Multi-dimensional network function isolation system of virtual private cloud and message processing method

Abstract

The invention discloses a multi-dimensional network function isolation system of a virtual private cloud and a message processing method. According to the system, a VPC network is isolated and decoupled into four independent dimensions of an interface, a route, connection state tracking and an NAT rule, a dynamic mapping relation between a VPC identifier and each isolation domain is established through a context binding table, and flexible combination of isolation strategies is realized. A message carries a VPC context label in a data plane, and a processing stage is dynamically switched to a corresponding domain to execute operation based on the label. According to the invention, the separation management of the NAT strategy and the connection tracking state is realized, different VPCs are supported to share the NAT rule, the session state isolation is maintained, and the Hash conflict and IP address overlapping problems are thoroughly eliminated. Compared with a traditional namespace scheme, processing is completed in the same kernel context, the CPU overhead is remarkably reduced, and the throughput is improved; linear expansion to thousands of VPCs is supported; operation and maintenance management is simplified; and multi-tenant security is enhanced.

Description

Technical Field

[0001] This application relates to the fields of cloud computing and network virtualization technology, and in particular to a multi-dimensional network function isolation system for virtual private clouds and related message processing methods. Background Technology

[0002] In cloud computing platforms, Virtual Private Clouds (VPCs) provide tenants with logically isolated network environments. With the development of cloud-native technologies, the network requirements within VPCs are becoming increasingly complex, and their core isolation requirements are mainly reflected in the following three aspects: 1. Route isolation: The routing tables (Forwarding Information Base, FIB) and forwarding paths of different tenants must be strictly independent, and tenants can use overlapping IP address spaces.

[0003] 2. Connection Tracking Isolation: Network Address Translation (NAT) relies on the connection tracking table to maintain session state. Sessions in different VPCs must not interfere with each other to avoid hash collisions or state leaks.

[0004] 3. NAT rule isolation: Destination Network Address Translation (DNAT) / Source Network Address Translation (SNAT) rules must be applied at the tenant level to prevent the rule base from becoming redundant, which could lead to decreased matching efficiency and the risk of mismatches.

[0005] Existing technologies primarily rely on the network isolation mechanisms provided by the Linux kernel, specifically including: (1) Based on network namespace: Create an independent namespace for each VPC to achieve full isolation of the protocol stack.

[0006] (2) Virtual Routing and Forwarding (VRF): The routing table is isolated by VRF ID within the same protocol stack.

[0007] (3) Based on the connection tracking zone: use Zone ID to distinguish connection tracking entries.

[0008] However, existing technologies have the following significant drawbacks in large-scale, high-concurrency VPC scenarios: 1. Limited flexibility due to isolated dimensional coupling: (1) The Network Namespace scheme is a “full isolation” mode, with strong binding of routing, network devices and firewall rules, making it difficult to extend NAT or routing independently.

[0009] (2) Namespace switching is accompanied by significant CPU context switching overhead, which affects network throughput.

[0010] 2. NAT and connection tracking management are highly complex: (1) VRF schemes typically only isolate routes, and NAT state tables are mostly shared globally, which can easily lead to IP / port conflicts.

[0011] (2) The complex Zone management mechanism introduced to resolve conflicts is prone to configuration errors.

[0012] 3. Redundant rules and high configuration complexity: In multi-layer NAT scenarios, iptables / nftables rules need to be configured repeatedly in multiple namespaces, leading to configuration drift and management difficulties.

[0013] 4. Limited scalability: When the number of VPCs reaches thousands, the number of kernel objects (such as namespaces and virtual devices) surges, leading to excessive resource consumption and decreased system stability.

[0014] In summary, existing technologies lack a lightweight isolation solution that can decouple the three core dimensions of routing, connection state, and NAT rules, and support flexible combination as needed. Summary of the Invention

[0015] To address the aforementioned problems in the existing technology, this application proposes a novel multi-dimensional network function isolation system and packet processing method for virtual private clouds. More specifically, it provides a network processing system and method that achieves multi-dimensional decoupling and isolation of routing forwarding, connection tracking, and network address translation (NAT) in a multi-tenant virtual private cloud (VPC) environment.

[0016] To achieve the above objectives, the present invention employs the following technical strategies: 1. Multidimensional Decoupling Architecture: This paper proposes an architecture that splits VPC network isolation into four independent dimensions: interface, routing, connection state, and NAT rules. This breaks through the limitation of traditional Namespace's single-dimensional full isolation and achieves fine-grained splitting and independent management of isolation dimensions.

[0017] 2. Domain Mapping and Binding Method: A method based on VPC context identifiers to dynamically combine four isolation domains is proposed. Each isolation domain is associated through context identifiers, enabling programmable configuration and flexible combination of isolation policies.

[0018] 3. Separation of connection state and NAT rules: Innovatively, NAT policies (static rules) and connection tracking (dynamic state) are separated into different domains for independent management, solving the problems of IP / port conflicts and rule redundancy in multi-tenant scenarios.

[0019] 4. Context-aware packet processing pipeline: A forwarding method is proposed that carries VPC metadata in the data plane and dynamically switches the context at each stage of packet processing to achieve context-aware and accurate packet processing.

[0020] Specifically, this application provides the following technical solutions: The first aspect of this application provides a multi-dimensional network function isolation system for a virtual private cloud, such as... Figure 1 As shown, the system includes: There are four independent isolation domains: interface isolation domain, routing processing domain, connection state tracking domain, and NAT rule domain. Each isolation domain is responsible for packet access and context marking, independent routing addressing, independent session state maintenance, and independent address translation policy execution, respectively. The domain mapping module is used to maintain the virtual private cloud context binding table. The virtual private cloud context binding table stores the dynamic mapping relationship between the virtual private cloud identifier and the domain identifiers of the four isolation domains, so as to realize the dynamic combination of virtual private cloud context and isolation domain. The message processing module is used to carry virtual private cloud metadata in the data plane and dynamically switch the isolation domain context according to the virtual private cloud metadata at each stage of message processing to execute the processing logic of the corresponding domain.

[0021] Furthermore, in the system of this application, the interface isolation domain identifies the virtual private cloud to which the packet belongs based on the virtual interface or tunnel identifier, and injects the virtual private cloud context identifier after the packet enters the system.

[0022] Furthermore, in the system of this application, the routing processing domain is used to store the routing table and forwarding policy of a specific virtual private cloud, including: indexing the corresponding routing table according to the virtual private cloud context label; and supporting different virtual private clouds to use overlapping IP address spaces and independently address in their respective routing tables.

[0023] Furthermore, in the system of this application, the connection state tracking domain provides an independent connection tracking tablespace for each virtual private cloud, and distinguishes the five-tuple sessions of different tenants through the virtual private cloud context identifier, thereby eliminating hash collisions and achieving state isolation.

[0024] Furthermore, in the system of this application, the NAT rule domain is used to store a set of source address translation / destination address translation policies for a specific virtual private cloud, and supports multiple virtual private clouds sharing the same NAT policy, including: directly jumping to the corresponding policy subset according to the virtual private cloud context label to avoid global traversal; and supporting the definition of a combination of public rule domains and private rule domains.

[0025] Furthermore, in the system of this application, the virtual private cloud context binding table records the mapping relationship between each virtual private cloud identifier and interface group identifier, routing table identifier, connection tracking area identifier, and NAT policy identifier; The logical model of the virtual private cloud context binding table is as follows: Context(VPCx) = {I_IDx, R_IDx, S_IDx, N_IDx}; Among them, VPCx is the Virtual Private Cloud identifier, and I_IDx, R_IDx, S_IDx, and N_IDx are the domain identifiers for the interface isolation domain, routing processing domain, connection state tracking domain, and NAT rule domain, respectively.

[0026] Furthermore, in the system of this application, the uplink message processing flow executed by the message processing module includes: (1) Access and labeling phase: Identify the virtual private cloud through the interface isolation domain and label it with the virtual private cloud context tag; (2) Connection status lookup phase: Switch to the corresponding connection status tracking field by label to query or mark the session status; (3) NAT rule matching stage: Perform static rule matching and transformation according to the NAT rule domain corresponding to the tag index; (4) Routing and forwarding phase: Switch to the corresponding routing processing domain by label, look up the table to determine the next hop and forward.

[0027] A second aspect of this application provides a message processing method for a multi-dimensional network function isolation system based on a virtual private cloud, wherein the method is applied to the aforementioned multi-dimensional network function isolation system of a virtual private cloud, such as... Figure 2 As shown, the method includes: S1. Receive messages from virtual machines, identify the virtual private cloud to which the message belongs in the interface isolation domain, and add a virtual private cloud context identifier to the message; S2. Based on the virtual private cloud context identifier, query the context binding table to determine the corresponding connection state tracking domain, and search for or create session state within that domain; S3. If the session state is newly created, switch to the corresponding NAT rule domain according to the virtual private cloud context identifier, match the source address translation or destination address translation rule in the domain and perform address translation. S4. After completing the address translation, switch to the corresponding routing processing domain according to the virtual private cloud context identifier, and perform route lookup and forwarding based on the routing table of that domain.

[0028] Furthermore, in the method of this application: The virtual private cloud context identifier is added to the virtual private cloud metadata and serves as the unique processing credential across the interface isolation domain, routing processing domain, connection state tracking domain, and NAT rule domain. The connection state tracking domains of different virtual private clouds are isolated from each other, so that the same quintuple is stored independently in different virtual private clouds without hash collisions; The context binding table supports dynamic configuration to enable the sharing or isolation of NAT policies between different virtual private clouds.

[0029] Furthermore, the method of this application also includes a domain mapping step: dynamically combining the interface isolation domain, routing processing domain, connection state tracking domain, and NAT rule domain through a virtual private cloud context binding table, wherein the virtual private cloud context binding table stores the mapping relationship between the virtual private cloud identifier and each isolation domain identifier.

[0030] A third aspect of this application provides an electronic device, including: a memory and a processor; Memory: Used to store computer programs; Processor: Used to execute the computer program to implement the steps of the aforementioned message processing method for a multi-dimensional network function isolation system based on a virtual private cloud.

[0031] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, it implements the steps of the aforementioned message processing method for a multi-dimensional network function isolation system based on a virtual private cloud.

[0032] In summary, compared with the prior art, the present invention has the following technical advantages: 1. High performance: By eliminating the excessive encapsulation and context switching overhead caused by Network Namespace, all network processing is completed in the same kernel / user space based on lightweight tag index, which significantly reduces CPU resource consumption and improves network throughput.

[0033] 2. Extreme flexibility and composability: Supports multi-dimensional isolation strategy combinations such as "routing isolation with NAT sharing", "complete isolation", and "partial rule sharing", which can flexibly adapt to the needs of advanced network scenarios such as Service Chain.

[0034] 3. High security: The independent connection state domain design completely isolates the session state of different tenants, effectively preventing cross-tenant session hijacking, state exhaustion attacks (such as DDoS), and connection tracking hash collision risks.

[0035] 4. Simplified operation and maintenance management: NAT rules are deduplicated, and administrators only need to maintain a unified rule template library. The rules are dynamically applied through the tenant-rule mapping relationship, reducing configuration complexity and error rate.

[0036] 5. Linear scalability: Adding a new VPC only requires allocating a unique ID and mapping table entry, without creating system-level objects such as namespaces and virtual devices. It supports the deployment of tens of thousands of VPCs on a single machine, with extremely low expansion costs.

[0037] Other features and advantages of this application will be set forth in detail in the following description, or will become apparent through the implementation of the relevant technical solutions of this application. The objectives and other advantages of this application can be achieved through the technical features and means explicitly pointed out in the description, claims, and drawings, and will be obtained through the implementation of these technical contents. Attached Figure Description

[0038] To more clearly illustrate the technical solution of this application, the accompanying drawings involved in the description of this invention will be briefly introduced below. It should be noted that the drawings only show some embodiments of this application. For those skilled in the art, other related drawings can be derived from these drawings without creative effort.

[0039] Figure 1 This is a structural diagram of the multi-dimensional network function isolation system of the virtual private cloud in this application.

[0040] Figure 2 This is a flowchart illustrating the overall implementation of the message processing method for the multi-dimensional network function isolation system based on a virtual private cloud, as described in this application.

[0041] Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. It should be noted that the described embodiments are only some embodiments of this application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the protection scope of this application.

[0043] In this document, the term "comprising" and any variations thereof (such as "including," "including," etc.) are open-ended expressions and should be understood as "including but not limited to," meaning that the listed content is not exhaustive and may include other content not explicitly mentioned. The term "based on" should be understood as "at least partially based on," meaning that the basis or condition referred to may not be the only factor and may involve other relevant factors. The term "one embodiment" should be understood as "at least one embodiment," meaning that the described embodiment is not the only possible implementation, and other similar embodiments may exist.

[0044] In this application, the terms "a" and "a plurality of" are used to modify related elements or features, and their expression is illustrative rather than restrictive. Unless otherwise expressly stated in the context, "a" should be understood as "at least one," and "a plurality of" should be understood as "at least two." Those skilled in the art should reasonably interpret these terms based on the semantic and logical relationships of the context to ensure that they cover the possibility of "one or more."

[0045] Example: A multi-dimensional network function isolation system and message processing method for a virtual private cloud 1. Overall Architecture Design This embodiment proposes a "multi-dimensional decoupling, dynamic mapping" network system (architecture). This system breaks away from the traditional fully encapsulated Namespace model and decomposes the VPC network data plane processing flow into four independent but logically related "isolation domains".

[0046] The four core isolation domains are as follows: (1) Interface Isolation Domain: Responsible for packet access and context marking.

[0047] (2) Routing Domain: Responsible for independent routing and next-hop selection.

[0048] (3) Session / Conntrack Domain: Responsible for independent session state maintenance.

[0049] (4) NAT Rule Domain: Responsible for the independent execution of address translation policies.

[0050] 2. Detailed Description of Core Components and Functions (1) Interface Isolation Domain (I-Domain) Definition: It is the boundary between VPC traffic entering and exiting the underlying physical network or virtual switch.

[0051] Functions: (a) Identify the VPC to which the packet belongs based on the virtual interface (veth, tap, virtio) or tunnel ID (VXLAN VNI); (b) Context injection: After the packet enters the system and passes the verification, immediately mark it with a "VPC context tag" (such as skb->mark or Metadata), which will serve as the unique credential for all subsequent domains.

[0052] (2) Routing Domain (R-Domain) Definition: The logical space that stores the routing table (FIB) and forwarding policies of a specific VPC.

[0053] Features: (a) The routing table is indexed based solely on the VPC label of the message; (b) IP address overlap is supported: VPC-A and VPC-B can have the exact same private network IP range (e.g., 192.168.1.0 / 24) and do not conflict with each other in their respective R-Domains.

[0054] (3) Connection State Tracking Domain (S-Domain) Definition: A separate connection tracking tablespace used to store the state of a 5-tuple (source IP, destination IP, source port, destination port, protocol).

[0055] Features: (a) Conflict elimination: The 1.1.1.1:80 -> 2.2.2.2:80 session of VPC-A and the same five-tuple session of VPC-B are stored in different S-Domain spaces in physical memory (or distinguished by Tag), which physically eliminates hash collisions; (b) State isolation: A connection flooding attack (SYN Flood) of one tenant will not exhaust the connection tracking table resources of another tenant.

[0056] (4) NAT rule domain (N-Domain) Definition: Stores a set of SNAT / DNAT policies for a specific VPC.

[0057] Features: (a) Rule sharding: NAT rules are no longer traversed in the global linked list, but are directly jumped to the corresponding N-Domain subset based on the VPC label; (b) Policy reuse: Supports the definition of combinations of "public rule domains" and "private rule domains" to improve memory utilization.

[0058] 3. Multidimensional domain mapping mechanism This embodiment innovatively introduces a "VPC Context Binding Table". The system control plane maintains a dynamic mapping table that defines how each VPC combines the above four domains.

[0059] Mapping logic model: Context(VPCx) = { I_IDx, R_IDx, S_IDx, N_IDx}

[0060] Note: As shown in the table above, this system supports different VPCs sharing the same NAT policy (such as VPC-1001 and 1002), but using different connection state domains, demonstrating extremely high flexibility.

[0061] 4. Message processing lifecycle flow The following describes the processing flow of an uplink packet (sent from a VM, accessing the public network via NAT): (1) Access and Tagging (I-Domain): (a) The message enters the host machine from the VM virtual network card.

[0062] (b) The system identifies the ingress port, looks up the binding table, and adds a metadata tag of VPC_ID = 1001 to the packet.

[0063] (2) Connection status lookup (S-Domain): (a) The system automatically switches to Conntrack_Zone_50 based on VPC_ID = 1001.

[0064] (b) Check if an existing session exists. If it exists, perform the conversion directly; if it does not exist, mark it as NEW.

[0065] (3) NAT rule matching (N-Domain): (a) If the status is NEW, the system indexes NAT_Policy_100 based on VPC_ID = 1001.

[0066] (b) Match only the SNAT rules within this policy domain and assign public IP addresses and ports.

[0067] (4) Routing and Forwarding (R-Domain): (a) After the NAT translation is completed, the system switches to Route_Table_10 based on VPC_ID = 1001.

[0068] (b) The table shows that the next hop is a public network gateway, and the packet is sent out.

[0069] The flowcharts and block diagrams in the accompanying drawings illustrate possible implementations of systems, methods, and computer program products according to various embodiments of this application, including architecture, functionality, and operation. In these figures, each block may represent a module, program segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should be noted that each block in the block diagrams and / or flowcharts, and combinations thereof, can be implemented using either a dedicated hardware-based system or a combination of dedicated hardware and computer instructions to achieve the specified function or operation.

[0070] like Figure 3 As shown in the illustration, an embodiment of this application also discloses an electronic device, including: a processor 310, a communication interface 320, a memory 330 for storing a processor-executable computer program, and a communication bus 340. The processor 310, communication interface 320, and memory 330 communicate with each other via the communication bus 340. The processor 310 executes the executable computer program to implement the steps of the above-described message processing method for a multi-dimensional network function isolation system based on a virtual private cloud.

[0071] It is understood that, in addition to memory and a processor, this electronic device may also include input devices (such as a keyboard), output devices (such as a display), and other communication modules. These input devices, output devices, and other communication modules all communicate with the processor through I / O interfaces (i.e., input / output interfaces).

[0072] The operations described in this application can be implemented by writing computer program code using one or more programming languages ​​or a combination thereof. The programming languages ​​include, but are not limited to, the following types: Object-oriented programming languages, such as Java, Smalltalk, C++, etc. Conventional procedural programming languages, such as "C" or similar programming languages.

[0073] The execution methods of program code include, but are not limited to: It runs entirely on the user's computer; Part of it executes on the user's computer, and part of it executes on a remote computer; Execute as a standalone software package; It is executed entirely on a remote computer or server.

[0074] In scenarios involving remote computers, the remote computer can connect to the user's computer via any type of network, including but not limited to local area networks (LANs) or wide area networks (WANs). Furthermore, the remote computer can also connect to external computers through an internet service provider, for example, by utilizing the internet for connection.

[0075] Furthermore, this application also discloses a computer-readable storage medium, which, when the instructions in the computer-readable storage medium are executed by the processor of an electronic device, enables the electronic device to perform the various steps of the message processing method of the multi-dimensional network function isolation system based on a virtual private cloud disclosed in this application.

[0076] In the context of this application, a computer-readable storage medium refers to a tangible medium capable of storing computer program code and related data. Specific examples include, but are not limited to, the following: (1) Portable computer disk: such as floppy disks and other removable magnetic storage media.

[0077] (2) Hard disk: including mechanical hard disks and solid-state hard disks and other fixed storage devices.

[0078] (3) Random Access Memory (RAM): A volatile storage medium used for temporary storage of data and program code.

[0079] (4) Read-only memory (ROM): a non-volatile storage medium used to store fixed programs and data.

[0080] (5) Erasable programmable read-only memory (EPROM) or flash memory: non-volatile storage media that supports multiple erasures and reprogrammings.

[0081] (6) Fiber optic storage devices: storage media based on fiber optic technology.

[0082] (7) Portable compact disc read-only memory (CD-ROM): a read-only medium that stores data in the form of an optical disc.

[0083] (8) Optical storage devices: such as DVDs, Blu-ray discs and other storage media based on optical principles.

[0084] (9) Magnetic storage devices: such as magnetic tapes, disks and other storage media based on magnetic principles.

[0085] (10) Any suitable combination of the above: for example, combining multiple storage media to meet different storage needs.

[0086] These computer-readable storage media can be used to store the program code and related data described in this application to support program execution and persistent data storage.

[0087] Specifically, according to embodiments of this application, the processes described in the flowcharts can be implemented as computer software programs. For example, embodiments of this application relate to a computer program product comprising a computer program carried on a non-transitory computer-readable medium. This computer program includes program code for executing the message processing method of the multi-dimensional network function isolation system based on a virtual private cloud disclosed in this application. When the computer program is executed by a processing device, it can achieve the functions defined in the embodiments of this application.

[0088] While the foregoing discussion contains several specific implementation details, these details should not be construed as limiting the scope of this application. The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this application is not limited to technical solutions formed by specific combinations of the above-described technical features. Furthermore, this application should also cover other technical solutions formed by any combination of the above-described technical features or their equivalents without departing from the foregoing disclosed concept.

[0089] Those skilled in the art should also understand that modifications can be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features, without departing from the spirit and scope of the technical solutions of the embodiments of this application. These modifications or substitutions will not cause the essence of the corresponding technical solutions to deviate from the core spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A multi-dimensional network function isolation system for a virtual private cloud, characterized in that, The system includes: There are four independent isolation domains: interface isolation domain, routing processing domain, connection state tracking domain, and NAT rule domain. Each isolation domain is responsible for packet access and context marking, independent routing addressing, independent session state maintenance, and independent address translation policy execution, respectively. The domain mapping module is used to maintain the virtual private cloud context binding table. The virtual private cloud context binding table stores the dynamic mapping relationship between the virtual private cloud identifier and the domain identifiers of the four isolation domains, so as to realize the dynamic combination of virtual private cloud context and isolation domain. The message processing module is used to carry virtual private cloud metadata in the data plane and dynamically switch the isolation domain context according to the virtual private cloud metadata at each stage of message processing to execute the processing logic of the corresponding domain.

2. The system according to claim 1, characterized in that, The interface isolation domain identifies the virtual private cloud to which the packet belongs based on the virtual interface or tunnel identifier, and injects the virtual private cloud context identifier after the packet enters the system.

3. The system according to claim 1, characterized in that, The routing processing domain is used to store the routing table and forwarding policy of a specific virtual private cloud, including: indexing the corresponding routing table according to the virtual private cloud context label; and supporting different virtual private clouds to use overlapping IP address spaces and independently address in their respective routing tables.

4. The system according to claim 1, characterized in that, The connection state tracking domain provides an independent connection tracking tablespace for each virtual private cloud, and distinguishes the five-tuple sessions of different tenants through the virtual private cloud context identifier, thereby eliminating hash collisions and achieving state isolation.

5. The system according to claim 1, characterized in that, The NAT rule domain is used to store a set of source address translation / destination address translation policies for a specific virtual private cloud, and supports multiple virtual private clouds sharing the same NAT policy, including: directly jumping to the corresponding policy subset based on the virtual private cloud context label to avoid global traversal; and supporting the definition of combinations of public rule domains and private rule domains.

6. The system according to claim 1, characterized in that, The virtual private cloud context binding table records the mapping relationship between each virtual private cloud identifier and the interface group identifier, routing table identifier, connection tracking area identifier, and NAT policy identifier; The logical model of the virtual private cloud context binding table is as follows: Context(VPCx) = {I_IDx, R_IDx, S_IDx, N_IDx}; Among them, VPCx is the Virtual Private Cloud identifier, and I_IDx, R_IDx, S_IDx, and N_IDx are the domain identifiers for the interface isolation domain, routing processing domain, connection state tracking domain, and NAT rule domain, respectively.

7. The system according to claim 1, characterized in that, The uplink message processing procedure executed by the message processing module includes: (1) Access and labeling phase: Identify the virtual private cloud through the interface isolation domain and label it with the virtual private cloud context tag; (2) Connection status lookup phase: Switch to the corresponding connection status tracking field by label to query or mark the session status; (3) NAT rule matching stage: Perform static rule matching and transformation according to the NAT rule domain corresponding to the tag index; (4) Routing and forwarding phase: Switch to the corresponding routing processing domain by label, look up the table to determine the next hop and forward.

8. A message processing method for a multi-dimensional network function isolation system based on a virtual private cloud, characterized in that, The method is applied to the system as described in any one of claims 1-7, and the method comprises: S1. Receive messages from virtual machines, identify the virtual private cloud to which the message belongs in the interface isolation domain, and add a virtual private cloud context identifier to the message; S2. Based on the virtual private cloud context identifier, query the context binding table to determine the corresponding connection state tracking domain, and search for or create session state within that domain; S3. If the session state is newly created, switch to the corresponding NAT rule domain according to the virtual private cloud context identifier, match the source address translation or destination address translation rule in the domain and perform address translation. S4. After completing the address translation, switch to the corresponding routing processing domain according to the virtual private cloud context identifier, and perform route lookup and forwarding based on the routing table of that domain.

9. The method according to claim 8, characterized in that, In the method: The virtual private cloud context identifier is added to the virtual private cloud metadata and serves as the unique processing credential across the interface isolation domain, routing processing domain, connection state tracking domain, and NAT rule domain. The connection state tracking domains of different virtual private clouds are isolated from each other, so that the same quintuple is stored independently in different virtual private clouds without hash collisions; The context binding table supports dynamic configuration to enable the sharing or isolation of NAT policies between different virtual private clouds.

10. The method according to claim 8, characterized in that, The method also includes a domain mapping step: dynamically combining interface isolation domain, routing processing domain, connection state tracking domain, and NAT rule domain through a virtual private cloud context binding table, wherein the virtual private cloud context binding table stores the mapping relationship between virtual private cloud identifiers and each isolation domain identifier.

Images