Data flow mirroring method and apparatus

Abstract

This application relates to the field of NFV technology and discloses a data flow mirroring method and apparatus. The method includes: an NFVO receives an instantiation request from an OSS / BSS; and obtains NSD information based on the instantiation request, the NSD information including first mirroring object information, the first mirroring object information describing information for creating a first mirroring object, the first mirroring object being for mirroring a first data flow; and the NFVO requests a VIM to create a first mirroring object based on the first mirroring object information, the first mirroring object being associated with a first mirroring service for analyzing the mirrored data flow of the first data flow. According to the method, the NSD information is extended to include the mirroring object information. In this way, the first data flow that needs to be mirrored can be specified in the design state, and a mirroring object is created during NS deployment, thereby implementing an end-to-end data flow mirroring service.

Description

Technical Field

[0001] Cross-reference to Related Applications This application claims priority to Chinese Patent Application No. 202011187447.6, titled "DATA FLOW MIRRORING METHOD AND APPARATUS", filed with the China National Intellectual Property Administration on October 29, 2020, which is incorporated herein by reference in its entirety.

[0002] This application relates to the field of NFV technology, and particularly to data flow mirroring methods and apparatuses.

Background Art

[0003] Network function virtualization (NFV) refers to using common hardware devices with the functions of dedicated devices in a conventional network in combination with virtualization technology to reduce the high costs incurred during the deployment of dedicated devices. Software is not bound to dedicated hardware, so network device functions no longer depend on dedicated hardware. Additionally, due to the characteristics of cloud computing, resources can be fully and flexibly shared to implement the rapid development and deployment of new services, and automatic deployment, scaling, failure isolation, self-repair, etc. are performed according to actual service requirements. NFV technology has gained great recognition in the field of data centers (DCs), especially in the field of carrier data centers, and has been continuously promoted by carriers.

[0004] Currently, data flow mirroring services can be applied to data centers to mirror a specified data flow to obtain a mirrored data flow for further analysis. Data flow mirroring services play a very important role in many fields (such as the field of service security risk insights and the field of system security vulnerabilities).

[0005] However, how to implement data flow mirroring services using an NFV architecture needs further consideration. [Overview of the project] [Means for solving the problem]

[0006] With this in mind, this application provides a data flow mirroring method and apparatus for implementing an end-to-end (i.e., OSS / BSS to VIM) data flow mirroring service.

[0007] According to a first aspect, one embodiment of the present application provides a data flow mirroring method. The method may be performed by an NFVO. In the method, the NFVO receives an instantiation request from an OSS / BSS, the instantiation request requests the instantiation of an NS, obtains NS description NSD information based on the instantiation request, the NSD information includes first mirroring object information, the first mirroring object information describes information for creating a first mirroring object, the first mirroring object is for mirroring a first data flow, and based on the first mirroring object information, requests a virtualization infrastructure manager VIM to create a first mirroring object, the first mirroring object is associated with a first mirroring service, and the first mirroring service is for analyzing the mirrored data flow of the first data flow.

[0008] According to the method described above, the current NSD information is extended to include mirroring object information (optionally, the extended NSD information may further include mirroring service information). In this way, the data flows that need to be mirrored can be specified in the design state, and the mirroring objects (and mirroring services) are automatically created during NS deployment, thereby enabling the implementation of an end-to-end (i.e., OSS / BSS to VIM) data flow mirroring service.

[0009] In one possible design, the first data flow is an inbound data flow to a first virtualized network function (VNF) contained within the NS, or an outbound data flow from the first VNF.

[0010] In one possible design, the NSD information further includes first mirroring service information, the first mirroring service information describes information for creating a first mirroring service, and the method further includes the step of requesting VIM to create a first mirroring service based on the first mirroring service information.

[0011] In one possible design, the first mirroring service information includes the name of the first mirroring service, and the step of requesting VIM to create the first mirroring service based on the first mirroring service information includes: sending a query request to VIM, the query request including the name of the first mirroring service; receiving a query response from VIM, the query response including address information of the analysis system corresponding to the first mirroring service; and sending a first creation request to VIM, the first creation request requesting the creation of the first mirroring service, the first creation request including the name of the first mirroring service and address information of the analysis system corresponding to the first mirroring service.

[0012] According to the method described above, the NSD information may not include the address information of the analysis system corresponding to the first mirroring service, but VIM assigns the address information of the analysis system corresponding to the first mirroring service. Therefore, security can be improved.

[0013] In one possible design, the first mirroring object information includes an identifier for an external connection point of the first VNF, and the step of requesting the VIM to create a first mirroring object based on the first mirroring object information includes the step of obtaining port information corresponding to the external connection point from the VNFM based on the identifier for the external connection point, and the step of sending a second creation request to the VIM, wherein the second creation request requests the creation of the first mirroring object and the second creation request includes port information.

[0014] In one possible design, the first mirroring object information further includes mirroring location information. The method further includes the step of obtaining security group rule information corresponding to an external connection point from the VNFM, where the mirroring location information is a connection point, the second creation request further includes security group rule information, and the first data flow is a data flow compliant with the security group rule information.

[0015] According to the method described above, security group rules can be defined for connection points in VNFD information, in other words, only data flows that meet specific requirements can flow to or from a specified connection point. Therefore, when the mirroring location information is a connection point, security group rule information can be obtained, and the data flows to be mirrored are filtered based on the security group rules.

[0016] In one possible design, the method further includes the step of obtaining policy information, a second creation request further containing the policy information, and a first data flow being a data flow compliant with the policy information.

[0017] In one possible design, the method further includes: receiving a first update request from OSS / BSS, the first update request requesting to update a first mirroring service to a second mirroring service, the first update request including information for a second mirroring service, the second mirroring service information describing information for creating a second mirroring service; requesting VIM to delete the first mirroring service in accordance with the first update request; and, after it has been determined that VIM has successfully deleted the first mirroring service, requesting VIM to create a second mirroring service based on the second mirroring service information.

[0018] In one possible design, the method further includes the steps of: requesting VIM to delete a first mirroring object associated with a first mirroring service in accordance with a first update request; updating the first mirroring object information to second mirroring object information, after it has been determined that VIM has successfully deleted the first mirroring object, wherein the second mirroring object information describes information for creating a second mirroring object, the second mirroring object is for mirroring a first data flow, and the second mirroring object is associated with a second mirroring service; and requesting VIM to create a second mirroring object based on the second mirroring object information.

[0019] In one possible design, the method includes the steps of: receiving a second update request from OSS / BSS, the second update request requesting the addition of a third mirroring object, the second update request including information for the third mirroring object, the third mirroring object information describing information for creating the third mirroring object, the third mirroring object being for mirroring a second data flow, and the third mirroring object being associated with a second mirroring service; and further including the step of requesting VIM to create the third mirroring object based on the information for the third mirroring object, wherein the second data flow may be a different data flow from the first data flow.

[0020] In one possible design, the method includes the steps of: receiving a third update request from OSS / BSS, the third update request requesting that the first mirroring object be updated to a fourth mirroring object, the third update request including information for the fourth mirroring object, the fourth mirroring object information describing information for creating the fourth mirroring object, the fourth mirroring object being for mirroring the third data flow, and the fourth mirroring object being associated with the first mirroring service; requesting VIM to delete the first mirroring object in accordance with the third update request; and, after it has been determined that VIM has successfully deleted the first mirroring object, requesting VIM to create a fourth mirroring object based on the information for the fourth mirroring object, wherein the third data flow and the first data flow may be different data flows.

[0021] In one possible design, the method includes the steps of: receiving a fourth update request from OSS / BSS, wherein the fourth update request requests the addition of a fifth mirroring object, the fourth update request includes information for the fifth mirroring object, the fifth mirroring object information describes information for creating the fifth mirroring object, the fifth mirroring object is for mirroring the fourth data flow, and the fifth mirroring object is associated with the first mirroring service; and further including the step of requesting VIM to create the fifth mirroring object based on the fifth mirroring object information, wherein the fourth data flow and the first data flow are different data flows.

[0022] According to a second aspect, one embodiment of the present application provides a data flow mirroring device. The data flow mirroring device may be an NFVO or a chip located inside an NFVO. The data flow mirroring device has a function that implements the first aspect. For example, the data flow mirroring device includes a corresponding module, unit, or means for performing the steps in the first aspect. The function, unit, or means may be implemented by using software, by using hardware, or by hardware running the corresponding software.

[0023] In one possible implementation, the dataflow mirroring device includes a processing unit and a communication unit. The communication unit may be configured to receive and transmit signals to implement communication between the dataflow mirroring device and another device. For example, the communication unit may be configured to receive instantiation requests from OSS / BSS. The processing unit may be configured to perform some of the internal operations of the dataflow mirroring device. The functions performed by the processing unit and the communication unit may correspond to the operations in the first embodiment.

[0024] In one possible design, the dataflow mirroring device includes a processor, which may further include transceivers. The transceivers are configured to receive and transmit signals, and the processor executes program instructions to complete the method in any possible design or implementation of the first embodiment. The dataflow mirroring device may further include one or more memories. The memories are coupled to the processor and may store the necessary computer programs or instructions to implement the functions in the first embodiment. The processor may execute the computer programs or instructions stored in the memories. Once the computer programs or instructions are executed, the dataflow mirroring device is enabled to implement the method in any possible design or implementation of the first embodiment.

[0025] In one possible design, the dataflow mirroring device includes a processor, which may be configured to be coupled to memory. The memory may store the necessary computer programs or instructions for implementing the functions in the first embodiment. The processor may execute the computer programs or instructions stored in memory. Once the computer programs or instructions are executed, the dataflow mirroring device is enabled to implement the methods in any possible design or implementation of the first embodiment.

[0026] In one possible design, the dataflow mirroring device includes a processor and an interface circuit, the processor being configured to communicate with another device by using the interface circuit and to perform the method in any possible design or implementation of the first embodiment.

[0027] In the second aspect, it should be understood that the processor can be implemented by using hardware or software. When the processor is implemented by using hardware, the processor may be a logic circuit, an integrated circuit, etc. When the processor is implemented by using software, the processor may be a general-purpose processor and is implemented by reading software code stored in a memory. In addition, there may be one or more processors and one or more memories. The memory may be integrated with the processor or the memory and the processor may be arranged separately. In a specific implementation process, the memory and the processor may be integrated on one chip or arranged on different chips. The type of the memory and the manner in which the memory and the processor are arranged are not limited in the embodiments of the present application.

[0028] According to a third aspect, an embodiment of the present application provides a data flow mirroring system. The system includes the data flow mirroring device (for example, NFVO) described in the second aspect and may further include an OSS / BSS and a VIM. The OSS / BSS is configured to send an instantiation request to the NFVO and request that the instantiation request instantiate an NS. The NFVO is configured to receive the instantiation request, obtain NS description NSD information based on the instantiation request, the NSD information includes first mirroring object information, the first mirroring object information describes information for creating a first mirroring object, the first mirroring object is for mirroring a first data flow, and based on the first mirroring object information, request the VIM to create the first mirroring object. The VIM is configured to create the first mirroring object, the first mirroring object is associated with a first mirroring service, and the first mirroring service is for analyzing the mirrored data flow of the first data flow.

[0029] In one possible design, the OSS / BSS is further configured to upload NSD information to the NFVO.

[0030] In one possible design, the NSD information further includes first mirroring service information, and the first mirroring service information describes information for creating a first mirroring service. The NFVO is further configured to request the VIM to create the first mirroring service based on the first mirroring service information. The VIM is further configured to create the first mirroring service.

[0031] According to a fourth aspect, the present application provides a computer-readable storage medium. The storage medium stores a computer program. When the computer program is executed, the method in any possible design of the first aspect is implemented.

[0032] According to a fifth aspect, the present application provides a computer program product. When a computer reads and executes the computer program product, the computer is enabled to perform the method according to any possible design of the first aspect.

[0033] These aspects or other aspects of the present application will become clearer upon reading the following description of the embodiments.

Brief Description of Drawings

[0034] [Figure 1] It is a schematic diagram of an NFV architecture according to an embodiment of the present application. [Figure 2] It is a schematic flowchart of NS instantiation according to an embodiment of the present application. [Figure 3] It is a diagram of two examples in which an NS includes two VNFs according to an embodiment of the present application. [Figure 4] It is an example diagram of the deployment of a data flow mirroring service in a data center according to an embodiment of the present application. [Figure 5]These are example diagrams of an NSD model before improvement and an improved NSD model according to one embodiment of this application. [Figure 6] This is a schematic flowchart corresponding to the data flow mirroring method according to Embodiment 1 of this application. [Figure 7] This is a schematic flowchart corresponding to the data flow mirroring method according to Embodiment 2 of this application. [Figure 8] This is a schematic flowchart corresponding to the data flow mirroring method according to Embodiment 3 of this application. [Figure 9] This is a possible schematic block diagram of a device according to one embodiment of the present application. [Figure 10] This is a schematic diagram of the structure of a data flow mirroring device according to one embodiment of this application. [Modes for carrying out the invention]

[0035] The following describes the technical solutions in the embodiments of this application with reference to the accompanying drawings.

[0036] Figure 1 is a schematic diagram of an NFV architecture according to one embodiment of the present application. The NFV architecture may implement multiple networks, such as a local area network (LAN), an Internet Protocol (IP) network, or an evolved packet core (EPC) network. As shown in Figure 1, the NFV architecture may include an NFV management and orchestration system (NFV-MANO) 110, an NFV infrastructure (NFVI) 150, multiple virtualized network functions (VNFs) 140, multiple element management (EM) modules 130, and one or more operation support systems / business support systems (OSS / BSS) 120. NFV-MANO110 may include an NFV orchestrator (NFVO) 111, one or more VNF managers (VNFM) 112, and one or more VIMs 113.

[0037] The following describes each part of the NFV architecture individually.

[0038] (1) NFVO111 is primarily responsible for lifecycle management processing in virtualization services, allocation and scheduling of virtual resources in virtual infrastructure and NFVI. NFVO111 can communicate with one or more VNFM112 to execute resource-related requests, send configuration information to VNFM104, and collect status information from VNF140. In addition, NFVO111 can also communicate with VIM113 to allocate and / or reserve resources and exchange configuration and status information of virtualized hardware resources.

[0039] (2) VNFM112 is primarily responsible for the lifecycle management of one or more VNFs, such as instantiating, updating, querying, scaling, or terminating VNF140. VNFM112 can communicate with VNF140 to complete the lifecycle management of the VNF and exchange configuration and status information. An NFV architecture may have multiple VNFMs, each responsible for the lifecycle management of different types of VNFs.

[0040] (3) VIM113 is primarily responsible for controlling and managing the interaction between VNF140 and the compute hardware 1521, memory hardware 1522, network hardware 1523, virtual compute resources 1511 (e.g., virtual machines (VMs)), virtual memory 1512, and virtual network 1513. For example, VIM113 performs resource management functions, including managing infrastructure resources, allocating them (e.g., adding resources to virtual containers), and performing functions (e.g., collecting NFVI failure information). VNFM112 can communicate with VIM113 to request resource allocation and exchange configuration and status information of virtualized hardware resources.

[0041] (4) The NFVI 150 may include a hardware resource layer including compute hardware 1521, storage hardware 1522, and network hardware 1523, a virtualization layer, and a virtual resource layer including virtual compute resources 1511, virtual storage 1512, and a virtual network 1513. The compute hardware 1521 in the hardware resource layer may be a dedicated processor or a general-purpose processor configured to provide processing and compute functions, such as a central process unit (CPU). The storage hardware 1522 is configured to provide storage capacity, such as magnetic disks or network-attached storage (NAS). The network hardware 1523 may be a switch, router, and / or other network device. The virtualization layer in the NFVI 150 is configured to abstract the hardware resources in the hardware resource layer and decouple the VNF 140 from the physical layer to which the hardware resources belong, in order to provide virtual resources to the VNF. The virtual resource layer may include virtual compute resources 1511, virtual storage 1512, and a virtual network 1513. The virtual computing resources 1511 and virtual memory 1512 may be provided to the VNF 140 in the form of virtual machines or other virtual containers, respectively. For example, one or more virtual machines may form one VNF 140. The virtualization layer forms a virtual network 1513 by abstracting the network hardware 1523. The virtual network 1513 is configured to enable communication between multiple virtual machines or between multiple virtual containers of a different type having VNFs.

[0042] (5) EM130 is a system for configuring and managing devices in conventional telecommunications systems. In the NFV architecture, EM130 can also be further configured to configure and manage VNFs and initiate lifecycle management operations such as instantiation of new VNFs for VNFM112.

[0043] (6) OSS / BSS120 supports a variety of end-to-end telecommunications services. For example, management functions supported by OSS include network configuration, service delivery, and fault management, while BSS handles order, payment, and revenue processing, supporting product management, order management, revenue management, and customer management.

[0044] (7) VNF140 corresponds to physical network functions (PNFs) in conventional non-virtualized networks, such as evolved packet core (EPC) nodes (e.g., mobility management entities (MMEs), serving gateways (SGWs), or public data network gateways (PGWs)). The functional behavior and state of a network function are independent of whether or not that network function is virtualized. Technical requirements for NFV expect VNFs and PNFs to have the same functional behavior and the same external interfaces.

[0045] Based on the NFV architecture shown in Figure 1, Figure 2 is a schematic flowchart of the instantiation of a network service (NS). An NS may be, for example, an EPC network service, and one NS may contain several VNFs, also called virtualized network elements. As shown in Figure 2, the procedure may include the following steps.

[0046] S201:OSS / BSS uploads the pre-designed network service descriptor (NSD) information of the NS to the NFVO.

[0047] For example, NSD information may also be called an NS deployment template. NSD information may include an NSD identifier (NSD ID), topology structure information for describing the NS, and description information (VNF descriptor, VNFD) for each VNF contained in the NS. In the topology structure information, network service virtual link descriptor (NSVLD) information (or VLD information) may be for describing virtual links (virtual links, VLs) between VNFs. VNFD information may also be called a VNF deployment template. The number of VNFD entries in the NSD information is the same as the number of VNFs contained in the NS; in other words, each VNF corresponds to one VNFD. Each VNFD describes information about the VNF corresponding to the VNFD. Each VNF contains one or more virtualization deployment units (VDUs). Therefore, the VNFD information corresponding to each VNF may include information about one or more VDUs. Information about one VDU may include resource information for at least one VM that makes up the VDU. For example, the resource information for each VM may include the number of central processing units (CPUs), CPU performance, memory size, bandwidth, storage size, and other VM information.

[0048] To more clearly explain the VLD information included in NSD information, the following provides an explanation by referring to two examples.

[0049] In Example 1, as shown in Figure 3(a), the NS includes two VNFs deployed in the same rack within the data center, namely VNF1 and VNF2. VNF1 and VNF2 communicate with each other via a switch (which may be a virtual or physical switch), in other words, VNF1 and VNF2 communicate with each other via a virtual local area network (VLAN). For simplicity of explanation, the VLAN may be marked as VLAN1. In this case, the NSD information of the NS includes VNFD information 1 corresponding to VNF1, VNFD information 2 corresponding to VNF2, and VLD information corresponding to VNF1 and VNF2. The VLD information may include information about the VLAN between VNF1 and VNF2 (i.e., VLAN1). Alternatively, since VNF1 and VNF2 are connected to the same VLAN, VNF1 and VNF2 may communicate with each other over a Layer 2 link. In this case, the VLD information may also include information about the Layer 2 link within VLAN1.

[0050] As shown in Figure 3(b), unlike Example 1, in Example 2, the upper-layer routing device of the switch connected to VNF1 and VNF2 may further assign Layer 3 links to VNF1 and VNF2. In this way, VNF1 and VNF3 can further communicate with each other based on the Layer 3 links assigned by the upper-layer routing device. Therefore, the VLD information may also include information about the Layer 3 links assigned to VNF1 and VNF2 by the upper-layer routing device.

[0051] S202:OSS / BSS sends a request message to the NFVO requesting it to create an NS instance identifier, and the request message may include the NSD identifier of the NS.

[0052] S203:NFVO returns a response message to OSS / BSS, which includes an NS instance identifier corresponding to the NSD identifier.

[0053] S204:OSS / BSS sends an instantiation request to NFVO, which requests the instantiation of NS, and the instantiation request may include an NS instance identifier.

[0054] S205: NFVO receives an instantiation request and retrieves the NSD information of the NS based on the NS instance identifier in the instantiation request and the correspondence between the NS instance identifier and the NSD identifier.

[0055] S206: NFVO requests VIM to create a virtual link based on the VLD information in the NSD information.

[0056] For example, if the VLD information contains only Layer 2 links, the NFVO will ask the VIM to create only Layer 2 links. If the VLD information also contains Layer 3 links, the NFVO will need to create the Layer 2 links first, and then the Layer 3 links.

[0057] S207: NFVO requests VNFM to instantiate a VNF based on the VNFD information in the NSD information.

[0058] Here, the NFVO may send a VNF instantiation request to the VNFM. The VNF instantiation request may include an identifier for the VNF to be instantiated and information about the Layer 2 and / or Layer 3 links connected to each VNF.

[0059] S208: The VNFM completes the VNF instantiation process and sends feedback to the NFVO indicating that the VNF was successfully instantiated.

[0060] After receiving the VNF instantiation request, the VNFM determines the virtual machine resources, storage resources, network resources, etc. for each VNF based on the VNFD corresponding to each VNF identifier, completes the connection between the VNF and the Layer 2 and / or Layer 3 links based on information about the Layer 2 and / or Layer 3 links connected to the VNF, completes the VNF instantiation process, and then feeds back a message to the NFVO indicating that the VNF has been successfully instantiated.

[0061] S209: NFVO feeds back a message to OSS / BSS indicating that the NS was successfully instantiated.

[0062] Here, after receiving a message from VNFM indicating that the VNF has been successfully instantiated, NFVO confirms that the NS instantiation process is complete and feeds back a message to OSS / BSS indicating that the NS has been successfully instantiated.

[0063] Figure 4 is an example diagram of the deployment of a data flow mirroring service in a data center according to one embodiment of the present application. As shown in Figure 4, the data center includes a plurality of virtual machines (e.g., virtual machine 1a, virtual machine 1b, ..., virtual machine 4a, and virtual machine 4b), a plurality of virtual switches (e.g., virtual switch 1, virtual switch 2, ..., and virtual switch 4), a plurality of switches (e.g., switch 1, switch 2, and switch 3), a data center gateway, etc. The plurality of virtual machines may be deployed on different servers. For example, virtual machines 1a and 1b are deployed on a server in rack 1, virtual machines 2a and 2b are deployed on a server in rack 2, virtual machines 3a and 3b are deployed on a server in rack 3, and virtual machines 4a and 4b are deployed on a server in rack 4. The virtual switches are configured to provide network services to the virtual machines. For example, virtual switch 1 may be configured to provide network services to virtual machines 1a and 1b, virtual switch 2 to provide network services to virtual machines 2a and 2b, virtual switch 3 to provide network services to virtual machines 3a and 3b, and virtual switch 4 to provide network services to virtual machines 4a and 4b. The switches may be configured to connect servers on different racks. For example, switch 1 may be configured to connect servers on rack 1 and rack 2, and switch 2 may be configured to connect servers on rack 3 and rack 4. In a particular implementation, the data center may include switches in multiple layers. The data center gateway may be the exit gateway device of the data center. Furthermore, an analysis system may be deployed in the data center and configured to analyze the received mirrored data flow (e.g., mirrored data flow of data flow to / from virtual machines, data flow within virtual switches, or mirrored data flow of data flow within switches).For example, the analysis system may analyze the flow rate and type of the mirrored data flow. This is not particularly limited. For example, in this embodiment of the present application, the deployment location of the analysis system within the data center is not limited. A communication interface may be located between the analysis system and the virtual switch, or between the analysis system and the switch. This is not particularly limited.

[0064] Based on the example diagram in Figure 4, the following describes one possible implementation of a data flow mirroring service. Specifically, a data center may have multiple platforms for managing virtual resources. Using OpenStack as an example, to implement a data flow mirroring service, OpenStack defines tapflow (or dataflow) and tapservice (or dataservice) for data flow mirroring management. tapflow is for mirroring data flows and retrieving the mirrored data flows. For example, tapflow information describes the information for creating a tapflow. For example, tapflow information may include the name of the tapflow, the name of the tapservice associated with the tapflow, and information used to specify the data flow that needs to be mirrored (e.g., virtual machine port information and flow direction information). tapservice is for analyzing the mirrored data flows. For example, tapservice information may include address information of the analysis system, and the address information of the analysis system may include IP address information or port information of the virtual machine (i.e., Analysis_VM) on which the analysis system is located. By defining tapflow and tapservice, a mirrored data flow of a specified data flow can be analyzed.

[0065] For example, if the inbound data flow to virtual machine 1 needs to be mirrored, tapflow could be defined as follows: {id:flow123, name: muscle_1, tapservice_id:service123,# Define a tapservice associated with tapflow# source_port:VM 1-port, position:PORT, direction: In. A tapservice can be defined as follows: {id:service123, name:service_1, port_id:Analysis_VM-port}.

[0066] The tapflow defines the virtual machine's port information (i.e., VM1-port), mirroring location information (i.e., PORT), and the direction of the data flow through the port (i.e., In). The tapservice associated with the tapflow defines the port information of the virtual machine where the analysis system is located (i.e., Analysis_VM-port). Therefore, by defining the tapflow and the tapservice associated with the tapflow, the mirrored data flow of the inbound data flow to virtual machine 1 can be sent to the analysis system for analysis.

[0067] From the above, it can be seen that most of the information related to the current operating interface defined by OpenStack and used to implement dataflow mirroring is instantiation information (i.e., deployment state information), such as virtual machine port information. Therefore, information is typically used for transmission between NFVO and VIM. For example, if an NS is instantiated by using the NS instantiation procedure shown in Figure 2, and then an inbound data flow to virtual machine 1 needs to be mirrored, NFVO may send tapflow information and tapservice information to VIM so that VIM can mirror the inbound data flow to virtual machine 1 based on the tapflow information and tapservice information. In other words, in the aforementioned implementation form, the dataflow mirroring service is mainly implemented in the deployment state, and the data flow that needs to be mirrored cannot be specified in the design state (NSD design), in other words, there is no end-to-end (i.e., OSS / BSS to VIM) solution for implementing the dataflow mirroring service.

[0068] Based on this, one embodiment of the present application provides a data flow mirroring method for implementing an end-to-end (i.e., OSS / BSS to VIM) data flow mirroring service. For example, the method provided in this embodiment of the present application may improve the NSD information. For example, in order to implement an end-to-end data flow mirroring service, the data flows that need to be mirrored may be specified in the NSD information.

[0069] It should be noted that the NS instantiation and service scenarios described in this embodiment of the present application are intended to more clearly illustrate the technical solutions in the embodiments of the present application and do not limit the technical solutions provided in the embodiments of the present application. With the evolution of network architectures and the emergence of new service scenarios, those skilled in the art will know that the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0070] The technical solutions provided in the embodiments of this application are described in detail below with reference to the accompanying drawings.

[0071] As described above, NSD information can be improved in this embodiment of the present application. The following describes specific implementations for improving NSD information with reference to concrete examples.

[0072] (1) NSD information before improvement (a) Figure 5 shows an example of the NSD model before improvement. The NSD model before improvement includes VNF1, VNF2, and VL_1 between VNF1 and VNF2. VNF1 is connected to VL_1 via an external connection point (Extcp) of VNF1 (e.g., Extcp_1), and VNF2 is connected to VL_1 via an external connection point of VNF2 (e.g., Extcp_2). In the case of the NSD model, the corresponding NSD information may include VNFD information corresponding to VNF1, VNFD information corresponding to VNF2, and description information of VL_1 between VNF1 and VNF2 (i.e., VLD information).

[0073] For example, the NSD information may further include NsVirtualLinkConnectivity information to describe the connection between the VNFs contained in the NS (i.e., VNF1 and VNF2) and VL_1. The connection can be understood as a connection relationship between the VNFs contained in the NS and Layer 2 links and / or Layer 3 links. For example, the connection relationship between the VNFs contained in the NS and Layer 2 links and / or Layer 3 links includes an identifier for the VNF's external connection point and information about the Layer 2 links and / or Layer 3 links connected to the external connection point. Below, the standards defined by the European Telecommunications Standards Institute (ETSI) for NFV technology are used as an example to describe the contents of the NsVirtualLinkConnectivity information. See Table 1. Table 1 includes two attribute pieces of information, virtualLinkConnectionInfo and constituentCpdId. virtualLinkConnectionInfo indicates information about VL_1, i.e., information about Layer 2 links and / or Layer 3 links, and constituentCpdId indicates information about the VNF's external connection point (which may be denoted as VnfExtCp).

[0074] [Table 1]

[0075] A candidate value for virtualLinkConnectionInfo is 1, which indicates that the VNF is connected to one VL. virtualLinkConnectionInfo may also contain the identifier (Id) of the VL file (virtualLinkProfile) (for example, the identifier may be the identifier from the VLD information mentioned above). constituentCpdId indicates the identifier of the CP connected to the VL, and the CP may be the external connection point of the VNF.

[0076] (2) Improved NSD information (b) Figure 5 is an example of an improved NSD model. Compared to the original NSD model, the improved NSD model keeps VNF1, VNF2, and VL_1 unchanged, and adds two model nodes: tapflow (e.g., tapflow_1 and tapflow_2) and tapservice. tapflow is defined where mirroring should occur. For example, tapflow_1 is defined between ExtCp1 of VNF1 and VL_1 to mirror data flow from VNF1 to VL_1 or from VL_1 to VNF1, and tapflow_2 is defined between ExtCp2 of VNF2 and VL_1 to mirror data flow from VNF2 to VL_1 or from VL_1 to VNF2. In the case of an NSD model, the corresponding NSD information may include VNFD information corresponding to VNF1, VNFD information corresponding to VNF2, and VL_1 description information between VNF1 and VNF2, and may further include mirroring object information and mirroring service information.

[0077] For example, mirroring object information may be tapflow information and describe information for creating a mirroring object (or tapflow). A mirroring object may be for mirroring a specified data flow. Creating a mirroring object may be understood as creating a task or process in VIM. One mirroring object may be associated with one mirroring service. Mirroring service information may be tapservice information and describe information for creating a mirroring service (or tapservice). A mirroring service is for analyzing the mirrored data flow of the data flow indicated by the mirroring object associated with the mirroring service. Creating a mirroring service may be understood as creating a task or process in VIM. One mirroring service may be associated with one or more mirroring objects. In this embodiment of the present application, an example is used in which the mirroring object is tapflow and the mirroring service is tapservice.

[0078] In one possible case (referred to as Case 1), the NSD information may include tapflow information and tapservice information. In this case, the tapflow information may include at least one of the following: the name of the tapflow, the flow direction information of the data flow, the name of the associated tapservice, policy information, mirroring location information, and an identifier of the external connection point. The tapservice information may include at least one of the name of the tapservice and the address information of the analysis system corresponding to the tapservice.

[0079] Table 2 shows an example of the contents included in tapflow information.

[0080] [Table 2]

[0081] In this embodiment of the present application, it should be noted that there may be multiple values ​​for the mirroring location information, for example, CP or VL as listed in Table 2. When the value of the mirroring location information is CP (wherein CP may be an external connection point of the VNF), it indicates that the tapflow information will mirror the data flow from the CP. In this case, security group rules may be defined for the CP in the VNFD file (i.e., only data flows that meet certain requirements may flow into or out of the CP), so when the value of the mirroring location information is CP, the data flows to be mirrored must be filtered according to the security group rules. When the value of the mirroring location information is VL, it indicates that the tapflow information will mirror the data flow from a VL connected to the CP. In this case, security group rules may not be considered, as they cannot be defined for the VL.

[0082] Table 3 shows an example of the contents included in tapservice information.

[0083] [Table 3]

[0084] In another possible case (referred to as Case 2), if the tapservice associated with tapflow is a tapservice that was created, for example, a tapservice created during the instantiation of another NS, then the NSD information may include tapflow information but not tapservice information. In this case, the tapflow information may include at least one of the following: the name of the tapflow, flow direction information, identifier of the associated tapservice, policy information, mirroring location information, and identifier of the external connection point.

[0085] In the two possible scenarios mentioned above, in one possible implementation, tapflow information within the NSD can be included in the NsVirtualLinkConnectivity information. In other words, the NsVirtualLinkConnectivity information can be extended. Table 4 shows an example of what is included in the extended NsVirtualLinkConnectivity information.

[0086] [Table 4]

[0087] Note that in Table 4, the value of tapflow can be 0, ..., N. When the value of tapflow is 0, it indicates that there is no data flow that needs to be mirrored between the VNF and VL. When the value of tapflow is N, it indicates that one or more tapflows can be created for the VNF and VL.

[0088] Based on the above description of improved NSD information, the following describes the procedure of the data flow mirroring method provided in the embodiments of this application.

[0089] The following explanatory process uses an example where the method is applied to the NFV architecture shown in Figure 1. In other words, below, OSS / BSS may be OSS / BSS120 shown in Figure 1, NFVO may be NFVO111 shown in Figure 1, and VIM may be VIM113 shown in Figure 1.

[0090] Embodiment 1 Figure 6 is a schematic flowchart corresponding to the data flow mirroring method according to Embodiment 1 of this application. As shown in Figure 6, the method includes the following steps.

[0091] S601:OSS / BSS sends an instantiation request to NFVO, which requests the instantiation of an NS, and the instantiation request may include an NS instance identifier.

[0092] S602: NFVO receives an instantiation request and retrieves the NSD information of the NS based on the NS instance identifier in the instantiation request.

[0093] Here, the NSD information includes first mirroring object information, the first mirroring object information describes the information for creating the first mirroring object, the first mirroring object is for mirroring the first data flow, and the first mirroring object may be associated with a first mirroring service.

[0094] For example, if the first mirroring service is a mirroring service that has not yet been created, the NSD information may further include information about the first mirroring service (corresponding to Example 1 above). The information about the first mirroring service describes the information needed to create the first mirroring service. In this case, S603 and S604 may be performed. If the first mirroring service is a mirroring service that has already been created, the NSD information does not need to include information about the first mirroring service (corresponding to Example 2 above). In this case, S603 and S604 may not be performed.

[0095] In this embodiment of the present application, after obtaining the NSD information of the NS, the NFVO may instantiate the NS based on the NSD information. NS instantiation may include S603 to S606 and may further include processes such as virtual link creation and VNF instantiation.

[0096] S603: NFVO requests VIM to create the first mirroring service based on the first mirroring service information.

[0097] S604: VIM creates the first mirroring service in accordance with the request from NFVO.

[0098] In one example, the first mirroring service information may include the name of the first mirroring service and the address information of the analysis system corresponding to the first mirroring service. In this case, the NFVO may send a first creation request to the VIM, which includes the name of the first mirroring service and the address information of the analysis system corresponding to the first mirroring service. Furthermore, the VIM may create the first mirroring service in accordance with the first creation request.

[0099] In another example, the first mirroring service information may include the name of the first mirroring service but not the address information of the analysis system corresponding to the first mirroring service. In this case, in one possible implementation, the NFVO may send a query request to the VIM, which includes the name of the first mirroring service; after receiving the query request, the VIM may assign an analysis system corresponding to the first mirroring service based on the query request and return a query response to the NFVO, which includes the address information of the analysis system corresponding to the first mirroring service; after receiving the query response, the NFVO may send a first creation request to the VIM, which includes the name of the first mirroring service and the address information of the analysis system corresponding to the first mirroring service; and further, the VIM may create the first mirroring service in accordance with the first creation request. In another possible implementation, the NFVO may send a first creation request to the VIM, which includes the name of the first mirroring service. After receiving the first creation request, the VIM may assign an analysis system corresponding to the first mirroring service based on the first creation request and create the first mirroring service based on the name of the first mirroring service and the address information of the analysis system corresponding to the first mirroring service. In the two implementations described above, the NSD information may not include the address information of the analysis system corresponding to the first mirroring service, but the VIM assigns the address information of the analysis system corresponding to the first mirroring service. Thus, security can be improved.In yet another possible implementation, the instantiation request may carry address information of the analysis system corresponding to the first mirroring service, and the NFVO may obtain the address information of the analysis system corresponding to the first mirroring service from the instantiation request and send a first creation request to the VIM, the first creation request including the name of the first mirroring service and the address information of the analysis system corresponding to the first mirroring service, and the VIM may further create the first mirroring service in accordance with the first creation request.

[0100] In addition, in the two examples described above, after creating the first mirroring service in accordance with the first creation request, VIM may send a first creation response to the NFVO. The first creation response indicates that the first mirroring service has been successfully created and may include an identifier assigned to the first mirroring service by VIM.

[0101] S605: NFVO requests VIM to create the first mirroring object based on the first mirroring object information.

[0102] S606: VIM creates the first mirroring object in accordance with the request from NFVO.

[0103] For example, the first data flow is an inbound data flow to or outbound data flow from the first VNF ​​contained in the NS. The first mirroring object information may include the name of the first mirroring object, the name (or identifier) ​​of the first mirroring service associated with the first mirroring object, and information used to specify the first data flow (e.g., flow direction information, policy information, and identifiers of the external connection points of the first VNF). Optionally, the first mirroring object information may further include mirroring location information. Note that when the NSD information does not include the first mirroring service information (which indicates that the first mirroring service is the mirroring service that was created), the first mirroring object information may include the identifier of the first mirroring service associated with the first mirroring object. When the NSD information includes information about a first mirroring service (indicating that the first mirroring service is a mirroring service that has not been created, in which case VIM has not assigned an identifier to the first mirroring service), the information about the first mirroring object may include the name of the first mirroring service associated with the first mirroring object.

[0104] The NFVO may obtain port information corresponding to the external connection point from the VNFM based on the identifier of the external connection point. In addition, when the mirroring location information is CP, the NFVO may obtain security group rule information corresponding to the external connection point of the first VNF ​​from the VNFM. Furthermore, the NFVO may send a second create request to the VIM. The second create request requests the creation of the first mirroring object and may include the name of the first mirroring object, the identifier of the first mirroring service associated with the first mirroring object, flow direction information, policy information, and port information. Furthermore, the VIM may create the first mirroring object in accordance with the second create request. Optionally, after creating the first mirroring object in accordance with the second create request, the VIM may send a second create response to the NFVO. The second create response indicates that the first mirroring object has been successfully created and may include the identifier assigned to the first mirroring object by the VIM.

[0105] In this embodiment of the present application, after the NS instantiation is complete, the mirroring object and / or mirroring service corresponding to the NS may be further updated.

[0106] In one possible update scenario (e.g., update scenario 1), after NS instantiation is complete, the first mirroring service may be updated to the second mirroring service. In this case, the method described above further includes the following steps:

[0107] S607:OSS / BSS sends a first update request to NFVO, which requests that the first mirroring service corresponding to NS be updated to the second mirroring service.

[0108] Here, the first update request may include an NS instance identifier and second mirroring service information, the second mirroring service information describing the information for creating the second mirroring service. For example, the second mirroring service information may include the name of the second mirroring service and may further include address information of the analysis system corresponding to the second mirroring service. The address information of the analysis system corresponding to the second mirroring service is different from the address information of the analysis system corresponding to the first mirroring service. The name of the second mirroring service is the same as the name of the first mirroring service. Furthermore, the NFVO may determine that the first update request is used to update the first mirroring service to the second mirroring service.

[0109] S608:NFVO requests VIM to update the first mirroring service to the second mirroring service in accordance with the first update request.

[0110] Specifically, the NFVO may request the VIM to delete the first mirroring service in accordance with the first update request. For example, the NFVO sends the first delete request to the VIM. The first delete request includes the identifier of the first mirroring service. Furthermore, the VIM may delete the first mirroring service in accordance with the first delete request and send the first delete response to the NFVO. The first delete response indicates that the first mirroring service has been successfully deleted. After the VIM has determined that the first mirroring service has been successfully deleted, the NFVO may request the VIM to create a second mirroring service based on the second mirroring service information. For specific implementation details of the step of requesting the creation of a second mirroring service, please refer to the description of the step of requesting the creation of a first mirroring service. Details will not be explained again here.

[0111] Furthermore, the NFVO may request the VIM to delete the mirroring object associated with the first mirroring service (e.g., the first mirroring object) in accordance with the first update request. For example, the NFVO may send a second delete request to the VIM. The second delete request includes the identifier of the first mirroring object. Furthermore, the VIM may delete the first mirroring object in accordance with the second delete request and send a second delete response to the NFVO. The second delete response indicates that the first mirroring object has been successfully deleted. After the VIM has determined that the first mirroring object has been successfully deleted, the NFVO may update the first mirroring object information with the second mirroring object information (for example, to obtain the second mirroring object information, the NFVO may update the name or identifier of the first mirroring service associated with the first mirroring object, which is included in the first mirroring object information, with the name or identifier of the second mirroring service). The second mirroring object information describes the information needed to create the second mirroring object, which mirrors the first data flow, and is associated with the second mirroring service. Furthermore, the NFVO may request the VIM to create the second mirroring object based on the second mirroring object information. For specific implementation details of the step of requesting the creation of the second mirroring object, please refer to the description of the step of requesting the creation of the first mirroring object. Details will not be explained again here.

[0112] After creating the second mirroring object and the second mirroring service in this manner, VIM may then send the mirrored data flow of the first data flow to the analysis system corresponding to the second mirroring service for analysis.

[0113] In the aforementioned update scenario 1, after S607 and S608 are performed, the method may further include the following steps.

[0114] S609:OSS / BSS sends a second update request to NFVO, which requests the addition of a third mirroring object.

[0115] Here, the second update request includes third mirroring object information, which describes the information for creating the third mirroring object, the third mirroring object is for mirroring the second data flow, and the third mirroring object is associated with the second mirroring service. For example, if the second data flow is an inbound data flow to or outbound data flow from the second VNF contained in the NS, the third mirroring object information may include the name of the third mirroring object, the name (or identifier) ​​of the second mirroring service associated with the third mirroring object, and information used to specify the second data flow (e.g., flow direction information, policy information, and identifier of the external connection point of the second VNF). Optionally, the third mirroring object information may further include mirroring location information.

[0116] S610: NFVO requests VIM to create a third mirroring object based on the information of the third mirroring object.

[0117] For specific implementation details of the step that requests the creation of a third mirroring object using NFVO, please refer to the explanation of the step that requests the creation of the first mirroring object. Further details will not be explained again here.

[0118] In another possible update scenario (e.g., update scenario 2), after the NS instantiation is complete, the first mirroring object may be updated to a fourth mirroring object. In this case, the method described above further includes the following steps:

[0119] S611:OSS / BSS sends a third update request to NFVO, which requests that the first mirroring object be updated to a fourth mirroring object.

[0120] Here, the third update request includes fourth mirroring object information, which describes the information for creating the fourth mirroring object, the fourth mirroring object is for mirroring the third data flow, and the fourth mirroring object may be associated with the first mirroring service. For example, if the third data flow is an inbound data flow to or outbound data flow from the third VNF contained in the NS, the fourth mirroring object information may include the name of the fourth mirroring object, the name (or identifier) ​​of the first mirroring service associated with the fourth mirroring object, and information for specifying the third data flow (e.g., flow direction information, policy information, and identifier of the external connection point of the third VNF). Optionally, the fourth mirroring object information may further include mirroring location information.

[0121] S612:NFVO requests VIM to update the first mirroring object to the fourth mirroring object in accordance with the third update request.

[0122] Specifically, the NFVO may request the VIM to delete the first mirroring object, and after the VIM determines that it has successfully deleted the first mirroring object, it may request the VIM to create a fourth mirroring object based on the information of the fourth mirroring object.

[0123] It should be noted that the two possible update scenarios described above are used as examples to illustrate the update procedure for completing NS instantiation. The solution in this embodiment of the present application may also be applicable to another possible update scenario, e.g., update scenario 3, in which a fifth mirroring object is added. The fifth mirroring object may be associated with the first mirroring service. Further details are not described.

[0124] According to the method described above, the current NSD information is extended to include mirroring object information (the extended NSD information may further include mirroring service information). In this way, the data flows that need to be mirrored can be specified in the design state, and the mirroring objects (and mirroring services) are automatically created during NS deployment, thereby enabling the implementation of an end-to-end (i.e., OSS / BSS to VIM) data flow mirroring service.

[0125] The following describes the data flow mirroring method provided in this embodiment of the present application with reference to specific examples.

[0126] Embodiment 2 Figure 7 is a schematic flowchart corresponding to the data flow mirroring method according to Embodiment 2 of this application. As shown in Figure 7, the method includes the following steps.

[0127] S701:OSS / BSS sends an instantiation request to NFVO, and the instantiation request asks to instantiate NS.

[0128] S702: NFVO receives an instantiation request and retrieves the NSD information of the NS based on the instantiation request.

[0129] For example, NSD information may include VLD information and VNFD information, and may further include tapflow information (e.g., tapflow_1 information and tapflow_2 information) and tapservice information (e.g., tapservice_1 information).

[0130] For details on the contents of tapflow_1 information, please refer to Table 5.

[0131] [Table 5]

[0132] The data flow that needs to be mirrored and is specified by the tapflow_1 information is the inbound data flow from VNF1 to ExtCp_1.

[0133] For details on the contents of tapflow_2 information, please refer to Table 6.

[0134] [Table 6]

[0135] The data flow that needs to be mirrored, as specified by the tapflow_2 information, is the outbound data flow from the IP address 10.1.1.2 of ExtCp_2 on VNF2.

[0136] For details on the contents of tapservice_1, please refer to Table 7.

[0137] [Table 7]

[0138] S703: NFVO requests VIM to create a corresponding virtual link based on the VLD information contained in the NSD (i.e., the description information of VL_1).

[0139] S704: NFVO sends creation request 1 to VIM based on the tapservice_1 information contained in NSD, and creation request 1 requests the creation of tapservice_1.

[0140] Here, creation request 1 may include the name tapservice_1.

[0141] S705: VIM creates tapservice_1 according to creation request 1 and sends creation response 1 to NFVO, creation response 1 indicating that tapservice_1 has been successfully created.

[0142] Here, the creation response 1 may include an identifier assigned to tapservice_1 by VIM.

[0143] S706: NFVO sends a VNF instantiation request to VNFM based on the VNFD information contained in the NSD information.

[0144] S707: VNFM completes VNF instantiation based on VNFD information.

[0145] For example, in the case of VNF1, the instantiation process for VNF1 includes requesting VIM to create the corresponding port information on VL-1 (e.g., port1) for VNF1's external connection point (ExtCp_1), and establishing a connection to ExtCp_1 via port1 in order to connect VNF1 to the VL-1 network instance. In the case of VNF2, the instantiation process for VNF2 includes requesting VIM to create the corresponding port information on VL-1 (e.g., port2) for VNF2's external connection point (ExtCp_2), and establishing a connection to ExtCp_2 via port2 in order to connect VNF2 to the VL-1 network instance.

[0146] S708: VNFM returns a VNF instantiation response to NFVO, which indicates that VNF ​​instantiation is complete.

[0147] S709: The NFVO checks whether tapflow information is included based on the NsVirtualLinkConnectivity information contained in the NSD. If the NFVO determines that tapflow information (e.g., tapflow_1 information and tapflow_2 information) is included, it performs S710 to S713.

[0148] S710: NFVO determines creation request 2 based on the tapflow_1 information, sends creation request 2 to VIM, and creation request 2 requests the creation of tapflow_1.

[0149] S711: VIM receives creation request 2, creates tapflow_1 according to creation request 2, returns creation response 2 to NFVO, creation response 2 indicates that tapflow_1 has been successfully created, and creation response 2 may include an identifier assigned to tapflow_1 by VIM.

[0150] Specifically, the NFVO's decision to create request 2 based on tapflow_1 information may include (1) the NFVO obtaining port information (i.e., port1) corresponding to the external connection point from the VNFM based on the identifier of the external connection point (i.e., ExtCp_1) in the tapflow_1 information. For example, the NFVO sends a request to the VNFM to obtain port information. The request includes the identifier of the external connection point. Furthermore, after receiving the request, the VNFM may send a response to the NFVO. The response includes port information corresponding to the external connection point. (2) If the NFVO determines that the Tapflow_1 information includes mirroring location information and the mirroring location information is a connection point, the NFVO may obtain security group rule information corresponding to the external connection point from the VNFM. For example, the security group rule information is direction:ingress;protocol:TCP;port_range_min:16;port_range_max:65535. This security group rule information requests entry into ExtCp_1 and indicates that only data flows using the TCP protocol and service ports numbered 16-65535 can enter ExtCp_1. Thus, creation request 2 may include security group rule information and port information, and may further include the name of tapflow_1, flow direction information, and the identifier of the associated tapservice. In addition, since tapflow_1 information does not include policy information, creation request 2 does not need to include policy information.

[0151] S712: NFVO determines creation request 3 based on the tapflow_2 information, sends creation request 3 to VIM, and creation request 3 requests the creation of tapflow_2.

[0152] S713: VIM receives creation request 3, creates tapflow_2 according to creation request 3, returns creation response 3 to NFVO, creation response 3 indicates that tapflow_2 has been successfully created, and creation response 3 may include an identifier assigned to tapflow_2 by VIM.

[0153] Specifically, the NFVO's decision to create request 3 based on tapflow_2 information may include (1) the NFVO obtaining port information (i.e., port2) corresponding to the external connection point from the VNFM based on the identifier of the external connection point (i.e., ExtCp_2) in the tapflow_2 information. (2) If the NFVO determines that the tapflow_2 information includes mirroring location information, but the mirroring location information is VL, the NFVO does not need to obtain security group rule information in this case. Thus, the second creation request may include port information and may further include the name of tapflow_2, flow direction information, and the identifier of the associated tapservice. In addition, since the tapflow_2 information includes policy information, creation request 3 may further include policy information.

[0154] S714: NFVO sends an instantiation response to OSS / BSS, which indicates that NS instantiation is complete.

[0155] It should be noted that Embodiment 1 provides an explanation by using an example in which the NSD information includes tapflow information (e.g., tapflow_1 information and tapflow_2 information) and tapservice information (e.g., tapservice_1 information). If tapservice_1 associated with tapflow_1 and tapflow_2 is the created tapservice, the NSD information does not need to include tapservice_1 information. In this case, steps S704 and S705 may not be performed.

[0156] Based on the NS instantiation procedure described in Embodiment 2, the following describes possible update procedures after NS instantiation with reference to Embodiment 3.

[0157] Embodiment 3 Figure 8 is a schematic flowchart corresponding to the data flow mirroring method according to Embodiment 3 of this application. As shown in Figure 8, the method includes the following steps.

[0158] S801:OSS / BSS sends update request 1 to NFVO, which requests that tapservice_1 be updated to tapservice_2, and update request 1 may include an NS instance identifier and tapservice_2 information. The name of tapservice_2 included in the tapservice_2 information may be the same as the name of tapservice_1.

[0159] For details on the contents of tapservice_2 information, please refer to Table 8.

[0160] [Table 8]

[0161] S802: NFVO receives update request 1, sends delete request 1 to VIM based on update request 1, and delete request 1 requests that tapservice_1 be deleted.

[0162] Here, deletion request 1 may include the identifier tapservice_1.

[0163] S803: VIM receives deletion request 1, deletes tapservice_1 according to deletion request 1, returns deletion response 1 to NFVO, and deletion response 1 indicates that tapservice_1 has been successfully deleted.

[0164] S804: NFVO requests VIM to create tapservice_2 based on the tapservice_2 information.

[0165] For an implementation where the NFVO requests VIM to create tapservice_2, please refer to the implementation in Embodiment 1 where the NFVO requests VIM to create the first mirroring service. Further details will not be explained again.

[0166] S805: NFVO sends delete request 2 to VIM based on update request 1, and delete request 2 requests the deletion of tapflow_1 associated with tapservice_1.

[0167] Here, deletion request 2 may include the identifier tapflow_1.

[0168] S806: VIM receives deletion request 2, deletes tapflow_1 according to deletion request 2, and returns deletion response 2 to NFVO, which indicates that tapflow_1 was successfully deleted.

[0169] S807:NFVO updates the tapflow_1 information to the tapflow_3 information (i.e., updates the name of tapservice_1 in the tapflow_1 information to the name of tapservice_2), and requests VIM to create tapflow_3 based on the tapflow_3 information.

[0170] For details on the contents of tapflow_3 information, please refer to Table 9.

[0171] [Table 9]

[0172] For an implementation where NFVO requests VIM to create tapflow_3 based on tapflow_3 information, please refer to the implementation in Embodiment 1 where NFVO requests VIM to create a first mirroring object. Further details will not be explained again.

[0173] S808: NFVO sends delete request 3 to VIM based on update request 1, and delete request 3 requests the deletion of tapflow_2 associated with tapservice_1.

[0174] Here, deletion request 3 may include the identifier tapflow_2.

[0175] S809: VIM receives deletion request 3, deletes tapflow_2 according to deletion request 3, and returns deletion response 3 to NFVO, which indicates that tapflow_2 was successfully deleted.

[0176] S810:NFVO updates the tapflow_2 information to the tapflow_4 information (i.e., updates the name of tapservice_1 in the tapflow_2 information to the identifier of tapservice_2), and requests VIM to create tapflow_4 based on the tapflow_4 information.

[0177] For details on the contents of tapflow_4 information, please refer to Table 10.

[0178] [Table 10]

[0179] For an implementation where NFVO requests VIM to create tapflow_4 based on tapflow_4 information, please refer to the implementation in Embodiment 1 where NFVO requests VIM to create a first mirroring object. Further details will not be explained again.

[0180] S811:OSS / BSS sends update request 2 to NFVO, update request 2 requests the addition of tapflow_5, update request 2 includes the NS instance identifier and tapflow_5 information.

[0181] For details on the contents of tapflow_5 information, please refer to Table 11.

[0182] [Table 11]

[0183] The tapflow_5 information states that the data flow that needs to be mirrored is the outbound data flow from ExtCp_1 of VNF1, and that tapflow_5 is associated with the newly established tapservice_2.

[0184] S812: After receiving update request 2, NFVO requests VIM to create tapflow_5 based on the tapflow_5 information.

[0185] Specifically, the tapflow_5 information includes mirroring location information, and the mirroring location information is determined to be a connection point. Therefore, the NFVO may obtain security group rule information corresponding to the external connection point from the VNFM. For example, the security group rule information is direction:outgress;protocol:TCP;port_range_min:16;port_range_max:65535. This security group rule information requests that data flows leave ExtCp_1 and indicates that only data flows using the TCP protocol and service ports numbered 16-65535 can be sent. In addition, the NFVO may further obtain port information corresponding to ExtCp_1 (i.e., port1). Furthermore, the NFVO may request the VIM to create tapflow_5 based on the security group rule information, port information, and other information (see Embodiment 1 for details).

[0186] Regarding Embodiments 1 to 3 described above, please note that the step numbers in the flowcharts described in Embodiments 1 to 3 are merely examples of execution procedures and do not constitute a limitation on the execution order of the steps. In the embodiments of this application, there is no strict execution order between steps that are not chronologically dependent on each other. In addition, not all steps shown in the flowchart are mandatory steps, and some steps may be added to or removed from the flowchart based on actual requirements.

[0187] The above primarily describes the solutions provided in the embodiments of this application from the perspective of device-to-device interaction. It will be understood that, in order to implement the aforementioned functions, each device may include a corresponding hardware structure and / or software module for implementing each function. Those skilled in the art will readily understand that, in embodiments of this application, the example units and algorithmic steps described with reference to the embodiments disclosed herein can be implemented by hardware, or by a combination of hardware and computer software. Whether a function is performed by hardware or by hardware driven by computer software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use various methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this application.

[0188] In embodiments of this application, each device may be divided into functional units based on the method examples described above. For example, functional units may be obtained by division based on corresponding functions, or two or more functions may be integrated into one functional unit. The integrated unit may be implemented in hardware form or in the form of a software functional unit.

[0189] When an integrated unit is used, Figure 9 is a possible exemplary block diagram of an apparatus according to one embodiment of the present application. As shown in Figure 9, the apparatus 900 may include a processing unit 902 and a communication unit 903. The processing unit 902 is configured to control and manage the operation of the apparatus 900. The communication unit 903 is configured to support communication between the apparatus 900 and another device. Optionally, the communication unit 903, also known as a transceiver unit, may include a receiving unit and / or a transmitting unit configured to perform receiving and transmitting operations, respectively. The apparatus 900 may further include a storage unit 901 configured to store program code and / or data of the apparatus 900.

[0190] The device 900 may be an NFVO in the embodiments described above. The processing unit 902 may assist the device 900 in performing the NFVO operations in the method example described above. Alternatively, the processing unit 902 may primarily perform the internal operations of the NFVO in the method example, and the communication unit 903 may support communication between the device 900 and another device.

[0191] Specifically, in one embodiment, the communication unit 903 is configured to receive an instantiation request from the operation support system / business support system OSS / BSS, and the instantiation request requests the instantiation of a network service NS. The processing unit 902 is configured to obtain NS description NSD information based on the instantiation request, and the NSD information includes first mirroring object information, the first mirroring object information describes information for creating a first mirroring object, and the first mirroring object is for mirroring a first data flow. The communication unit 903 is further configured to request the virtualization infrastructure manager VIM to create a first mirroring object based on the first mirroring object information, and the first mirroring object is associated with a first mirroring service, and the first mirroring service is for analyzing the mirrored data flow of the first data flow.

[0192] In one possible design, the first data flow is an inbound data flow to a first VNF ​​contained within the NS, or an outbound data flow from the first VNF.

[0193] In one possible design, the NSD information further includes first mirroring service information, which describes information for creating a first mirroring service. The communication unit 903 is further configured to request the VIM to create a first mirroring service based on the first mirroring service information.

[0194] In one possible design, the first mirroring service information includes the name of the first mirroring service. The communication unit 903 is particularly configured to send a query request to the VIM, the query request including the name of the first mirroring service; receive a query response from the VIM, the query response including address information of the analysis system corresponding to the first mirroring service; send a first creation request to the VIM, the first creation request requesting the creation of the first mirroring service, the first creation request including the name of the first mirroring service and address information of the analysis system corresponding to the first mirroring service.

[0195] In one possible design, the first mirroring object information includes an identifier for the external connection point of the first VNF. The communication unit 903 is specifically configured to obtain port information corresponding to the external connection point from the VNFM based on the identifier of the external connection point, and to send a second creation request to the VIM, which requests the creation of the first mirroring object, and the second creation request includes port information.

[0196] In one possible design, the first mirroring object information further includes mirroring location information. The communication unit 903 is further configured such that, when the mirroring location information is a connection point, it obtains security group rule information corresponding to the external connection point from the VNFM, and the second creation request further includes security group rule information, and the first data flow is a data flow compliant with the security group rule information.

[0197] In one possible design, the communication unit 903 is further configured such that it obtains policy information, a second creation request further includes policy information, and the first data flow is a data flow compliant with the policy information.

[0198] In one possible design, the communication unit 903 is further configured to receive a first update request from OSS / BSS, the first update request requests that the first mirroring service be updated to a second mirroring service, the first update request includes second mirroring service information, the second mirroring service information describes information for creating the second mirroring service, the communication unit 903 requests VIM to delete the first mirroring service in accordance with the first update request, and the processing unit 902, after determining that VIM has successfully deleted the first mirroring service, requests VIM to create the second mirroring service based on the second mirroring service information.

[0199] In one possible design, the communication unit 903 is further configured to request the VIM to delete the first mirroring object associated with the first mirroring service in accordance with a first update request. After the processing unit 902 determines that the VIM has successfully deleted the first mirroring object, it updates the first mirroring object information to second mirroring object information, the second mirroring object information describes information for creating a second mirroring object, the second mirroring object is for mirroring the first data flow, and the second mirroring object is associated with a second mirroring service. Based on the second mirroring object information, the communication unit 903 is further configured to request the VIM to create a second mirroring object.

[0200] In one possible design, the communication unit 903 is further configured to receive a second update request from OSS / BSS, the second update request requests the addition of a third mirroring object, the second update request includes information about the third mirroring object, the third mirroring object information describes the information for creating the third mirroring object, the third mirroring object is for mirroring the second data flow, the third mirroring object is associated with the second mirroring service, and based on the third mirroring object information, it requests VIM to create the third mirroring object.

[0201] In one possible design, the communication unit 903 is further configured to receive a third update request from OSS / BSS, the third update request requests that the first mirroring object be updated to a fourth mirroring object, the third update request includes information for the fourth mirroring object, the fourth mirroring object information describes information for creating the fourth mirroring object, the fourth mirroring object is for mirroring the third data flow, the fourth mirroring object is associated with the first mirroring service, and in accordance with the third update request, it requests VIM to delete the first mirroring object, and after the processing unit 902 determines that VIM has successfully deleted the first mirroring object, it requests VIM to create a fourth mirroring object based on the fourth mirroring object information.

[0202] It should be understood that the division of a device into units is merely a logical functional division. In actual implementations, all or some of the units may be integrated into a single physical entity or physically separated. In addition, all units within the device may be implemented in a form in which processing elements invoke software, or in a hardware form, or some units may be implemented in a form in which processing elements invoke software, and some units may be implemented in a hardware form. For example, each unit may be a separately located processing element, or it may be integrated into the device's chip for implementation. In addition, each unit may, alternatively, be stored in memory in the form of a program to be invoked by the device's processing element to perform the unit's function. In addition, all or some of the units may be integrated or implemented independently. The processing element as used herein may be called a processor, or it may be an integrated circuit having signal processing capabilities. In the implementation process, the operation in the aforementioned method or the aforementioned units may be implemented by using hardware integrated logic circuits within the processor element, or in a form in which the processing element invokes software.

[0203] In one example, a unit in any of the aforementioned devices may be one or more integrated circuits configured to implement the method described above, such as one or more application-specific integrated circuits (ASICs), one or more digital signal processors (DSPs), one or more field programmable gate arrays (FPGAs), or a combination of at least two of these forms of integrated circuits. In another example, when a unit in a device may be implemented in a manner in which a processing element schedules a program, the processing element may be a processor, such as a central processing unit (CPU), or another processor capable of calling a program. In yet another example, the unit may be implemented as an integrated system-on-a-chip (SOC).

[0204] The aforementioned unit configured to receive is an interface circuit of the device and is configured to receive signals from another device. For example, when the device is implemented in the form of a chip, the receiving unit is of the chip and is an interface circuit configured to receive signals from another chip or device. The aforementioned unit configured to transmit is an interface circuit of the device and is configured to transmit signals to another device. For example, when the device is implemented in the form of a chip, the transmitting unit is of the chip and is an interface circuit configured to transmit signals to another chip or device.

[0205] Figure 10 shows a data flow mirroring device 1000 according to one embodiment of the present application. The data flow mirroring device 1000 may also be an NFVO in the embodiments shown in Figures 6 to 8, and can implement the functions of the NFVO in the manner provided in the embodiments of the present application. Alternatively, the data flow mirroring device 1000 may be a device that can assist the NFVO in implementing the functions of the NFVO in the manner provided in the embodiments of the present application. The data flow mirroring device 1000 may also be a chip system. In this embodiment of the present application, the chip system may include a chip, or it may include a chip and other discrete components.

[0206] The data flow mirroring device 1000 may further include at least one memory 1030 configured to store program instructions and / or data. The memory 1030 is coupled to the processor 1020. The coupling in this embodiment of the application may be an indirect coupling or communication connection between devices, units, or modules, and may be in an electrical, mechanical, or other form, and is used for information exchange between devices, units, or modules. The processor 1020 can cooperate with the memory 1030. The processor 1020 can execute program instructions stored in the memory 1030. At least one of the at least one memory may be included in the processor.

[0207] The data flow mirroring device 1000 may further include a communication interface 1010 configured to communicate with another device via a transmission medium, so that devices within the data flow mirroring device 1000 can communicate with another device. For example, the other device may be a control device. The processor 1020 may transmit and receive data via the communication interface 1010.

[0208] In this embodiment of the present application, the specific connection medium between the communication interface 1010, the processor 1020, and the memory 1030 is not limited. In this embodiment of the present application, the memory 1030, the processor 1020, and the communication interface 1010 are connected to each other using the bus 1040 in Figure 10. The bus is represented in Figure 10 by the use of a thick line. The connection methods between other components are merely illustrative examples and are not limited thereto. Buses can be classified as address buses, data buses, control buses, etc. For ease of representation, only one thick line is used to represent buses in Figure 10, but this does not mean that there is only one bus or only one type of bus.

[0209] In this embodiment of the present application, the processor 1020 may be a general-purpose processor, a digital signal processor, an application-specific integrated circuit, a field-programmable gate array or another programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component that can implement or perform the methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps in the methods disclosed with reference to the embodiments of the present application may be performed directly by the hardware processor or by using a combination of hardware and software modules within the processor.

[0210] In this embodiment of the present application, the memory 1030 may be non-volatile memory, such as a hard disk drive (HDD) or solid-state drive (SSD), or volatile memory, such as random-access memory (RAM). The memory may be any other medium that can be used to hold or store expected program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited to such other medium. Alternatively, the memory in this embodiment of the present application may be a circuit or any other device that can implement a storage function and is configured to store program instructions and / or data.

[0211] One embodiment of this application further provides a computer-readable storage medium. The storage medium stores a computer program. When the computer program is executed, a method is implemented that is performed by NFVO in the embodiments shown in Figures 6 to 8.

[0212] One embodiment of this application further provides a computer program product. When a computer reads and executes the computer program product, the computer is enabled to perform the method performed by NFVO in the embodiments shown in Figures 6 to 8.

[0213] One embodiment of this application provides a chip system. The chip system includes a processor, which may further include memory, and is configured to implement the functionality of the NFVO in the aforementioned method. The chip system may include a chip, or it may include a chip and other discrete components.

[0214] One embodiment of this application provides a data flow mirroring system. The system includes the aforementioned NFVO and another device, the other device may include at least one of OSS / BSS, VIM, and VNFM.

[0215] In embodiments of this application, “at least one” means one or more, and “multiple” means two or more. “And / or” describes the relationship between the related subjects and indicates that three relationships may exist. For example, A and / or B may mean that only A exists, both A and B exist, and only B exists, and A and B may each be singular or plural. The letter “ / ” generally indicates that the related subjects are in an “or” relationship. “At least one of the following items” or similar expressions indicate any combination of items, including a single item or any combination of multiple items. For example, “at least one of A, B, and C” includes A, B, C, AB, AC, BC, or ABC. In addition, unless otherwise specified, ordinal numbers such as “first” and “second” as referred to in embodiments of this application are used to distinguish multiple subjects and are not used to limit the order, chronological order, priority, or importance of multiple subjects.

[0216] Those skilled in the art will understand that embodiments of this application may be provided as methods, systems, or computer program products. Accordingly, this application may take the form of hardware-only embodiments, software-only embodiments, or embodiments having a combination of software and hardware. In addition, this application may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, magnetic disk memory, CD-ROM, optical memory, etc.) that includes computer-usable program code.

[0217] This application is described with reference to flowcharts and / or block diagrams of the methods, devices (systems), and computer program products described herein. It should be understood that computer program instructions may be used to implement each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams. These computer program instructions may be provided by a general-purpose computer, a dedicated computer, an embedded processor, or a processor of another programmable data processing device to create a machine such that a procedure executed by the processor of the computer or another programmable data processing device creates a device for implementing one or more instructions in the flowchart and / or one or more blocks in the block diagram.

[0218] These computer program instructions may, alternatively, be stored in computer-readable memory, which can instruct a computer or another programmable data processing device to operate in a particular manner, such that the instructions stored in computer-readable memory create artifacts including an instruction unit. The instruction unit implements a particular function in one or more steps in a flowchart and / or one or more blocks in a block diagram.

[0219] These computer program instructions may, alternatively, be loaded onto a computer or another programmable data processing device so that a series of operations and steps are performed on the computer or another programmable device to generate computer implementation processing. Thus, instructions executed on the computer or another programmable device provide steps for implementing a particular function in one or more steps in a flowchart and / or one or more blocks in a block diagram.

[0220] It is clear that a person skilled in the art can make various modifications and alterations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and alterations of this application fall within the scope of the claims of this application and the equivalent art thereof, this application is intended to include such modifications and alterations. [Explanation of symbols]

[0221] 110 Network Function Virtualization (NFV) Management and Orchestration System (NFV-MANO) 111 NFV Orchestrator (NFVO) 112 VNF Manager (VNFM) 113 Virtualization Infrastructure Manager (VIM) 120 Operational support systems / Business support systems (OSS / BSS) 130 Device Management Module (EM) 140 Virtualized Network Function (VNF) 150 NFV Infrastructure (NFVI) 900 equipment 901 Memory Unit 902 Processing Unit 903 Communication Unit 1000 Dataflow Mirroring Devices 1010 Communication Interface 1020 Processor 1030 memory 1040 Bus 1511 Virtual Computing Resources 1512 Virtual Memory 1513 Virtual Network 1521 Computing Hardware 1522 Memory Hardware 1523 Network Hardware

Claims

1. A data flow mirroring method performed by a network function virtualization orchestrator, wherein the method is A step of receiving an instantiation request from an operation support system / business support system, wherein the instantiation request requests the instantiation of a network service, A step of obtaining network service description information based on the instantiation request, wherein the network service description information includes first mirroring object information, the first mirroring object information describes information for creating a first mirroring object, and the first mirroring object is for mirroring a first data flow. The steps include: requesting a virtualization infrastructure manager to create the first mirroring object based on the first mirroring object information, wherein the first mirroring object is associated with a first mirroring service; A data flow mirroring method wherein the network service description information is pre-configured to include the first mirroring object information when designing the network service.

2. The method according to claim 1, wherein the first data flow is an inbound data flow to a first virtualized network function included in the network service or an outbound data flow from the first virtualized network function.

3. The network service description information further includes first mirroring service information, and the first mirroring service information describes information for creating the first mirroring service. The aforementioned method, The method according to claim 1 or 2, further comprising the step of requesting the virtualization infrastructure manager to create the first mirroring service based on the first mirroring service information.

4. The first mirroring service information includes the name of the first mirroring service, The step of requesting the virtualization infrastructure manager to create the first mirroring service based on the first mirroring service information is: A step of sending a query request to the virtualization infrastructure manager, wherein the query request includes the name of the first mirroring service, A step of receiving a query response from the virtualization infrastructure manager, wherein the query response includes address information of an analysis system corresponding to the first mirroring service, The method according to claim 3, comprising the step of sending a first creation request to the virtualization infrastructure manager, wherein the first creation request requests the creation of the first mirroring service, and the first creation request includes the name of the first mirroring service and the address information of the analysis system corresponding to the first mirroring service.

5. The first data flow is an inbound data flow to a first virtualized network function included in the network service or an outbound data flow from the first virtualized network function. The first mirroring object information includes an identifier for the external connection point of the first virtualization network function, The step of requesting the virtualization infrastructure manager to create the first mirroring object based on the first mirroring object information is: The steps include obtaining port information corresponding to the external connection point from the virtualization network function manager based on the identifier of the external connection point, The method according to claim 3 or 4, comprising the step of sending a second creation request to the virtualization infrastructure manager, wherein the second creation request requests the creation of the first mirroring object and the second creation request includes the port information.

6. The aforementioned first mirroring object information further includes mirroring position information, The method, when the mirroring location information is a connection point, includes the step of obtaining security group rule information corresponding to the external connection point from the virtualization network function manager, the security group rule information indicating the requirements that the data flow must satisfy in order to enter or exit the external connection point. The method according to claim 5, wherein the second creation request further includes the security group rule information, and the first data flow is a data flow compliant with the security group rule information.

7. The method further includes the step of obtaining policy information, The method according to claim 5 or 6, wherein the second creation request further includes the policy information, and the first data flow is a data flow compliant with the policy information.

8. The aforementioned method, A step of receiving a first update request from the operation support system / business support system, wherein the first update request requests updating the first mirroring service to a second mirroring service, the first update request includes second mirroring service information, and the second mirroring service information describes information for creating the second mirroring service. The steps include requesting the virtualization infrastructure manager to delete the first mirroring service in accordance with the first update request, The method according to any one of claims 1 to 7, further comprising the step of requesting the virtualization infrastructure manager to create the second mirroring service based on the second mirroring service information, after the virtualization infrastructure manager has determined that it has successfully deleted the first mirroring service.

9. The aforementioned method, The steps include requesting the virtualization infrastructure manager to delete the first mirroring object associated with the first mirroring service in accordance with the first update request, The steps include: updating the first mirroring object information to second mirroring object information after determining that the virtualization infrastructure manager has successfully deleted the first mirroring object; wherein the second mirroring object information describes information for creating a second mirroring object, the second mirroring object is for mirroring the first data flow, and the second mirroring object is associated with the second mirroring service; The method according to claim 8, further comprising the step of requesting the virtualization infrastructure manager to create the second mirroring object based on the second mirroring object information.

10. The aforementioned method, A step of receiving a second update request from the aforementioned operation support system / business support system, wherein the second update request requests the addition of a third mirroring object, the second update request includes information for the third mirroring object, the third mirroring object information describes information for creating the third mirroring object, the third mirroring object is for mirroring a second data flow, and the third mirroring object is associated with the second mirroring service. The method according to claim 8 or 9, further comprising the step of requesting the virtualization infrastructure manager to create the third mirroring object based on the third mirroring object information.

11. The aforementioned method, A step of receiving a third update request from the operation support system / business support system, wherein the third update request requests updating the first mirroring object to a fourth mirroring object, the third update request includes information for the fourth mirroring object, the fourth mirroring object information describes information for creating the fourth mirroring object, the fourth mirroring object is for mirroring the third data flow, and the fourth mirroring object is associated with the first mirroring service. The steps include requesting the virtualization infrastructure manager to delete the first mirroring object in accordance with the third update request, The method according to any one of claims 1 to 7, further comprising the step of requesting the virtualization infrastructure manager to create the fourth mirroring object based on the fourth mirroring object information, after it has been determined that the virtualization infrastructure manager has successfully deleted the first mirroring object.

12. A data flow mirroring method, wherein the method is A step of sending an instantiation request from an operations support system / business support system to a network function virtualization orchestrator, wherein the instantiation request requests the instantiation of a network service; A step of obtaining network service description information based on the instantiation request, wherein the network service description information includes first mirroring object information, the first mirroring object information describes information for creating a first mirroring object, and the first mirroring object is for mirroring a first data flow. A step of requesting a virtualization infrastructure manager to create the first mirroring object based on the first mirroring object information, wherein the first mirroring object is associated with a first mirroring service. The process includes the step of creating the first mirroring object, A data flow mirroring method wherein the network service description information is pre-configured to include the first mirroring object information when designing the network service.

13. A data flow mirroring system, wherein the system is An operational support system / business support system configured to send instantiation requests to a network function virtualization orchestrator, wherein the instantiation request requests the instantiation of a network service, A network function virtualization orchestrator is configured to receive the instantiation request, acquire network service description information based on the instantiation request, the network service description information includes first mirroring object information, the first mirroring object information describes information for creating a first mirroring object, the first mirroring object is for mirroring a first data flow, and it requests the virtualization infrastructure manager to create the first mirroring object based on the first mirroring object information, The virtualization infrastructure manager is configured to create the first mirroring object, wherein the first mirroring object is associated with a first mirroring service. A data flow mirroring system in which the network service description information is pre-configured to include the first mirroring object information when designing the network service.

14. The system according to claim 13, wherein the operation support system / business support system is further configured to upload the network service description information to the network function virtualization orchestrator.

15. The network service description information includes first mirroring service information, and the first mirroring service information describes information for creating the first mirroring service. The network function virtualization orchestrator is further configured to request the virtualization infrastructure manager to create the first mirroring service based on the first mirroring service information. The system according to claim 13 or 14, wherein the virtualization infrastructure manager is further configured to create the first mirroring service.

16. A data flow mirroring device comprising a module configured to perform the method described in any one of claims 1 to 11.

17. A data flow mirroring device comprising a processor, wherein the processor is coupled to a memory, the memory stores a computer program, and the processor is configured to call the computer program in the memory so that the device performs the method according to any one of claims 1 to 11.

18. A data flow mirroring device, wherein the device is configured to perform the method described in any one of claims 1 to 11.

19. A computer-readable storage medium, wherein the storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 11 is implemented.

20. A computer program wherein, when a computer reads and executes the computer program, the computer is enabled to perform the method according to any one of claims 1 to 11.

Images