A flow table generation method and device, electronic equipment and medium

Abstract

The application discloses a flow table generation method and device, electronic equipment and medium, and relates to the technical field of computers. The method comprises the following steps: obtaining a firewall policy corresponding to a to-be-generated flow table; in the case that the firewall policy contains at least one message matching condition, determining all message matching conditions in the firewall policy and the condition types corresponding to each message matching condition respectively; generating a first flow table corresponding to the firewall policy based on the message matching conditions and the condition types corresponding to the message matching conditions respectively; in the case that the firewall policy contains a virtual machine label, determining a virtual network card identifier corresponding to the virtual machine label in the firewall policy; and generating a second flow table corresponding to the firewall policy based on the virtual network card identifier and the virtual machine label. Through the application, the generation of a firewall policy flow table containing various message matching conditions such as IP and port and containing a virtual machine label is supported, and the flexibility and convenience of the firewall policy are improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, electronic device and medium for generating flow tables. Background Technology

[0002] Firewalls based on the OpenFlow network communication protocol are core devices for data center network security protection. They primarily use flow tables to match and control network traffic, thereby ensuring network transmission security. Currently, generating flow tables based on firewall policies has significant drawbacks. The packet matching conditions in the flow table can only match a single field, resulting in poor configuration flexibility and an inability to adapt to diverse and granular security policy configuration needs, hindering rapid firewall policy deployment. Furthermore, with the widespread adoption of cloud computing and virtualization technologies, virtual machine tags have become the primary identification method for virtual networks. However, firewall policy flow tables in related technologies do not support virtual machine tag matching mechanisms, making them unsuitable for traffic identification and control scenarios in virtualized networks. Summary of the Invention

[0003] This application provides a flow table generation method, apparatus, electronic device, and medium to support the generation of firewall policy flow tables that include various packet matching conditions such as IP and port, as well as virtual machine tags.

[0004] This application provides a method for generating flow tables, including: Obtain the firewall policy corresponding to the flow table to be generated; If a firewall policy contains at least one packet matching condition, determine all packet matching conditions in the firewall policy and the condition type corresponding to each packet matching condition; based on each packet matching condition and the condition type corresponding to each packet matching condition, generate a first flow table corresponding to the firewall policy. If the firewall policy includes a virtual machine tag, determine the virtual network interface identifier corresponding to the virtual machine tag in the firewall policy; based on the virtual network interface identifier and the virtual machine tag, generate a second flow table corresponding to the firewall policy, wherein the virtual machine tag is used to indicate the group to which the virtual machine belongs.

[0005] This application also provides a flow table generation apparatus, including: The acquisition module is used to acquire the firewall policy corresponding to the flow table to be generated. The generation module is used to determine all packet matching conditions in the firewall policy and the condition type corresponding to each packet matching condition when the firewall policy contains at least one packet matching condition; and to generate a first flow table corresponding to the firewall policy based on each packet matching condition and the condition type corresponding to each packet matching condition. If the firewall policy includes a virtual machine tag, determine the virtual network interface identifier corresponding to the virtual machine tag in the firewall policy; based on the virtual network interface identifier and the virtual machine tag, generate a second flow table corresponding to the firewall policy, wherein the virtual machine tag is used to indicate the group to which the virtual machine belongs.

[0006] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for executing the computer program to implement the steps of any of the above-described flow table generation methods.

[0007] This application also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the above-described flow table generation methods.

[0008] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described flow table generation methods.

[0009] This application addresses the limitation of firewall flow tables in related technologies, which can only match single fields, by generating a first flow table based on each packet matching condition and its corresponding type when the firewall policy contains multi-dimensional and multi-type packet matching conditions. This supports packet matching with multiple packet matching conditions, improving the flexibility and convenience of firewall policy configuration, meeting security needs in different scenarios, and increasing firewall configuration efficiency. Furthermore, for firewall policies containing virtual machine tags, a second flow table is generated by associating the virtual machine tag with the corresponding virtual network interface identifier. This achieves traffic identification and control based on virtual machine tags (i.e., virtual machine groups), overcoming the shortcomings of related technologies in adapting to virtualization tag matching, and adapting to cloud computing and virtualization networking scenarios. In the embodiments of this application, the first and second flow tables simultaneously address physical packet filtering and virtual network packet control, improving the network security protection performance of data centers. Attached Figure Description

[0010] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A flowchart illustrating a flow table generation method provided in this application embodiment; Figure 2 A schematic diagram illustrating the generation of the first flow table provided in an embodiment of this application; Figure 3This is a schematic diagram of the OpenFlow flow table provided in the embodiments of this application; Figure 4 This is a schematic diagram illustrating the allocation of labels to virtual machines using flow tables, as provided in an embodiment of this application. Figure 5 This is a schematic diagram of the structure of a flow table generation device provided in an embodiment of this application; Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0012] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0013] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0014] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0015] First, the application scenarios of the embodiments of this application will be introduced by way of example.

[0016] Firewalls based on the OpenFlow network communication protocol are crucial for data center network security. They use flow tables to match and control network traffic, thereby ensuring the security of data transmission over business networks. However, existing firewall policies only support single-field matching in their generated flow tables, making them unsuitable for complex security policies with multiple conditions, resulting in low deployment efficiency.

[0017] The firewall policy works by designing and initializing flow tables, which are then distributed to each switch. The switch matches traffic from flow table 0 down according to priority. Once a specific flow table is matched, the corresponding action is executed, such as forwarding or dropping packets. If no flow table is matched, the default rules are used to execute the appropriate action.

[0018] Suppose we need to issue a firewall policy from the cloud platform with a source IP address of 192.168.12.3, a destination IP address of 192.168.12.8, a source port of 6600, a destination port of 443, and the protocol being Transmission Control Protocol (TCP). The issued flow table would be: "table=5, priority=10, tcp,nw_src=192.168.12.3, nw_dst=192.168.12.8, tp_src=6600, tp_dst=443, actions=normal". In this flow table, table=5 indicates that the packet matching condition belongs to the 5th flow table, and Priority represents the priority of this condition in the 5th table. When a packet enters the 5th flow table, it is matched sequentially from highest to lowest priority. The tcp, nw_src, nw_dst, tp_src, and tp_dst correspond to the five-tuple of firewall policies, namely, protocol, source IP address, destination IP address, source port, and destination port. However, due to the limitations of the underlying flow table, the source and destination IP fields only support a single IP address or a single network segment, such as 192.168.12.0 / 24, and the source and destination ports also only support a single port.

[0019] Meanwhile, with the development of cloud computing and virtualization technologies, virtual machine group labels have become an important identification criterion for distinguishing virtual machine service groups in virtual networks. However, existing flow tables cannot directly identify virtual machine labels and lack a matching processing mechanism for virtual machine labels. Therefore, how to generate flow tables that include various packet matching conditions such as IP and port, as well as firewall policies such as virtual machine labels, is a current focus.

[0020] It should be noted that the flow table generation method provided in this embodiment of the invention can be executed by a flow table generation device. This device can be implemented as part or all of an electronic device through software, hardware, or a combination of both. The electronic device can be a server or a terminal. In this embodiment, the server can be a single server or a server cluster composed of multiple servers. The terminal in this embodiment can be a smartphone, personal computer, tablet computer, wearable device, or other intelligent hardware device such as a smart robot. The following method embodiments will use an electronic device as an example for explanation.

[0021] According to an embodiment of the present invention, a flow table generation method embodiment is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0022] This embodiment provides a flow table generation method, which can be used in the aforementioned electronic devices, such as servers. Figure 1 This is a flowchart of a flow table generation method provided according to an embodiment of the present invention, such as... Figure 1 As shown, the process includes: S101, obtain the firewall policy corresponding to the flow table to be generated.

[0023] Specifically, firewall policies are security control rules for data center networks, used by the firewall to generate flow tables and manage network traffic. For example, firewall policies include, but are not limited to, traffic matching rules, access permissions, and control priorities.

[0024] For example, firewall policies can be security control policies that network administrators edit through a firewall management platform.

[0025] S102, if the firewall policy contains at least one packet matching condition, determine all packet matching conditions in the firewall policy and the condition type corresponding to each packet matching condition; based on each packet matching condition and the condition type corresponding to each packet matching condition, generate a first flow table corresponding to the firewall policy.

[0026] If the firewall policy includes a virtual machine label, determine the virtual network interface identifier corresponding to the virtual machine label in the firewall policy; based on the virtual network interface identifier and the virtual machine label, generate a second flow table corresponding to the firewall policy.

[0027] The virtual machine label is used to indicate the group to which the virtual machine belongs.

[0028] Specifically, packet matching conditions are used in firewall policies to filter packets and identify key conditions for target traffic. For example, packet matching conditions include, but are not limited to, source IP address, destination IP address, source port, destination port, transport protocol, and packet length. For instance, a packet matching condition could be a source IP of 10.0.0.5 or a destination port of 80. Furthermore, the IP address can be a single IP address, an IP range, or an IP subnet. The port can be a single port, discrete ports, or a port range. Correspondingly, the condition types for packet matching conditions are source IP address type, destination IP address type, source port type, destination port type, transport protocol type, and packet length type, etc.

[0029] The first flow table is used to filter and control traffic in the network, and can perform operations such as packet field comparison, forwarding, and interception.

[0030] Virtual machine tags are used to distinguish the groups to which virtual machines belong in the network. These groups can be business groups, permission levels, etc. For example, virtual machine tags can be Production Environment A, Production Environment B, etc.

[0031] Virtual network adapter identifiers are used to indicate the virtual network adapter of a virtual machine (such as network adapter ID), which can be used to identify virtual machines and avoid confusion when identifying multiple virtual machines.

[0032] For example, text analysis can be performed on firewall policies, such as keyword extraction, to filter out packet matching fields such as IP, port, and protocol, as well as virtual machine tag fields, in order to obtain the corresponding packet matching conditions and virtual machine tags.

[0033] The second flow table is generated based on virtual machine tags and virtual network interface card identifiers, overcoming the limitation of flow tables in related technologies that can only match the physical fields of packets, and realizing traffic control based on virtual machine groups and virtual identities.

[0034] In this embodiment, when the firewall policy contains multi-dimensional and multi-type packet matching conditions, a corresponding first flow table is generated based on each packet matching condition and its corresponding type. This overcomes the limitation of firewall flow tables in related technologies, which can only match a single field. It supports packet matching with multiple packet matching conditions, improving the flexibility and convenience of firewall policy configuration, meeting security needs in different scenarios, and increasing firewall configuration efficiency. Simultaneously, for firewall policies containing virtual machine tags, a second flow table is generated by associating the virtual machine tag with the corresponding virtual network interface identifier. This achieves traffic identification and control based on virtual machine tags (i.e., virtual machine groups), overcoming the shortcomings of related technologies in adapting to virtualization tag matching, and adapting to cloud computing and virtualization networking scenarios. In this embodiment, the first and second flow tables simultaneously handle physical packet filtering and virtual network group control, improving the network security protection performance of the data center.

[0035] In some embodiments, based on the foregoing embodiments, a first flow table corresponding to the firewall policy is generated based on each packet matching condition and the condition type corresponding to each packet matching condition, specifically including the following method steps: a1. Based on the condition types corresponding to all packet matching conditions, determine the total number of packet matching condition types in the firewall policy.

[0036] Specifically, the total number of types refers to the total number of non-repeating condition types corresponding to all packet matching conditions in the firewall policy, representing the packet matching dimension in the firewall policy. For example, if the firewall policy includes packet matching conditions of source IP, destination port, and transport protocol, and packets are filtered from three dimensions, then the total number of types is 3.

[0037] a2, based on the first message matching condition, the condition type of the first message matching condition, and the total number of types, generates the first type of sub-flow table corresponding to the first message matching condition.

[0038] The first message matching condition is one of at least one message matching conditions.

[0039] Here, the first type of subflow table can be understood as the message control logic generated based on the first message matching condition.

[0040] In one possible implementation, the first type of sub-flow table corresponding to the first message matching condition is generated in the following manner: b1 generates a tagging instruction based on the total number of types and the condition type of the first message matching condition.

[0041] The marking instruction is used to mark the condition type corresponding to the first message matching condition as successfully matched after the message matches the first message matching condition.

[0042] Optionally, before generating the first type of sub-flow table corresponding to the first message matching condition based on the first message matching condition, the condition type of the first message matching condition, and the total number of types, the method provided in this application embodiment further includes the following: Assign multi-dimensional matching identifiers to all message matching conditions, and assign a corresponding sequence number to each condition type.

[0043] Specifically, the multi-dimensional matching identifier serves as a unified global representation for all packet matching conditions under this firewall policy. It is used to mark that all packet matching conditions belong to the same set of flow table generation, thus realizing the association of multi-condition matching data and avoiding confusion between cross-policy conditions. For example, 1234 is assigned as the multi-dimensional matching identifier for all the above packet matching conditions.

[0044] The condition type number refers to the sequence number assigned to each condition type according to a preset sorting rule, thereby distinguishing different condition types. In this embodiment, the sequence numbers corresponding to all condition types are natural numbers starting from 1. For example, taking a total of 2 types of message matching conditions as an example, the sequence number of the condition type "Destination IP" is 1, and the sequence number of the condition type "Target Port" is 2.

[0045] Furthermore, a tagging instruction is generated based on the total number of types and the condition type of the first message matching condition in the following manner: First, based on the condition type of the first message matching condition, determine the sequence number corresponding to the first message matching condition.

[0046] Then, based on the multi-dimensional matching identifier, the total number of types, and the sequence number corresponding to the matching condition of the first message, a marking instruction is generated.

[0047] In this way, by uniformly configuring multi-dimensional matching identifiers and unique sequence numbers for all packet matching conditions before generating the sub-flow table, the association and differentiation of multiple packet matching conditions under this firewall policy are realized. At the same time, based on the multi-dimensional matching identifiers, the total number of types, and the sequence number corresponding to the first packet matching condition, a marking instruction is generated, making the matching results of the first type of sub-flow table traceable and distinguishable, thereby improving the orderliness of firewall policy flow table generation.

[0048] For example, the marking instruction is used to instruct the switch to mark a matching success mark of the corresponding condition type in the packet buffer space or flow table matching status bit when the packet matches the first packet matching condition.

[0049] In this embodiment, the multi-dimensional matching identifier, the total number of types, and the sequence number corresponding to the first message matching condition are written as parameters into the conjunction instruction to generate a tagging instruction.

[0050] In this way, the `conjunction` directive logically ANDs all packet matching conditions to form a unified policy rule. This allows for the configuration of firewall policies that combine packet matching conditions such as multiple IP addresses and service ports through the first-flow table.

[0051] Specifically, `conjunction` is a flow table optimization in OpenVswitch (OVS). It's an advanced flow table feature used to optimize the number of flow table entries and improve matching efficiency, suitable for scenarios requiring simultaneous matching of multiple condition sets. The `conjunction` directive has the form `conjunction(id, k / n)`, where `k` is the dimension of the current `conjunction`, `n` is the total number of dimensions in the `conjunction`, and `id` is the common ID of the same `conjunction` (range 1~65535). Here, the sequence number corresponding to the matching condition of the first packet is used as the dimension of the current `conjunction`, and the total number of types is used as the total number of dimensions in the `conjunction`. For example, the marking directive is `conjunction(1234, 1 / 2)`, where `1234` is the multi-dimensional matching identifier, `1 / 2` represents the sequence number corresponding to the matching condition of the first packet, and `2 / 2` represents the total number of types.

[0052] b2, using the first message matching condition as the matching field and the marking instruction as the action field, generates the first type of subflow table corresponding to the first message matching condition.

[0053] Specifically, the matching field refers to the field area in the first type of sub-flow table used for performing traffic feature comparison, carrying the first packet matching condition. The action field refers to the operation that needs to be performed when the packet meets the first packet matching condition. For example, a flag instruction indicating that the first packet matching condition has been successfully matched is written into the action field, so that the action field instruction is automatically triggered after the packet matches the first packet matching condition, completing the matching status marking.

[0054] Of course, the first type of subflow table can also include information such as the identifier of the first flow table and the priority of the first type of subflow table.

[0055] For example, following the OpenFlow flow table standard format, the first message matching condition is filled into the flow table matching field, and the corresponding flag instruction is directly written into the action field, forming a standard sub-flow table with a regular structure that is compatible with general OpenFlow devices.

[0056] a3. After generating the first type of sub-flow tables corresponding to all message matching conditions, determine the first flow table based on the first type of sub-flow tables corresponding to all message matching conditions.

[0057] Specifically, the first flow table is a composite flow table generated from the first type of sub-flow tables corresponding to all packet matching conditions, which can realize multi-dimensional and multi-field traffic control.

[0058] In one possible implementation, a3 above specifically includes the following: First, all condition types that match successfully are used as the matching field, and the message passing is used as the action field to generate the second type of subflow table.

[0059] Specifically, unlike the first type of subflow table which carries single-dimensional packet matching conditions, the second type of subflow table takes the successful matching of all condition types as the basis and only executes the packet passage action when all condition types match, thus realizing the final verification and traffic release control of the multi-condition matching strategy.

[0060] It is understandable that "all condition types match successfully" means that at least one message matching condition of each condition type is successful, but it does not require that all message matching conditions of each condition type are successful.

[0061] Taking a firewall policy that includes source IP address and destination port as an example, assuming that the packet matching conditions belonging to the source IP address class include 192.168.12.3 (packet matching condition 1) and 192.168.13.0 (packet matching condition 2), and the packet matching conditions belonging to the destination port class are port 80 (packet matching condition 3) and port 100 (packet matching condition 4), if the source IP address of the packet is 192.168.12.3 (i.e. matching packet matching condition 1) and the destination port is port 100 (i.e. matching packet matching condition 4), then the packet is successfully matched in both the source IP address and destination port dimensions, and the packet will be allowed to pass.

[0062] Then, based on each of the first type of subflow tables and the second type of subflow tables, the first flow table is determined.

[0063] Specifically, the first flow table, as a complete composite flow table that aggregates various first-type sub-flow tables and second-type sub-flow tables, has the ability to control packets by performing single-dimensional distribution matching and multi-dimensional overall verification.

[0064] For example, the first type of sub-flow tables and the second type of sub-flow tables are integrated, for example, through modular binding and encapsulation, to obtain the first flow table.

[0065] In this way, based on the first type of sub-flow table, combined with the second type of sub-flow table used for global verification, the success of matching all condition types is used as the basis for message passage, thereby realizing the aggregation of multi-dimensional matching results.

[0066] In this embodiment, the total number of packet matching conditions in the firewall policy ensures the matching dimension of the policy. A first-type sub-flow table is generated separately for each packet matching condition. Finally, all first-type sub-flow tables are integrated to obtain the first flow table. This overcomes the limitation of related technologies where firewall flow tables can only match a single field and cannot adapt to complex, multi-dimensional security policies. This embodiment, through the splitting of multiple sub-flow tables and global dimensional constraints, achieves the generation of flow tables for firewall policies containing multiple types and dimensions of packet matching conditions. It can flexibly adapt to the generation of various flow tables according to firewall policies of different complexities, improving the flexibility, compatibility, and security of firewall configuration.

[0067] Suppose an IP address group A is created on a cloud platform, with the content {192.168.12.3, 192.168.13.0 / 24, 12.12.12.13-12.12.12.15}, and a service group (which can also be understood as a port group) B is created, with the content {22, 80, 100-105}. A firewall policy is created, where the packet matching conditions include destination IP address class and destination port class. Specifically, the destination IP address is IP address group A, the destination port is service group B, the protocol is TCP, and the action is allow. The steps for the switch to implement packet control using the first flow table are as follows: First, obtain the multi-dimensional matching identifier conj_id as 1234. Then, based on conj_id, search the various first-class sub-flow tables and second-class sub-flow tables in the first flow table again. Finally, find the action corresponding to the connection match. When all condition types match successfully, execute the packet passage action. The first flow table obtained by the method provided in this application embodiment is as follows: "table=5,priority=100,nw_dst=192.168.12.3 actions=conjunction(1234,1 / 2) table=5,priority=100,nw_dst=192.168.13.0 / 24 actions=conjunction(1234,1 / 2) table=5,priority=100,nw_dst=192.168.12.13 actions=conjunction(1234,1 / 2) table=5,priority=100,nw_dst=192.168.12.14 actions=conjunction(1234,1 / 2) table=5,priority=100,nw_dst=192.168.12.15 actions=conjunction(1234,1 / 2) table=5,priority=100,tp_dst=22 actions=conjunction(1234, 2 / 2) table=5,priority=100,tp_dst=80 actions=conjunction(1234, 2 / 2) table=5,priority=100,tp_dst=100 actions=conjunction(1234, 2 / 2) table=5,priority=100,tp_dst=101 actions=conjunction(1234, 2 / 2) table=5,priority=100,tp_dst=102 actions=conjunction(1234, 2 / 2) table=5,priority=100,tp_dst=103 actions=conjunction(1234, 2 / 2) table=5,priority=100,tp_dst=104 actions=conjunction(1234, 2 / 2) table=5,priority=100,tp_dst=105 actions=conjunction(1234, 2 / 2) table=5,priority=100,tcp,conj_id=1234 actions=normal”.

[0068] The aforementioned first-flow table contains 14 sub-flow tables: 13 first-type sub-flow tables and 1 second-type sub-flow table. Specifically, the first five first-type sub-flow tables correspond to IP address group A, the next eight first-type sub-flow tables correspond to service group B (also known as port group B), and the last one is a second-type sub-flow table. The first-flow table shows that this firewall policy has two types of packet matching conditions: the first type matches the destination IP address, and the second type matches the destination port. When both dimensions match successfully, the corresponding action is executed.

[0069] Taking the first sub-flow table as an example, in "table=5,priority=100,nw_dst=192.168.12.13actions=conjunction(1234, 1 / 2)", it indicates that a packet matching condition with a priority of 100 is configured in flow table 5, and the matching field is the destination network address of the packet, 192.168.12.13. When the destination IP address of a network packet flowing through this flow table matches the packet matching condition, the corresponding action field action will be triggered. Specifically, the packet matching condition group with the multi-dimensional matching identifier 1234 will be added, and it will be marked as the first condition type among the two condition types under the packet matching condition group has been successfully matched, thus realizing the step-by-step marking of single-dimensional conditions.

[0070] In “table=5,priority=100,tcp,conj_id=1234 actions=normal”, it is indicated that a matching rule with a priority of 100 is configured in flow table 5. When a packet matches the TCP protocol and all condition types in the packet matching condition group with multi-dimensional matching identifier 1234 are successfully matched, it is determined that the packet meets the matching rule. At this time, a normal forwarding action will be triggered, which together with the first 13 first-type sub-flow tables will complete the multi-condition matching verification.

[0071] Figure 2 This diagram illustrates the generation of the first flow table. When generating the flow table for a firewall policy, firstly, it is determined whether the firewall policy contains multiple packet matching conditions such as IP groups and service groups. If not, the corresponding flow table is directly generated based on relevant technologies, i.e., the method provided in this embodiment is not used to generate the flow table. If yes, a multi-dimensional matching identifier corresponding to all packet matching conditions in the firewall is generated, and the total number of packet matching condition types in the firewall policy is counted. Next, a first type of sub-flow table corresponding to each packet matching condition and a second type of sub-flow table used for global aggregation judgment are generated. Finally, the various first type of sub-flow tables and second type of sub-flow tables are integrated to obtain the first flow table, which is then distributed to the switch to complete the configuration of the firewall policy.

[0072] The method provided in this application addresses the issue of inflexible adaptation between source and destination IPs and ports by proposing and designing IP address groups for source and destination IPs and service groups for source and destination ports through the conjunction field in the flow table. The IP address group can be a combination of a single IP, an IP range, or an IP network segment. When adding a firewall policy on the cloud platform, a pre-created IP address group label can be selected in the source and destination IP field. For example, its format can be {name:192.168.12.3,192.168.13.0 / 24,12.12.12.12-12.12.12.20}, where 'name' is the name of the IP address group, also called the IP address group label, and its value can include a combination of a single IP 192.168.12.3, the IP network segment 192.168.13.0 / 24, and the IP range 12.12.12.12-12.12.12.20. In the source and destination port fields, you can select a pre-created service group label. For example, it can be in the form of {name:22,80,100-120}, where name is the label name of the service group. Its value can include a single port 22 and 80, or a range of ports in the form of 100-120.

[0073] In some embodiments, based on any of the foregoing embodiments, a second flow table corresponding to the firewall policy is generated based on the virtual network interface card identifier and the virtual machine tag, specifically including the following method steps: First, the virtual network interface identifier is identified as the matching field of the second flow table.

[0074] Specifically, the second flow table, as a flow table adapted to cloud computing virtualization scenarios, such as the OpenFlow flow table, uses the virtual network card identifier as the matching basis and the virtual machine label allocation as the execution action, realizing the labeling and control of virtual machine identity and virtual machine group.

[0075] The matching field in the second flow table refers to the comparison field used for virtual network interface card identification in the second flow table, thereby filtering out the virtual machine traffic to be managed.

[0076] Then, assigning virtual machine labels to messages will be determined as the action domain of the second flow table.

[0077] Specifically, the action field in the second flow table refers to the operation instruction executed after a successful match of the virtual network interface card (NIC) identifier. In this embodiment, it refers to assigning a virtual machine label to the packet corresponding to the virtual NIC identifier, marking the packet with a virtual machine group, realizing the group classification of virtualized traffic, and providing a foundation for subsequent virtual network group management. For example, after a packet successfully matches the virtual NIC identifier, the action field automatically assigns the virtual machine label "Generation Environment A" to the packet, completing the traffic group marking.

[0078] In one possible implementation, the virtual machine label is written into the metadata of the open virtual switch and identified as the action field of the second flow table. In this way, firewall policies identify the virtual machine's identity through the values ​​in the metadata fields corresponding to the packets, without parsing the original packet content, thus achieving fine-grained security policies based on virtual machine identity rather than network location.

[0079] Specifically, the Open Virtual Switch (OVS) is used to implement traffic forwarding, traffic matching, and traffic control between virtual machines and between virtual machines and the external network in a virtualization scenario. Inbound and outbound traffic for each virtual machine must be scheduled through the Open Virtual Switch. The metadata in OVS consists of pre-reserved, customizable, read-write temporary data storage fields within the Open Virtual Switch. For example, writing the "0x1000" virtual machine tag corresponding to production environment A into the OVS metadata identifies the virtual machine group belonging to production environment A for the current packet.

[0080] For example, the virtual machine tag is written to the metadata offset address corresponding to the message.

[0081] Finally, a second flow table is generated based on the matching domain and action domain of the second flow table.

[0082] For example, based on the OpenFlow flow table standard architecture, the virtual network interface identifier matching field and the virtual machine label allocation action field are encapsulated and combined to generate a standardized second flow table that is compatible with various OpenFlow devices.

[0083] An OpenFlow flow table is a collection of policy entries for a specific flow, responsible for packet lookup and forwarding. It consists of three parts: a header field, a counter, and an action table. The header field contains most of the identifiers from the link layer, network layer, and transport layer, used as matching conditions to match corresponding traffic; the counter is used to count the number of packets matched by each flow table; and the action table is used to guide the matched traffic to the next step. Figure 3 This is a schematic diagram of the OpenFlow flow table. Figure 3 As shown, an OVS virtual switch can store n flow tables, each matched according to priority. When a packet enters the OVS switch, it is first matched in flow table 0 according to priority. If a match is found in flow table 0, the corresponding action is executed. If no match is found in flow table 0, the default flow table is used to proceed to the next flow table, 1, until a match is found.

[0084] In this embodiment, the virtual network interface card identifier is used as the matching field of the second flow table, and the virtual machine label assignment is used as the action field. The second flow table adapted to the virtualization scenario solves the defects of OpenFlow firewall in related technologies that cannot recognize virtual machine logical labels and is difficult to adapt to virtualization packet traffic control. Combined with the first flow table, it meets the security control requirements of data centers for physical networks and virtualized networks, and improves the firewall's recognition capability in cloud computing virtualization scenarios.

[0085] In addition to assigning virtual machine labels to packets as the action field of this second flow table, the action field for transferring to the next-level second flow table can also be written into the aforementioned second flow table. In the next-level second flow table, the virtual network interface card identifier is determined as the matching field of the next-level second flow table, and the preset packet processing action (such as packet forwarding, packet dropping, etc.) is determined as the action field of the next-level second flow table.

[0086] This creates a multi-level, progressive virtualized traffic matching domain processing architecture. Virtual machine traffic is filtered and labeled through the upper-level second flow table, and then the process jumps to the lower-level second flow table to match based on the same virtual network interface card identifier and perform processing actions such as packet forwarding and packet dropping, which further improves the scalability and adaptability of firewall policies.

[0087] Assume virtual machines A and B are tagged "Production Environment A", and each virtual machine A and virtual machine B has a virtual network interface card (NIC). When creating a firewall policy, the virtual machine tag "Production Environment A" is assigned to packets whose source or destination is virtual machine A and virtual machine B. For example, if a virtual machine tag is detected in the policy during distribution, the second flow table distributed in table 0 using the method provided in this application embodiment is as follows: table=0,priority=100,dl_src=mac_a,actions=write_metadata:0x1000,goto_table:1 table=0,priority=100,dl_src=mac_b,actions=write_metadata:0x1000,goto_table:1 The function of the second flow table mentioned above is to assign the virtual machine label of production environment A to the packet when the packet matches the virtual network interface identifier (i.e., the virtual network interface identifier of virtual machine A or virtual machine B). Specifically, it writes 0x1000 corresponding to production environment A into the OVS metadata.

[0088] Taking “table=0, priority=100, dl_src=mac_a, actions=write_metadata:0x1000, goto_table:1” as an example, a traffic matching rule with a priority of 100 is configured in flow table 0. When the source MAC address of the packet is mac_a (i.e., the virtual network card identifier of virtual machine A), it is determined that the packet meets the traffic matching rule. At this time, the virtual machine label 0x1000 (corresponding to production environment A), which is used to identify the virtual machine group, is written into the metadata of the open virtual switch to complete the marking of the virtual machine group to which the packet belongs. In addition, it jumps to the next level flow table 1 to continue to complete the subsequent matching verification and packet processing.

[0089] Different virtual machine tags can generate different hexadecimal tags. Metadata is a crucial internal communication field in the OVS flow table. It is not contained in the raw data packet itself, but is generated and used by OVS when processing packets. Its core function is to pass context information between flow tables, thereby guiding the packet forwarding and processing logic.

[0090] In the next level, the second type of flow table table 1, the following flow table can be added to match the metadata, and then perform the corresponding packet forwarding / dropping actions: table=1,priority=100,metadata=0x1000,actions=normal / drop Figure 4 This diagram illustrates how flow tables are used to assign labels to virtual machines. When generating the second flow table corresponding to a firewall policy, the process first determines whether the firewall policy contains a virtual machine label. If not, the flow table is generated directly using a service group, IP address group, or a normal method. If so, the virtual network interface identifier is used as the matching field, and writing the virtual machine label into the metadata of the open virtual switch is used as the action field to generate the second-level flow table, completing the virtual machine labeling processing of the packets. After labeling processing is complete, the process jumps to the next level of the second flow table. In the next level of the second flow table, the virtual machine label carried in the metadata is used as the matching basis. If a match is successful, the corresponding packet processing action is executed. This yields various second flow tables, which are then sent to the switch to configure firewall policies containing virtual machine labels.

[0091] The method provided in this application addresses the issue of flow tables not supporting virtual machine labels by implementing label support through multi-level flow tables and a metadata-based label delivery method. When a virtual machine uses an OVS bridge, it is assigned an OVS port, also known as a virtual network interface card (NIC). Each OVS port has a MAC address. When a virtual machine group label A is created in the virtualization platform, label A contains two virtual machines, m and n. m and n each have a virtual NIC with MAC addresses mac_m and mac_n respectively, and are under the same virtual switch. In the preceding flow table, such as table0, the virtual NICs mac_m and mac_n of virtual machines m and n are matched. Table0 serves as a classification table, identifying the identity label of the virtual machines and setting the same metadata using write_metadata. The matched traffic is then forwarded to the next-level flow table, table1. In table1, different labels are distinguished by matching metadata values, thereby enabling traffic forwarding or corresponding operations for the upper-layer unified virtual machine group.

[0092] The above mainly describes the solution provided by the embodiments of this application from a methodological perspective.

[0093] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0094] This application also provides a flow table generation apparatus for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0095] This embodiment provides a flow table generation device, such as... Figure 5 As shown, it includes: Module 501 is used to obtain the firewall policy corresponding to the flow table to be generated. The generation module 502 is used to determine all packet matching conditions in the firewall policy and the condition type corresponding to each packet matching condition when the firewall policy contains at least one packet matching condition; and to generate a first flow table corresponding to the firewall policy based on each packet matching condition and the condition type corresponding to each packet matching condition. If the firewall policy includes a virtual machine tag, determine the virtual network interface identifier corresponding to the virtual machine tag in the firewall policy; based on the virtual network interface identifier and the virtual machine tag, generate a second flow table corresponding to the firewall policy, wherein the virtual machine tag is used to indicate the group to which the virtual machine belongs.

[0096] The apparatus provided in this application, when a firewall policy contains multi-dimensional and multi-type packet matching conditions, generates a corresponding first flow table based on each packet matching condition and its corresponding type. This overcomes the limitation of firewall flow tables in related technologies, which can only match a single field. It supports packet matching with multiple packet matching conditions, improving the flexibility and convenience of firewall policy configuration, meeting security needs in different scenarios, and increasing firewall configuration efficiency. Simultaneously, for firewall policies containing virtual machine tags, a second flow table is generated by associating the virtual machine tag with the corresponding virtual network interface identifier. This achieves traffic identification and control based on virtual machine tags (i.e., virtual machine groups), overcoming the shortcomings of related technologies in adapting to virtualization tag matching, and adapting to cloud computing and virtualization networking scenarios. In this application embodiment, the first and second flow tables simultaneously handle physical packet filtering and virtual network group control, improving the network security protection performance of data centers.

[0097] In one possible implementation, the generation module 502 is specifically used to determine the total number of packet matching condition types in the firewall policy based on the condition types corresponding to all packet matching conditions. Based on the first message matching condition, the condition type of the first message matching condition, and the total number of types, a first type of subflow table corresponding to the first message matching condition is generated, wherein the first message matching condition is one of at least one message matching conditions. After generating the first type of sub-flow tables corresponding to all message matching conditions, the first flow table is determined based on the first type of sub-flow tables corresponding to all message matching conditions.

[0098] In one possible implementation, the generation module 502 is specifically used to generate a marking instruction based on the total number of types and the condition type of the first message matching condition. The marking instruction is used to mark the condition type corresponding to the first message matching condition as successfully matched after the message matches the first message matching condition. The first message matching condition is used as the matching field, and the marking instruction is used as the action field to generate the first type of subflow table corresponding to the first message matching condition.

[0099] In one possible implementation, the generation module 502 is further configured to, before generating the first type of sub-flow table corresponding to the first message matching condition, assign multi-dimensional matching identifiers to all message matching conditions based on the first message matching condition, the condition type of the first message matching condition, and the total number of types, and assign a corresponding sequence number to each condition type. Specifically, the generation module 502 is configured to determine the sequence number corresponding to the first message matching condition based on the condition type of the first message matching condition. A marking instruction is generated based on the multi-dimensional matching identifier, the total number of types, and the sequence number corresponding to the matching condition of the first message.

[0100] In one possible implementation, the generation module 502 is specifically used to generate a second type of subflow table by taking all condition types as the matching field and the message passage as the action field. The first flow table is determined based on each first-class subflow table and the second-class subflow table.

[0101] In one possible implementation, the generation module 502 is specifically used to determine the virtual network interface identifier as the matching field of the second flow table; The virtual machine label will be assigned to the message and determined as the action field of the second flow table; The second flow table is generated based on the matching field and action field of the second flow table.

[0102] In one possible implementation, the generation module 502 is specifically used to determine the action domain of the second flow table by writing the virtual machine tag into the metadata of the open virtual switch.

[0103] For a description of the features in the embodiment corresponding to the flow table generation device, please refer to the relevant description in the embodiment corresponding to the flow table generation method, which will not be repeated here.

[0104] Embodiments of this application also provide an electronic device, such as... Figure 6 As shown, it includes a memory 10 and a processor 20. The memory 10 stores a computer program, and the processor 20 is configured to run the computer program to perform the steps in any of the above-described flow table generation method embodiments.

[0105] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described flow table generation method embodiments at runtime.

[0106] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0107] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described flow table generation method embodiments.

[0108] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in any of the above-described flow table generation method embodiments.

[0109] Any of the components, modules, units, parts, methods, and operations described herein can be implemented using software, firmware, hardware (e.g., fixed logic circuitry), manual processing, or any combination thereof. Alternatively or additionally, any functionality described herein can be executed at least in part by one or more hardware logic components, such as, but not limited to, a central processing unit (CPU), a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), an application-specific standard product (ASSP), a system-on-a-chip (SoC), a complex programmable logic device (CPLD), a microprocessor (MCU), etc. The terms "system," "computing device," or "apparatus" as used herein encompass various means, devices, and machines for processing data, including, for example, one or more programmable processors, computers, SoCs, or combinations thereof. The apparatus may also include code that creates an execution environment for the computer program in question, such as code constituting processor firmware, a protocol stack, a database management system, an operating system, a cross-platform runtime environment, a virtual machine, or one or more combinations thereof. The aforementioned computer program (also known as a program, software, software application, app, script, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and can be deployed in any form, including as a standalone program or as a module, component, subroutine, object, or other unit suitable for a computing environment.

[0110] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0111] The foregoing has provided a detailed description of the flow table generation method, apparatus, electronic device, and medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only intended to aid in understanding the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A method for generating flow tables, characterized in that, The method includes: Obtain the firewall policy corresponding to the flow table to be generated; If the firewall policy contains at least one packet matching condition, determine all packet matching conditions in the firewall policy and the condition type corresponding to each packet matching condition; based on each packet matching condition and the condition type corresponding to each packet matching condition, generate a first flow table corresponding to the firewall policy. If the firewall policy includes a virtual machine tag, determine the virtual network interface identifier corresponding to the virtual machine tag in the firewall policy; based on the virtual network interface identifier and the virtual machine tag, generate a second flow table corresponding to the firewall policy, wherein the virtual machine tag is used to indicate the group to which the virtual machine belongs.

2. The method according to claim 1, characterized in that, The step of generating a first flow table corresponding to the firewall policy based on each of the packet matching conditions and the condition type corresponding to each of the packet matching conditions includes: Based on the condition types corresponding to all the aforementioned packet matching conditions, determine the total number of packet matching condition types in the firewall policy; Based on the first message matching condition, the condition type of the first message matching condition, and the total number of the types, a first type of sub-flow table corresponding to the first message matching condition is generated, wherein the first message matching condition is one of the at least one message matching conditions. After generating the first type of sub-flow table corresponding to all the packet matching conditions, the first flow table is determined based on the first type of sub-flow table corresponding to all the packet matching conditions.

3. The method according to claim 2, characterized in that, The step of generating a first type of sub-flow table corresponding to the first message matching condition based on the first message matching condition, the condition type of the first message matching condition, and the total number of the types includes: Based on the total number of the types and the condition type of the first message matching condition, a marking instruction is generated, wherein the marking instruction is used to mark the condition type corresponding to the first message matching condition as successfully matched after the message matches the first message matching condition; The first message matching condition is used as the matching field, and the marking instruction is used as the action field to generate a first type of sub-flow table corresponding to the first message matching condition.

4. The method according to claim 3, characterized in that, Before generating the first type of sub-flow table corresponding to the first message matching condition based on the first message matching condition, the condition type of the first message matching condition, and the total number of the types, the method further includes: Assign a multi-dimensional matching identifier to all the message matching conditions, and assign a corresponding sequence number to each of the condition types; The condition type based on the total number of the types and the matching conditions of the first message generates a marking instruction, including: Based on the condition type of the first message matching condition, determine the sequence number corresponding to the first message matching condition; The marking instruction is generated based on the multi-dimensional matching identifier, the total number of types, and the sequence number corresponding to the matching condition of the first message.

5. The method according to any one of claims 2-4, characterized in that, After generating the first type of sub-flow table corresponding to all the packet matching conditions, determining the first flow table based on the first type of sub-flow table corresponding to all the packet matching conditions includes: The second type of subflow table is generated by taking all the conditions that are successfully matched as the matching field and taking the message passage as the action field. The first flow table is determined based on each of the first type of subflow table and the second type of subflow table.

6. The method according to claim 1, characterized in that, The step of generating a second flow table corresponding to the firewall policy based on the virtual network interface identifier and the virtual machine tag includes: The virtual network interface card identifier is determined as the matching field of the second flow table; The virtual machine label assigned to the message will be determined as the action field of the second flow table; The second flow table is generated based on the matching field and action field of the second flow table.

7. The method according to claim 6, characterized in that, The step of assigning the virtual machine label to the message as the action field of the second flow table includes: The metadata written into the open virtual switch with the virtual machine tag is determined as the action field of the second flow table.

8. A flow table generation device, characterized in that, The device includes: The acquisition module is used to acquire the firewall policy corresponding to the flow table to be generated. A generation module is configured to, when the firewall policy contains at least one packet matching condition, determine all packet matching conditions in the firewall policy and the condition type corresponding to each packet matching condition; and generate a first flow table corresponding to the firewall policy based on each packet matching condition and the condition type corresponding to each packet matching condition. If the firewall policy includes a virtual machine tag, determine the virtual network interface identifier corresponding to the virtual machine tag in the firewall policy; based on the virtual network interface identifier and the virtual machine tag, generate a second flow table corresponding to the firewall policy, wherein the virtual machine tag is used to indicate the group to which the virtual machine belongs.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the flow table generation method as described in any one of claims 1-7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, it implements the steps of the flow table generation method as described in any one of claims 1-7.

Images