries related to the current service session can be accurately located.

[0038] S102. Based on the security group update information, determine the current security group flow table corresponding to the current service session in a preset information set; wherein, the preset information set includes: the correspondence between the communication metadata of each service session and the corresponding security group flow table.

[0039] In this embodiment, the preset information set is a storage structure used to record the correspondence between the communication metadata of each service session and the corresponding security group flow table. The preset information set can be implemented using a hash table, where the communication metadata serves as the key and the corresponding flow table identifier serves as the value. When the virtual switch detects security group update information, the system will search the preset information set for the current security group flow table related to the current service session based on the communication metadata of the security group update information.

[0040] S103. Delete the current security group flow table and configure the security group update information based on the current service session.

[0041] In this embodiment, the operation of deleting the current security group flow table by the virtual switch includes clearing the current security group flow table from the virtual switch and simultaneously notifying the hardware offloading device to stop using the current security group flow table. Subsequently, the virtual switch reconfigures the flow table based on the latest security group update information and sends the new flow table to the hardware for offloading.

[0042] In this embodiment, configuration refers to the virtual switch regenerating OpenFlow flow tables conforming to the new policy based on the new security group update information, and then sending these flow tables to the hardware for offloading. This process ensures that the new security group configuration takes effect promptly, guaranteeing the effective execution of network security policies.

[0043] In this embodiment, the flow table that the virtual switch re-unloads and configures to the hardware is an OpenFlow flow table generated based on security group update information. This indicates that the new OpenFlow flow table has been configured according to the user's modified security group policy and has been successfully loaded into the hardware, thereby achieving high-performance data forwarding and policy execution.

[0044] The security group configuration method provided in this application, upon detecting security group update information corresponding to the current service session, searches for the flow table corresponding to the current security group in a preset information set based on the communication metadata of the current service session, deletes the current security group flow table, and then reconfigures. In this way, by detecting security group update information corresponding to the current service session and searching for the corresponding current security group flow table in the preset information set based on the update information, the flow table that needs to be modified can be quickly located, thereby enabling the deletion of the old flow table and the timely application of the new configuration. Compared to the problem in existing technologies where flow tables cannot take effect immediately after being unloaded to hardware, this solution ensures that configuration modifications are reflected in the flow table in real time by matching security group update information with communication metadata, thus improving the real-time performance and security of security group configuration.

[0045] Please see Figure 4 This is a flowchart illustrating the security group configuration method provided in this application embodiment. Figure 2 , will combine Figure 4 The steps shown are explained below: S201. Obtain the identification information of the security group flow table of different nodes corresponding to each service session; wherein, the security group flow table of different nodes includes: new state flow table, new+track state flow table, and established state flow table.

[0046] In this embodiment, the security group flow table is a set of OpenFlow flow table entries generated according to security group rules, used to control the forwarding policy of specific network traffic. Since the DPU cloud host supports stateful firewall functionality, the same service session may trigger the creation of multiple flow tables, corresponding to the initial state (new), intermediate tracking state (new+track), and final confirmation state (establish) of the same service session, respectively. The identification information of the security group flow table includes, but is not limited to, the ufid information of the security group flow table.

[0047] In this embodiment of the application, the virtual switch can, after completing the unloading of the merging table to the preset hardware in the new state flow table and the established state flow table in both directions of the session request and session reply corresponding to each service session, obtain the identification information of the security group flow table in both directions of the session request and session reply corresponding to each service session.

[0048] For example, when a user logs into a cloud host via SSH, the virtual switch generates a new state flow table for the corresponding service session, allowing the first packet to enter; subsequently, the virtual switch generates a new+track state flow table to track the state changes of the corresponding service session; finally, the virtual switch generates an establish state flow table to maintain the access permissions of the corresponding service session in the long term. The virtual switch obtains the identification information of the above flow tables.

[0049] S202. Based on the correspondence between the first five-tuple corresponding to each service session and the identification information of the corresponding security group flow table, construct the preset information set.

[0050] In this embodiment, the virtual switch maps the first five-tuple of each service session to the corresponding flow table identifier information of each security group to form a preset information set. The purpose of the preset information set is that when the security group configuration changes, the system can quickly find all flow tables related to the service session by querying the preset information set and perform corresponding cleanup or update operations.

[0051] In this embodiment of the application, the virtual exchange can perform hash calculation on the first five-tuple of each service session to generate a unique key value, and bind the unique key value with the identification information of each node flow table to form a preset information set.

[0052] Combination Figure 5 Each associated entry in the flow table association device corresponds to a business session. The associated entry and the flow session use the same 5-tuple hash value as the key information, facilitating quick lookup of the corresponding associated entry through the business session. When each node flow table is generated, its ufid information is extracted and saved to the corresponding associated entry. After the head and tail nodes of both the business session request and response directions are merged and unloaded, the associated entry completes the association of all relevant flow tables for that flow session. Subsequently, after the DPU cloud host customer modifies the corresponding OpenFlow security group configuration and distributes it to the virtual switch, the security group configuration takes effect, and all other flow tables related to that flow session can be found in any flow table.

[0053] In this embodiment, by extracting the first quintuple of each service session, the system can uniquely identify the service session and use it as the basis for subsequent flow table management. Then, based on the first quintuple of the service session, the system obtains the identification information of each associated state flow table to construct a preset information set, thereby achieving overall control over the service session and its flow tables. This structured approach not only improves the accuracy of flow table management but also significantly optimizes the response efficiency after security group configuration changes.

[0054] In this embodiment of the application, S102 can also be implemented by S1021 to S1022, which will be described in conjunction with the steps: S1021. Based on the second quintuple corresponding to the security group update information, determine the current identification information in the preset information set; wherein, the second quintuple is the same as the first quintuple.

[0055] In this embodiment, the second 5-tuple refers to a set of parameters used to uniquely identify a network communication connection for security group update information, including source IP address, destination IP address, source port, destination port, and transport layer protocol. The second 5-tuple is identical to the first 5-tuple, indicating that the first and second 5-tuples describe different information about the same network communication connection. Since the preset information set includes the correspondence between the first 5-tuple corresponding to each service session and the identification information of the corresponding security group flow table, the virtual switch can use the unique identifier (current identification information) found in the preset information set based on the hash value corresponding to the second 5-tuple to further locate the security group flow table associated with the current service session.

[0056] S1022. Determine the current security group flow table of different nodes corresponding to the current service session based on the current identification information.

[0057] In this embodiment of the application, after determining the current identification information of the security group flow table of different nodes associated with the current service session, the virtual switch can determine the corresponding current security group flow table locally on the virtual switch and in the corresponding offload hardware based on the current identification information.

[0058] In this embodiment, a direct lookup relationship exists between the second quintuple and the preset information set. Specifically, the second quintuple is used as the input key to perform a hash lookup in the preset information set to obtain the current identification information. This current identification information is then used to look up the current security group flow tables of different nodes corresponding to the current service session. Therefore, after a security group configuration change, the virtual switch can quickly locate and update the security group flow tables corresponding to all service sessions involved in the current service session using the second quintuple, and then delete them to ensure the immediate effect of the updated security group information.

[0059] In this embodiment of the application, S103 can also be implemented by S1031, which will be described in conjunction with the steps: S1031. Based on the current service session, the first packet sent for the security group update information is unloaded, and the new state update flow table and the established state update flow table corresponding to the security group update information are unloaded to the preset hardware.

[0060] In this embodiment, the virtual switch sends the first network data packet (i.e., the first packet) to the virtual switch for processing. The first packet is used to generate new flow table rules (including new state update flow tables, new+track state update flow tables, and established state update flow tables), and triggers the subsequent flow table offloading process: the new state update flow tables and established state update flow tables corresponding to the security group update information are offloaded to preset hardware. In this way, it can be ensured that the new security group rules can take effect quickly, avoiding the security policy delay problem caused by the old flow tables still being in the hardware.

[0061] Combination Figure 6 After detecting changes to OpenFlow, the virtual switch retrieves the corresponding associated table entries (header node flow table, intermediate node flow table, and tail node flow table) through hash lookup in a preset information set. Then, it clears all old flow tables associated with the service session. Based on the current service session, the flow table corresponding to the security group update information is re-uploaded to the first packet for offloading. The hardware flow table configuration after re-offloading is the OpenFlow modified by the security group. This application associates all flow tables generated by the customer traffic session through a preset information set. Then, the flow table hit status synchronization device updates the hit status of relevant flow tables in real time to ensure that flow tables are not deleted. Next, the security group configuration immediate-effective device can detect OpenFlow changes caused by modifying the security group configuration in real time. Upon detecting OpenFlow changes, it immediately and thoroughly clears all related flow tables, and the customer traffic session is re-uploaded for offloading, achieving the purpose of allowing or denying specific network traffic configured by the customer.

[0062] In this embodiment, by promptly unloading the new state update flow table and the established state update flow table corresponding to the security group update information to the preset hardware, the security group configuration can be made effective quickly. This effectively prevents potential security risks caused by configurations not taking effect in a timely manner. Operations based on the above method can significantly improve the network security and user experience of the DPU cloud host.

[0063] Please see Figure 7 This is a flowchart illustrating the security group configuration method provided in this application embodiment. Figure 3 , will combine Figure 7 The steps shown are explained below: S301. If the first security group flow table is detected to be hit, then based on the first communication metadata of the first service session corresponding to the first security group flow table, other security group flow tables corresponding to the first service session are determined in the preset information set.

[0064] In this embodiment, when a data packet in the hardware hits the first security group flow table of a certain service session, it indicates that a service session is forwarding data according to the rules contained in the first security group flow table. At this time, the virtual switch extracts the communication metadata (such as 5-tuple information) of the service session corresponding to the first security group flow table, and uses this communication metadata as a key to search for other security group flow tables associated with the service session in a preset information set. By searching for associated security group flow tables in the preset information set based on this communication metadata, other flow tables belonging to the same service session as the first security group flow table can be quickly located, thereby achieving comprehensive control over the flow table set of the entire service session.

[0065] In this embodiment, a service session may involve multiple flow tables with different states, such as a new connection flow table and an established connection flow table. These flow tables together constitute the processing logic of the complete session. Other security group flow tables refer to all other flow tables related to the first service session, excluding the flow table corresponding to the first security group flow table. For example, if a service session contains a new state flow table, a new+track state flow table, and an established state flow table, and the first security group flow table hits the new state flow table, then all flow tables except for the new state flow table belong to other security group flow tables.

[0066] S302. Update the hit status of the other security group flow tables.

[0067] In this embodiment, after finding other flow tables associated with the currently hit first security group flow table, the virtual switch synchronously updates the hit status of these flow tables. The hit status reflects whether a flow table is still processing active service traffic, which is crucial for flow table aging management. If some intermediate node flow tables are aged out and deleted due to a lack of hit status updates, the virtual switch will be unable to detect changes in OpenFlow, thus affecting the timely effectiveness of security group configurations. Therefore, by synchronizing the hit status in real time, it is possible to ensure that all flow tables participating in service sessions are in the latest state, preventing the delayed effectiveness of security group configurations due to the aging of some flow tables.

[0068] In this embodiment, due to the limited storage resources of the DPU hardware, it is impossible to offload all flow tables to the hardware, nor is it permissible for a large number of flow tables that have not been hit for a long time to remain in the hardware. Therefore, the virtual switch not only handles the flow table offloading task but also implements a device to manage the lifecycle of flow tables in the hardware. This device is called the flow table aging mechanism in the virtual switch. The flow table aging device continuously compares the hit status of flow tables. If the hit status has not been updated for a long time, the flow table will be aged out and deleted. Existing solutions can only update the hit status of flow tables at the head node and tail node. Intermediate nodes will be aged out and deleted because their hit status cannot be updated. When the security group configuration applied to intermediate nodes is modified, the virtual switch cannot detect it and cannot make the modified security group configuration take effect immediately. Figure 8 The flow table hit status synchronization device is designed to prevent intermediate node flow tables from being aged and deleted due to the inability to update their hit status. After the virtual switch obtains the hit status of the flow table in the request direction and the flow table in the response direction from the hardware, it finds all flow tables related to the traffic session based on the association between flow tables and service sessions stored in the preset information set, and synchronizes the hit status to each flow table in real time to prevent the flow table from being aged and deleted.

[0069] In this embodiment, when a first security group flow table is detected to be hit, other security group flow tables corresponding to the first service session are determined from a preset information set based on the first communication metadata of the first service session corresponding to the first security group flow table, and the hit status of the other security group flow tables is updated. This ensures that all flow tables participating in the service session remain synchronized, thereby avoiding the problem of delayed security group configuration activation due to aging or inconsistent status of some flow tables. This enables immediate activation of security group configurations, improving system security and response efficiency.

[0070] In this embodiment of the application, S101 can also be implemented by S1011 to S1012, which will be described in conjunction with the steps: S1011. Receive the configuration information corresponding to the current service session, match the configuration information with the current security group flow table corresponding to the current service session, and determine the matching result.

[0071] In this embodiment, the configuration information corresponding to the current service session refers to the security policy changes submitted by the user for the current service session, such as modifying access rules for allowing or denying specific IP addresses, ports, protocols, etc. The current security group flow table corresponding to the current service session is an OpenFlow flow table entry generated based on the security group configuration rules, used to guide the virtual switch on how to process data packets. The virtual switch compares the received configuration information with the existing security group flow table to determine the matching result. If the rules in the configuration information corresponding to the current service session are consistent with the current security group flow table corresponding to the current service session, it is considered unchanged; if there are differences, it is considered a failed match, indicating that a new rule needs to take effect.

[0072] In this embodiment of the application, by comparing the configuration information corresponding to the current business session with the current security group flow table corresponding to the current business session, the system can quickly determine whether there is a new security group configuration that needs to be applied, thereby providing a basis for subsequent flow table cleanup and re-uninstallation operations.

[0073] S1012. Based on the matching result, determine that the configuration information is the security group update information.

[0074] In this embodiment, the virtual switch compares the received configuration information with the current security group flow table to obtain a matching result. Only when the matching result indicates a difference between the configuration information corresponding to the current service session and the security group flow table corresponding to the service session is it confirmed as a valid security group update, and thus the configuration information is determined to be security group update information.

[0075] In this embodiment, a security group update deemed valid includes not only newly added rules but also deleted or modified rules. When a virtual switch confirms that a certain configuration information is a security group update, it will use a preset information set to search for all associated flow tables of the current service session and perform unified clearing.

[0076] In this embodiment, the configuration information corresponding to the current service session is matched with the security group flow table corresponding to the service session, and the matching result is used to determine whether there are any configuration changes that need to be implemented. This embodiment can quickly identify whether the configuration information is security group update information, thereby improving the response speed of the virtual switch and enabling the DPU cloud host security group configuration to take effect immediately, significantly enhancing network security and user experience.

[0077] Please see Figure 9 This is a schematic diagram of the security group configuration device provided in the embodiments of this application.

[0078] This application provides a security group configuration device 800, including: a detection unit 801, a determination unit 802, and a configuration unit 803.

[0079] The detection unit 801 is used to detect the security group update information corresponding to the current service session; wherein the security group update information is the same as the communication metadata of the current service session; The determining unit 802 is configured to determine the current security group flow table corresponding to the current service session based on the security group update information in a preset information set; wherein, the preset information set includes: the correspondence between the communication metadata of each service session and the corresponding security group flow table; Configuration unit 803 is used to delete the current security group flow table and configure the security group update information based on the current service session.

[0080] In this embodiment of the application, the communication metadata includes: a first quintuple; a determination unit 802 in the security group configuration device 800 is used to obtain the identification information of the security group flow table of different nodes corresponding to each service session; wherein, the security group flow table of different nodes includes: a new state flow table, a new+track state flow table, and an established state flow table; based on the correspondence between the first quintuple corresponding to each service session and the identification information of the corresponding security group flow table, the preset information set is constructed.

[0081] In this embodiment of the application, the determining unit 802 in the security group configuration device 800 is used to determine the current identification information in the preset information set based on the second quintuple corresponding to the security group update information; wherein, the second quintuple is the same as the first quintuple; The current security group flow table for different nodes corresponding to the current service session is determined based on the current identification information.

[0082] In this embodiment of the application, the configuration unit 803 in the security group configuration device 800 is used to unload the first packet of the security group update information sent based on the current service session, and unload the new state update flow table and the established state update flow table corresponding to the security group update information to the preset hardware.

[0083] In this embodiment of the application, the detection unit 801 in the security group configuration device 800 is used to detect that the first security group flow table is hit, and then determine other security group flow tables corresponding to the first service session based on the first communication metadata of the first service session corresponding to the first security group flow table in the preset information set. Update the hit status of the other security group flow tables.

[0084] In this embodiment of the application, the detection unit 801 in the security group configuration device 800 is used to receive the configuration information corresponding to the current service session, match the configuration information with the current security group flow table corresponding to the current service session, and determine the matching result; Based on the matching result, the configuration information is determined to be the security group update information.

[0085] It should be noted that, in the embodiments of this application, if the above-described security group configuration method is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a security group configuration device (which may be a personal computer, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0086] Correspondingly, embodiments of this application provide a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps in the method on one side of the virtual switch.

[0087] It should be noted that the descriptions of the storage medium and device embodiments above are similar to the descriptions of the method embodiments above, and have similar beneficial effects. For technical details not disclosed in the storage medium and device embodiments of this application, please refer to the descriptions of the method embodiments of this application for understanding.

[0088] It should be noted that, Figure 10 A schematic diagram of a hardware entity of an electronic device provided in an embodiment of this application, such as... Figure 10 As shown, this application embodiment provides an electronic device 900, including a memory 902 and a processor 901. The memory 902 stores a computer program that can run on the processor 901. When the processor 901 executes the program, it implements the steps in the above-described method, wherein; Processor 901 typically controls the overall operation of electronic device 900.

[0089] The memory 902 is configured to store instructions and applications executable by the processor 901, and can also cache data to be processed or already processed (e.g., image data, audio data, voice communication data and video communication data) in the processor 901 and various modules in the electronic device 900. It can be implemented by flash memory or random access memory (RAM).

[0090] Correspondingly, this application also provides a computer program product, including a computer program that can be executed by the processor 901 of the electronic device 900 to complete the steps in the method of the security group configuration device 800.

[0091] It should be understood that the phrase "one embodiment" or "an embodiment" throughout the specification means that a specific feature, structure, or characteristic related to the embodiment is included in at least one embodiment of this application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. It should be understood that in the various embodiments of this application, the sequence numbers of the above-described processes do not imply a sequential order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application. The sequence numbers of the above-described embodiments are merely descriptive and do not represent the superiority or inferiority of the embodiments.

[0092] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0093] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the apparatus or units can be electrical, mechanical, or other forms.

[0094] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units. They may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0095] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0096] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, read-only memory (ROM), magnetic disks, or optical disks.

[0097] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to related technologies, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROMs, magnetic disks, or optical disks.

[0098] The above description is merely an embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A security group configuration method, characterized in that, include: Security group update information corresponding to the current service session is detected; wherein, the security group update information is the same as the communication metadata of the current service session; Based on the security group update information, the current security group flow table corresponding to the current service session is determined in a preset information set; wherein, the preset information set includes: the correspondence between the communication metadata of each service session and the corresponding security group flow table; Delete the current security group flow table and configure the security group update information based on the current service session.

2. The security group configuration method according to claim 1, characterized in that, The communication metadata includes: a first quintuple; the method further includes: Obtain the identification information of the security group flow table of different nodes corresponding to each service session; wherein, the security group flow table of different nodes includes: new state flow table, new+track state flow table, and establish state flow table. Based on the correspondence between the first five-tuple corresponding to each service session and the identification information of the corresponding security group flow table, the preset information set is constructed.

3. The security group configuration method according to claim 2, characterized in that, The step of determining the current security group flow table corresponding to the current service session based on the security group update information in a preset information set includes: Based on the second quintuple corresponding to the security group update information, the current identification information is determined in the preset information set; wherein, the second quintuple is the same as the first quintuple; The current security group flow table for different nodes corresponding to the current service session is determined based on the current identification information.

4. The security group configuration method according to claim 1, characterized in that, The configuration of security group update information based on the current service session includes: Based on the current service session, the first packet sent for the security group update information is unloaded, and the new state update flow table and the established state update flow table corresponding to the security group update information are unloaded to the preset hardware.

5. The security group configuration method according to any one of claims 1 to 4, characterized in that, The method further includes: If a first security group flow table is detected to be hit, then other security group flow tables corresponding to the first service session are determined in the preset information set based on the first communication metadata of the first service session corresponding to the first security group flow table. Update the hit status of the other security group flow tables.

6. The security group configuration method according to any one of claims 1 to 4, characterized in that, The detection of security group update information corresponding to the current service session includes: Receive the configuration information corresponding to the current service session, match the configuration information with the current security group flow table corresponding to the current service session, and determine the matching result; Based on the matching result, the configuration information is determined to be the security group update information.

7. A security group configuration device, characterized in that, include: The detection unit is used to detect security group update information corresponding to the current service session; wherein the security group update information is the same as the communication metadata of the current service session; The determining unit is configured to determine the current security group flow table corresponding to the current service session based on the security group update information in a preset information set; wherein, the preset information set includes: the correspondence between the communication metadata of each service session and the corresponding security group flow table; The configuration unit is used to delete the current security group flow table and configure the security group update information based on the current service session.

8. An electronic device, characterized in that, It includes a memory and a processor, the memory storing a computer program that can run on the processor, the processor executing the computer program to implement the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images