Firewall configuration method, nfvo, server, and storage medium

Abstract

Embodiments of the present application relate to the field of communications, and provide a firewall configuration method, a network function virtualization orchestrator, a server, and a computer readable storage medium. The firewall configuration method comprises: acquiring a cluster creation request, wherein the cluster creation request comprises network information of a control node of a target cluster to be created; on the basis of the network information of the control node, creating and configuring a first virtual firewall between the control node and a network function virtualization orchestrator; creating the control node, and creating one or more working nodes when the control node is created and enters a working state; and on the basis of network information of each created working node and the network information of the control node, creating and configuring a second virtual firewall between the control node and the working node.

Description

Firewall configuration method, NFVO, server and storage media

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to Chinese patent application No. 202310700836.1 filed on June 13, 2023, the contents of which are incorporated herein by reference in their entirety. Technical Field

[0003] The present application relates to the field of communication technology, and in particular to a firewall configuration method, a network function virtualization orchestrator, a server, and a computer-readable storage medium. Background Art

[0004] To ensure the security and reliability of telecommunications services, when deploying a cluster to carry these services, it's necessary to isolate the cluster's control nodes (Master nodes) and worker nodes (Node nodes). To achieve this, you need to configure a firewall before creating the cluster. However, the network information for the worker nodes can only be obtained after cluster creation. Without knowing the network information for the worker nodes during firewall configuration, communication between the control and worker nodes may fail.

[0005] To address this issue, during the initial cluster creation phase, the firewall is configured to fully open traffic, allowing communication between the control node and worker nodes. After the worker nodes are created, the firewall is modified to partially open traffic, achieving network isolation between the control node and worker nodes. However, fully opening the firewall poses security risks and requires multiple firewall configuration changes, which is tedious and error-prone. Therefore, how to accurately and quickly achieve network isolation between the control node and worker nodes is a pressing issue.

[0006] Public content

[0007] In a first aspect, an embodiment of the present application provides a firewall configuration method, comprising: obtaining a cluster creation request, the cluster creation request including network information of a control node of a target cluster to be created; creating and configuring a first virtual firewall between the control node and a network function virtualization orchestrator NFVO based on the network information of the control node; creating the control node, and when the control node is created and enters a working state, creating at least one working node; creating and configuring a second virtual firewall between the control node and the working node based on the network information of each of the created working nodes and the network information of the control node.

[0008] In a second aspect, an embodiment of the present application further provides a network function virtualization orchestrator NFVO, comprising: an acquisition module configured to acquire a cluster creation request, the cluster creation request including network information of a control node of a target cluster to be created; a firewall configuration module configured to create and configure a first virtual firewall between the control node and the NFVO based on the network information of the control node; a node creation module configured to create the control node and, when the control node is created and enters a working state, create at least one working node; the firewall configuration module is further configured to create and configure a second virtual firewall between the control node and the working node based on the network information of each of the created working nodes and the network information of the control node.

[0009] In a third aspect, an embodiment of the present application further provides a server comprising a processor, a memory, a computer program stored on the memory and executable by the processor, and a data bus for implementing connection and communication between the processor and the memory. When the computer program is executed by the processor, the processor implements the firewall configuration method as described in the first aspect.

[0010] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium storing at least one computer program, wherein the at least one computer program can be executed by at least one processor so that the at least one processor implements the firewall configuration method as described in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0012] FIG1 is a schematic block diagram of the structure of a server provided in an embodiment of the present application;

[0013] FIG2 is a flow chart of a firewall configuration method provided in an embodiment of the present application;

[0014] FIG3 is a schematic diagram of a deployment scenario of a control node and a working node in an embodiment of the present application;

[0015] FIG4 is a schematic diagram of the connection between the control node, the working node and the virtual firewall in an embodiment of the present application;

[0016] FIG5 is a flowchart showing some steps of a firewall configuration method provided in an embodiment of the present application;

[0017] FIG6 is another schematic diagram of the connection between the control node, the working node and the virtual firewall in an embodiment of the present application;

[0018] FIG7 is a flow chart of a firewall configuration method provided in an embodiment of the present application;

[0019] FIG8 is another schematic diagram of connections among the control node, the working node, and the virtual firewall in an embodiment of the present application;

[0020] FIG9 is a schematic block diagram of the structure of a network function virtualization orchestrator provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0022] The flowcharts shown in the accompanying drawings are for illustrative purposes only and do not necessarily include all contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may be decomposed, combined, or partially merged, so the actual execution order may vary depending on the actual situation.

[0023] It should be understood that the terms used in this specification are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in this specification and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms unless the context clearly indicates otherwise.

[0024] Currently, when initially creating a cluster, the firewall is configured to fully open traffic, allowing communication between the control node and worker nodes. After the worker nodes are created, the firewall is modified to partially open traffic, achieving network isolation between the control node and worker nodes. However, fully opening the firewall poses certain security risks and requires multiple firewall configuration changes, which is cumbersome and error-prone.

[0025] To solve the above problems, embodiments of the present application provide a firewall configuration method, a server, a Network Function Virtualization Orchestrator (NFVO), and a computer-readable storage medium. When a cluster creation request is obtained, the firewall configuration method creates and configures a first virtual firewall between the control node and the NFVO based on the network information of the control node carried in the cluster creation request, then creates the cluster's control node, and when the control node is created and enters the working state, creates at least one working node of the cluster, and finally, based on the network information of each created working node and the network information of the control node, creates and configures a second virtual firewall between the control node and the working node. In this way, there is no need to open all firewalls or modify the firewall configuration multiple times, and the network isolation between the control node and the working node can be automatically, quickly, and accurately achieved. In the embodiment of the present application, the server can be a single server or a server cluster consisting of multiple servers, and the embodiment of the present application does not specifically limit this.

[0026] The following describes some embodiments of the present application in detail with reference to the accompanying drawings. In the absence of conflict, the following embodiments and features of the embodiments may be combined with each other.

[0027] Please refer to FIG1 , which is a schematic block diagram of the structure of a server provided in an embodiment of the present application.

[0028] As shown in FIG1 , a server 100 includes a processor 101 and a memory 102 . The processor 101 and the memory 102 are connected via a bus 103 , which may be an I2C (Inter-Integrated Circuit) bus.

[0029] The processor 101 is configured to provide computing and control capabilities to support the operation of the entire server. The processor 101 can be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0030] The memory 102 may be a Flash chip, a read-only memory (ROM) disk, an optical disk, a USB flash drive, or a mobile hard disk.

[0031] Those skilled in the art will understand that the structure shown in FIG1 is merely a block diagram of a partial structure related to the embodiment of the present application, and does not constitute a limitation on the server to which the embodiment of the present application is applied. The actual server may include more or fewer components than shown in FIG1 , or combine certain components, or have a different arrangement of components.

[0032] The processor 101 is further configured to run a computer program stored in the memory 102 and implement the firewall configuration method provided in the embodiment of the present application when executing the computer program.

[0033] In some embodiments, the processor 101 is configured to run a computer program stored in a memory, and implement the following steps when executing the computer program: obtain a cluster creation request, the cluster creation request including network information of a control node of a target cluster to be created; create and configure a first virtual firewall between the control node and a network function virtualization orchestrator NFVO based on the network information of the control node; create the control node, and when the control node is created and enters a working state, create at least one working node; create and configure a second virtual firewall between the control node and the working node based on the network information of each of the created working nodes and the network information of the control node.

[0034] In some embodiments, when the processor 101 creates and configures a second virtual firewall between the control node and the working node based on the network information of each of the created working nodes and the network information of the control node, it can achieve: dividing each of the created working nodes into multiple working node groups based on the network information of each of the created working nodes and the node grouping rules carried by the cluster creation request; creating and configuring a second virtual firewall between the control node and each of the working node groups based on the network information of each working node in each of the working node groups and the network information of the control node.

[0035] In some implementations, the second virtual firewalls between the control node and different working node groups are different, and the second virtual firewalls between the control node and each working node in the working node group are the same.

[0036] In some embodiments, after creating and configuring the second virtual firewall between the control node and the working node based on the network information of each of the working nodes and the network information of the control node, the processor 101 can also: obtain the status information of each of the working nodes; when it is determined according to the status information that the current status of each of the working nodes is in a working state, display the network topology diagram of the target cluster in the cluster management page of the NFVO.

[0037] In some embodiments, the processor 101 is further configured to implement: upon obtaining a cluster expansion request for the target cluster, creating at least one new working node according to the cluster expansion information carried in the cluster expansion request; and updating the access rules of the second virtual firewall according to the network information of each of the new working nodes that have been created.

[0038] In some embodiments, after the processor 101 creates and configures a second virtual firewall between the control node and the working node based on the network information of each of the working nodes and the network information of the control node that have been created, it can also achieve: when a cluster scaling-in request is obtained, the cluster scaling-in information carried in the cluster scaling-in request is sent to the control node, so that the control node removes the corresponding working node from the target cluster according to the cluster scaling-in information; and deletes the access rules corresponding to the removed working node from the second virtual firewall according to the cluster scaling-in information.

[0039] In some embodiments, after the processor 101 creates and configures a second virtual firewall between the control node and the working node based on the network information of each of the working nodes and the network information of the control node that have been created, it can also achieve: when a cluster termination request of the target cluster is obtained, the cluster termination request is sent to the control node, so that the control node deletes all working nodes in the target cluster according to the cluster termination request; when it is determined that all working nodes in the target cluster have been deleted, the control node of the target cluster is deleted; when the control node has been deleted, the access rules corresponding to the control node are deleted from the first virtual firewall.

[0040] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the server described above can refer to the corresponding process in the following firewall configuration method implementation method, and will not be repeated here.

[0041] The following will describe in detail the firewall configuration method provided by the embodiment of the present application in conjunction with the scenario in Figure 1. It should be noted that the scenario in Figure 1 is only used to explain the firewall configuration method provided by the embodiment of the present application, but does not constitute a limitation on the application scenario of the firewall configuration method provided by the embodiment of the present application.

[0042] Please refer to Figure 2, which is a flowchart of a firewall configuration method provided in an embodiment of the present application. This firewall configuration method can be applied to servers or NFVOs, and can accurately and quickly achieve network isolation between control nodes and working nodes.

[0043] As shown in FIG. 2 , the firewall configuration method includes steps S101 to S104 .

[0044] Step S101: Obtain a cluster creation request, where the cluster creation request includes network information of a control node of a target cluster to be created.

[0045] In this step, the target cluster is the cluster to be created. The target cluster may include a control node and at least one worker node. The cluster creation request includes network information for the control node of the target cluster to be created. This information includes, but is not limited to, the IP address and port number of the control node. In some embodiments, the cluster creation request may also include resource specification information for creating the control node. This resource specification information describes the computing resources required by the control node.

[0046] In some embodiments, a user terminal displays a cluster management page that includes a cluster creation option; in response to a user triggering an operation on the cluster creation option, the user terminal displays a cluster creation page that includes a confirmation button; cluster creation information entered or uploaded by the user on the cluster creation page is obtained, and in response to the user triggering an operation on the confirmation button, a cluster creation request is generated based on the cluster creation information and sent to a server; the server receives the cluster creation request sent by the user terminal. The cluster creation information includes network information of the control node of the target cluster to be created, and the triggering operation includes a click operation, a double-click operation, or a long press operation. In some embodiments, the cluster creation information also includes resource specifications of the control node, which describe the resource size of the control node.

[0047] In some embodiments, the server controls a display device to display a cluster management page, which includes a cluster creation option. In response to a user triggering the cluster creation option, the server displays a cluster creation page, which includes a confirmation button. The server obtains cluster creation information entered or uploaded by the user on the cluster creation page and, in response to the user triggering the confirmation button, generates a cluster creation request based on the cluster creation information. The display device may be a display screen integrated with the server or an external display communicatively connected to the server, and this is not specifically limited in the present embodiments.

[0048] Step S102: Create and configure a first virtual firewall between the control node and the network function virtualization orchestrator according to the network information of the control node.

[0049] In this step, a physical device can be logically divided into multiple virtual firewalls. A virtual firewall is software or a service running in a virtualized environment. The physical device can be a server or an electronic device.

[0050] In some embodiments, the server generates a first firewall creation request based on the network information of the NFVO and the network information of the control node, and sends the first firewall creation request to the hardware firewall; when the hardware firewall receives the first firewall creation request, it obtains the network information of the control node and the network information of the NFVO from the first firewall creation request; the hardware firewall creates a first virtual firewall based on the network information of the control node and the network information of the NFVO, and configures access rules between the control node and the NFVO on the first virtual firewall to enable communication between the control node and the NFVO.

[0051] In some embodiments, before executing step S102, a determination is made as to whether the cluster creation request carries firewall sharing information. If the cluster creation request does not carry firewall sharing information, a first virtual firewall is created and configured between the control node and the NFVO based on the network information of the control node and the network information of the NFVO. If the cluster creation request carries firewall sharing information, a target virtual firewall is determined based on the firewall identifier in the firewall sharing information, and access rules between the control node and the NFVO are configured on the target virtual firewall based on the network information of the control node and the network information of the NFVO to enable communication between the control node and the NFVO. This embodiment conserves computing resources by eliminating the need to create a new virtual firewall when a shared firewall is used, and only configuring access rules between the control node and the NFVO on the corresponding firewall to enable communication between the control node and the NFVO.

[0052] In some embodiments, when the cluster creation request carries firewall sharing information, a first firewall creation request is generated based on the network information of the NFVO, the network information of the control node, and the firewall sharing information, and the first firewall creation request is sent to the hardware firewall; when the hardware firewall receives the first firewall creation request, it obtains the firewall sharing information, the network information of the control node, and the network information of the NFVO from the first firewall creation request; the hardware firewall determines the target virtual firewall based on the firewall identifier in the firewall sharing information, and configures access rules between the control node and the NFVO on the target virtual firewall based on the network information of the control node and the network information of the NFVO, so as to enable communication between the control node and the NFVO.

[0053] Step S103: Create a control node, and when the control node is created and enters a working state, create at least one working node.

[0054] In this step, during the creation of the control node, the control node's status is queried at preset intervals until the control node is created and enters the working state. Once the control node is created and enters the working state, at least one working node is created. The control node and working nodes are deployed on different devices.

[0055] In some embodiments, the cluster creation request also includes resource specification information for the control node. The control node may be created based on the resource specification information and network information of the control node. For example, a first virtual machine is created based on the resource specification information for the control node. After the first virtual machine is created, the network information of the first virtual machine is updated with the network information of the control node, and the first virtual machine is initialized as a control node. The resource specification information for the control node describes the computing resources required to create the control node.

[0056] In some embodiments, based on the resource specification information and network information of the control node, the method for creating a control node can be: the server creates the control node in the local machine based on the resource specification information and network information of the control node; or, the server generates a control node creation instruction based on the resource specification information and network information of the control node, and sends the control node creation instruction to a computer device that is communicatively connected to the server; when the computer device receives the control node creation instruction, it creates the control node based on the resource specification information and network information carried by the control node creation instruction.

[0057] In some embodiments, the cluster creation request also includes a first number of worker nodes to be created and resource specification information for each worker node. The at least one worker node may be created by creating the first number of worker nodes based on the resource specification information for each worker node. The resource specification information for the worker nodes describes the computing resources required to create the worker nodes. The computing resources required to create each worker node may be the same or different, and this is not specifically limited in this embodiment of the present application.

[0058] For example, if the first quantity is 3 and the computing resources required to create each work node are x, then 3 work nodes can be created, namely work node A1, work node A2, and work node A3, and the computing resources required to create work nodes A1, work node A2, and work node A3 are all x. For another example, if the first quantity is 3 and the computing resources required to create each work node are x1, x2, and x3, then 3 work nodes can be created, namely work node A1, work node A2, and work node A3, and the computing resources required to create work nodes A1, work node A2, and work node A3 are x1, x2, and x3, respectively.

[0059] Exemplarily, for each working node, a second virtual machine is created based on the resource specification information of the working node; after the second virtual machine is created, network information is allocated to the second virtual machine, and the working node is initialized for the second virtual machine so that the second virtual machine is initialized as a working node.

[0060] For example, the first quantity is 3, and the computing resources required to create each working node are x1, x2 and x3 respectively. Then, a second virtual machine B1, a second virtual machine B2 and a second virtual machine B3 can be created. The computing resources for creating the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3 are x1, x2 and x3 respectively. Network information is allocated to the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3. For example, the network information allocated to the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3 is w1, w2 and w3 respectively. The working nodes of the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3 are initialized, so that the working nodes A1, the working nodes A2 and the working nodes A3 can be obtained.

[0061] In some embodiments, the cluster creation request also includes a first number of working nodes to be created and resource specification information and network information of each working node. The method for creating at least one working node can be: creating a first number of working nodes based on the resource specification information and network information of each working node.

[0062] Exemplarily, for each working node, a second virtual machine is created based on the resource specification information of the working node; after the second virtual machine is created, the network information of the second virtual machine is updated to the network information of the working node, and the second virtual machine is initialized as a working node, so that the second virtual machine is initialized as a working node.

[0063] For example, the first quantity is 3, and the computing resources required to create these 3 working nodes are x1, x2 and x3 respectively, and the network information of these 3 working nodes is w1, w2 and w3 respectively, then a second virtual machine B1, a second virtual machine B2 and a second virtual machine B3 can be created, and the computing resources for creating the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3 are x1, x2 and x3 respectively, and the network information of the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3 are updated to w1, w2 and w3 respectively, and then the working nodes of the second virtual machine B1, the second virtual machine B2 and the second virtual machine B3 are initialized, so that the working nodes A1, A2 and A3 can be obtained.

[0064] In some embodiments, the method for creating a first number of working nodes based on the resource specification information of each working node can be: the server creates the first number of working nodes in the local machine based on the resource specification information of each working node; or, the server generates a working node creation instruction based on the first number and the resource specification information of each working node, and sends the working node creation instruction to a computer device that is communicatively connected to the server; when the computer device receives the working node creation instruction, it creates at least one working node based on the first number in the working node creation instruction and the resource specification information of each working node.

[0065] In some implementations, the control node and worker nodes are located on different servers. For example, as shown in FIG3 , an NFVO is deployed on server 100. A control node for the target cluster is created on server 100, and all worker nodes of the target cluster are created on first computer device 21. Alternatively, the control node for the target cluster is created on server 100, some worker nodes of the target cluster are created on first computer device 21, and another portion of worker nodes of the target cluster are created on second computer device 22. Alternatively, all worker nodes of the target cluster are created on server 100, and the control node of the target cluster is created on first computer device 21 or second computer device 22. Alternatively, some worker nodes of the target cluster are created on server 100, another portion of worker nodes of the target cluster are created on first computer device 21, and the control node of the target cluster is created on first computer device 21. Alternatively, all worker nodes of the target cluster are created on first computer device 21, and the control node of the target cluster is created on second computer device 22.

[0066] Step S104: Create and configure a second virtual firewall between the control node and the working nodes according to the created network information of each working node and the network information of the control node.

[0067] In this step, after the worker nodes are created, the control node in the target cluster obtains the network information of each newly created worker node and sends it to the server running the NFVO. Based on the network information of each newly created worker node and the control node's network information, the server creates and configures a second virtual firewall between the control node and the worker nodes. After the second virtual firewall is created and configured, the control node and the worker nodes can communicate, forming the target cluster.

[0068] For example, as shown in Figure 4, a first virtual firewall 12 is deployed between the network function virtualization orchestrator 200 and the control node 13. The first virtual firewall 12 can achieve network isolation between the network function virtualization orchestrator 200 and the control node 13. A second virtual firewall 14 is deployed between the control node 13 and the first and second working nodes 15 and 16. The second virtual firewall 14 can achieve network isolation between the control node 13 and the first and second working nodes 15 and 16.

[0069] In some embodiments, the method for creating and configuring a second virtual firewall between the control node and the working node based on the network information of each working node that has been created and the network information of the control node can be: generating a second firewall creation request based on the network information of each working node that has been created and the network information of the control node, and sending the second firewall creation request to the hardware firewall; the hardware firewall creates a second virtual firewall based on the network information of each working node that has been created and the network information of the control node, and configures access rules between the control node and each working node on the second virtual firewall to enable the control node and each working node to communicate.

[0070] In some embodiments, as shown in FIG5 , step S104 includes sub-steps S1041 and S1042 .

[0071] Sub-step S1041: Divide each created working node into a plurality of working node groups according to the network information of each created working node and the node grouping rule carried in the cluster creation request.

[0072] In this step, each working node group may include at least one working node, and the node grouping rules carried in the cluster creation request may be set by the user based on actual conditions, and the embodiments of the present application do not specifically limit this. For example, the node grouping rules may be rules for grouping according to the IP address segments of the working nodes, or rules for grouping according to the regions to which the IP addresses of the working nodes belong, or rules for grouping according to the servers to which the IP addresses of the working nodes belong.

[0073] For example, the created working nodes include working node C1, working node C2, working node C3, working node C4 and working node C5. The IP addresses of working node C1, working node C2 and working node C3 are all located in the preset first IP address segment, while working node C4 and working node C5 are all located in the preset second IP address segment. Therefore, working node C1, working node C2 and working node C3 can be divided into one working node group, and working node C4 and working node C5 can be divided into another working node group. For another example, the servers to which the IP addresses of working node C1 and working node C2 belong are both server A, and the servers to which the IP addresses of working node C3, working node C4 and working node C5 belong are all server B. Therefore, working node C1 and working node C2 can be divided into one working node group, and working node C3, working node C4 and working node C5 can be divided into another working node group.

[0074] Sub-step S1042: Create and configure a second virtual firewall between the control node and each working node group based on the network information of each working node in each working node group and the network information of the control node.

[0075] In this step, the second virtual firewalls between the control node and different working node groups are different, the second virtual firewalls between the control node and each working node in the working node group are the same, the second virtual firewalls between the control node and different working node groups are different, and one working node group corresponds to one second virtual firewall. For example, as shown in Figure 6, a second virtual firewall A is deployed between the control node 13 and the first working node group 31, and a second virtual firewall B is deployed between the control node 13 and the second working node group 32. The first working node group 31 includes the first working node 15 and the second working node 16. The second virtual firewall A is used to achieve network isolation between the control node 13 and the first working node 15 and the second working node 16. The second working node group 32 includes the third working node 17 and the fourth working node 18. The second virtual firewall B is used to achieve network isolation between the control node 13 and the third working node 17 and the fourth working node 18.

[0076] In some embodiments, the method for creating and configuring a second virtual firewall between the control node and each working node group based on the network information of each working node in each working node group and the network information of the control node can be: for each working node group, a third firewall creation request is generated based on the network information of each working node in the working node group and the network information of the control node, and the third firewall creation request is sent to the hardware firewall; when the hardware firewall receives the third firewall creation request, it creates a second virtual firewall between the control node and each working node in the working node group based on the network information of each working node in the third firewall creation request and the network information of the control node, and configures access rules between the control node and each working node in the working node group on the second virtual firewall.

[0077] In some embodiments, after step S104, the firewall configuration method further includes: obtaining status information of each working node; and when it is determined based on the status information that each working node is currently in an operational state, displaying a network topology diagram of the target cluster on the NFVO's cluster management page. The control node can obtain the status information of each working node and then send the status information of each working node to a server deployed with the NFVO. Upon obtaining the status information of each working node, the server can determine the current status of each working node based on the status information. When each working node is currently in an operational state, displaying the network topology diagram of the target cluster on the NFVO's cluster management page. This embodiment displays the network topology diagram of the target cluster on the cluster management page after the creation of the control node, working nodes, and virtual firewalls between the control node and the working nodes is complete, thereby facilitating user awareness of the target cluster's creation and improving user experience.

[0078] In some implementations, as shown in FIG. 7 , after step S104 , the firewall configuration method further includes steps S105 to S106 .

[0079] Step S105: When a cluster expansion request of the target cluster is obtained, at least one new working node is created according to the cluster expansion information carried in the cluster expansion request.

[0080] In this step, the cluster expansion request carries cluster expansion information including the number of nodes to be expanded and the resource specifications of each working node. The number of nodes to be expanded and the resource specifications of each working node can be configured by the user based on actual conditions and are not specifically limited in this embodiment of the application.

[0081] In some embodiments, the user terminal displays a cluster management page, which includes a cluster creation option and a cluster expansion option; in response to the user's triggering operation on the cluster expansion option, a cluster expansion page is displayed, which includes a first input box for a cluster identifier and a second input box for cluster expansion information; the cluster identifier and cluster expansion information selected or entered by the user are obtained, and the cluster identifier selected or entered by the user is displayed in the first input box, and the cluster expansion information selected or entered by the user is displayed in the second input box; in response to the user's triggering operation on the confirmation button in the cluster expansion page, a cluster expansion request is generated according to the cluster identifier displayed in the first input box and the cluster expansion information displayed in the second input box, and the cluster expansion request is sent to the server; when the server receives the cluster expansion request, if the cluster identifier carried by the cluster expansion request is the cluster identifier of the target cluster, it is determined that the server has obtained the cluster expansion request of the target cluster.

[0082] In some embodiments, the server controls the display device to display a cluster management page, which includes a cluster creation option and a cluster expansion option; in response to a user triggering operation on the cluster expansion option, a cluster expansion page is displayed, which includes a first input box for a cluster identifier and a second input box for cluster expansion information; the cluster identifier and cluster expansion information selected or input by the user are obtained, and the cluster identifier selected or input by the user is displayed in the first input box, and the cluster expansion information selected or input by the user is displayed in the second input box; in response to the user triggering operation on a confirmation button in the cluster expansion page, a cluster expansion request is generated according to the cluster identifier displayed in the first input box and the cluster expansion information displayed in the second input box; if the cluster identifier carried by the cluster expansion request is the cluster identifier of the target cluster, it is determined that the server has obtained the cluster expansion request of the target cluster.

[0083] In some embodiments, the cluster expansion information includes the number of nodes to be expanded and the resource specification information of the newly created nodes. Based on the cluster expansion information carried in the cluster expansion request, at least one new working node may be created by creating a corresponding number of new working nodes based on the resource specification information of each newly created node. The resource specification information of the newly created nodes is used to describe the computing resources required to create the newly created working nodes. The computing resources required to create each newly created working node may be the same or different, and this embodiment of the present application does not specifically limit this.

[0084] For example, if two worker nodes need to be expanded, and the computing resources required for each of these two new worker nodes are x4, then two new worker nodes can be created, named worker node A4 and worker node A5, with the computing resources for each of these two nodes being x5. For another example, if the computing resources required for these two new worker nodes are x5 and x6, then two new worker nodes can be created, named worker node A4 and worker node A5, with the computing resources for each of these nodes being x5 and x6, respectively.

[0085] Step S106: Update the access rules of the second virtual firewall according to the network information of each newly created working node.

[0086] In this step, after each new working node is created, the access rules of the second virtual firewall corresponding to the firewall identifier in the cluster expansion request can be updated based on the network information of each newly created working node. In some embodiments, the network information of each newly created working node can be added to the access list of the second virtual firewall corresponding to the firewall identifier in the cluster expansion request, and each newly created working node and the control node can access each other through the second virtual firewall.

[0087] For example, as shown in Figure 4, the target cluster includes the first working node 15 and the second working node 16 before expansion. After the target cluster is expanded to include two new working nodes, the access rules of the second virtual firewall 14 can be updated according to the network information of the two new working nodes. As shown in Figure 8, the expanded target cluster includes the first working node 15, the second working node 16, the fifth working node 33 and the sixth working node 34, and the fifth working node 33 and the sixth working node 34 are isolated from the control node 13 through the second virtual firewall 14.

[0088] In some embodiments, the server generates an access rule addition request based on the network information of each new working node created and the firewall identifier in the cluster expansion request, and sends the access rule addition request to the hardware firewall; when the hardware firewall receives the access rule addition request, it determines the second virtual firewall to which access rules need to be added based on the firewall identifier in the access rule addition request, and adds corresponding access rules to the second virtual firewall to which access rules need to be added based on the network information of each new working node in the access rule addition request.

[0089] In some embodiments, when a cluster expansion request does not carry a firewall identifier, a second virtual firewall is created and configured between the control node corresponding to the cluster identifier and each new work node based on the network information of each newly created work node and the network information of the control node corresponding to the cluster identifier. For example, before expansion, the target cluster includes a control node M, a work node D1, and a work node D2. A second virtual firewall C is deployed between the control node M and the work nodes D1 and D2. When the target cluster is expanded, the user does not select or enter a firewall identifier, which means that the new work node does not share the virtual firewall with the already created work nodes. After the target cluster is expanded, a second virtual firewall D is deployed between the control node M and the new work nodes D3 and D4. In this way, the second virtual firewall C is used to achieve network isolation between the control node M and the work nodes D1 and D2, and the second virtual firewall D is used to achieve network isolation between the control node M and the work nodes D3 and D4.

[0090] In some embodiments, when a cluster scaling-down request is obtained, the cluster scaling-down information carried in the cluster scaling-down request is sent to the control node, so that the control node removes the corresponding working node from the target cluster according to the cluster scaling-down information; and deletes the access rules corresponding to the removed working node from the second virtual firewall according to the cluster scaling-down information. The cluster scaling-down information includes the node identification and network information of the working node to be removed. For example, before scaling down, the target cluster includes the control node M, working node D1, working node D2, working node D3 and working node D4, and the cluster scaling-down information includes the node identification and network information of working node D2 and working node D3. Then, working node D2 and working node D3 can be removed from the target cluster, and the access rules corresponding to working node D2 can be deleted from the second virtual firewall C between the control node M and working node D2, and the access rules corresponding to working node D3 can be deleted from the second virtual firewall D between the control node M and working node D3, thereby completing the scaling down of the target cluster.

[0091] In some embodiments, based on the cluster scaling information, the method for deleting the access rules corresponding to the removed working node from the second virtual firewall can be: the server generates an access rule deletion request based on the cluster identifier and cluster scaling information carried in the cluster scaling request, and sends the access rule deletion request to the hardware firewall; when the hardware firewall receives the access rule deletion request, it determines the second virtual firewall whose access rules need to be deleted based on the cluster identifier in the access rule deletion request, and deletes the access rules corresponding to the node identifier in the cluster scaling information from the second virtual firewall whose access rules need to be deleted.

[0092] In some embodiments, when all access rules of a second virtual firewall are deleted, the second virtual firewall is deleted. For example, before the target cluster is scaled down, it includes a control node M, a work node D1, a work node D2, a work node D3, and a work node D4. A second virtual firewall C is deployed between the control node M and the work nodes D1 and D2. A second virtual firewall D is deployed between the control node M and the work nodes D3 and D4. The cluster scale-down information includes the node identifiers and network information of the work nodes D1 and D2. In this case, the work nodes D1 and D2 can be removed from the target cluster, and the access rules corresponding to the work nodes D1 and D2 can be deleted from the second virtual firewall C. Since all access rules of the second virtual firewall C are deleted, the second virtual firewall C can be deleted.

[0093] In some embodiments, the user terminal displays a cluster management page, which includes a cluster creation option, a cluster expansion option, and a cluster reduction option; in response to the user's triggering operation on the cluster reduction option, a cluster reduction page is displayed, which includes a third input box for the cluster identifier and a fourth input box for the cluster reduction information; the cluster identifier and cluster reduction information selected or entered by the user are obtained, and the cluster identifier selected or entered by the user is displayed in the third input box and the cluster reduction information selected or entered by the user is displayed in the fourth input box; in response to the user's triggering operation on the confirmation button in the cluster reduction page, a cluster reduction request is generated according to the cluster identifier displayed in the third input box and the cluster reduction information displayed in the fourth input box, and the cluster reduction request is sent to the server; when the server receives the cluster reduction request, if the cluster identifier carried by the cluster reduction request is the cluster identifier of the target cluster, it is determined that the server has obtained the cluster reduction request of the target cluster.

[0094] In some embodiments, the server controls the display device to display a cluster management page, which includes a cluster creation option, a cluster expansion option, and a cluster reduction option; in response to a user triggering operation on the cluster reduction option, a cluster reduction page is displayed, which includes a third input box for a cluster identifier and a fourth input box for cluster reduction information; the cluster identifier and cluster reduction information selected or input by the user are obtained, and the cluster identifier selected or input by the user is displayed in the third input box and the cluster reduction information selected or input by the user is displayed in the fourth input box; in response to a user triggering operation on a confirmation button in the cluster reduction page, a cluster reduction request is generated according to the cluster identifier displayed in the third input box and the cluster reduction information displayed in the fourth input box; if the cluster identifier carried by the cluster reduction request is the cluster identifier of the target cluster, it is determined that the server has obtained the cluster reduction request of the target cluster.

[0095] In some embodiments, when all access rules of the second virtual firewall are deleted, the server generates a firewall deletion request based on the firewall identifier of the second virtual firewall and sends the firewall deletion request to the hardware firewall; when the hardware firewall receives the firewall deletion request, it deletes the second virtual firewall corresponding to the firewall identifier in the firewall deletion request.

[0096] In some embodiments, upon receiving a cluster termination request from a target cluster, a cluster termination request is sent to a control node, causing the control node to delete all active nodes in the target cluster in accordance with the cluster termination request. Upon determining that all active nodes in the target cluster have been deleted, the control node of the target cluster is deleted. If the control node has been deleted, the access rules corresponding to the control node are deleted from the first virtual firewall. The cluster termination request includes the cluster identifier of the cluster to be terminated, which can be any already created cluster.

[0097] In some embodiments, the user terminal displays a cluster management page, which includes a cluster creation option, a cluster expansion option, a cluster reduction option, and a cluster termination option; in response to the user's triggering operation on the cluster termination option, a cluster termination page is displayed, which includes a fifth input box for the cluster identifier; the cluster identifier selected or input by the user is obtained, and the cluster identifier selected or input by the user is displayed in the fifth input box; in response to the user's triggering operation on the confirmation button in the cluster termination page, a cluster termination request is generated according to the cluster identifier displayed in the fifth input box, and the cluster termination request is sent to the server; when the server receives the cluster termination request, if the cluster identifier carried by the cluster termination request is the cluster identifier of the target cluster, it is determined that the server has obtained the cluster termination request of the target cluster.

[0098] In some embodiments, the server controls the display device to display a cluster management page, which includes a cluster creation option, a cluster expansion option, a cluster reduction option, and a cluster termination option; in response to a user triggering operation on the cluster termination option, a cluster termination page is displayed, which includes a fifth input box for the cluster identifier; the cluster identifier selected or input by the user is obtained, and the cluster identifier selected or input by the user is displayed in the fifth input box; in response to the user triggering operation on the confirmation button in the cluster termination page, a cluster termination request is generated according to the cluster identifier displayed in the fifth input box; if the cluster identifier carried by the cluster termination request is the cluster identifier of the target cluster, it is determined that the server has obtained the cluster termination request of the target cluster.

[0099] It is understood that users can also expand, shrink, or terminate clusters other than the target cluster. The specific implementation process for expanding, shrinking, or terminating clusters other than the target cluster can refer to the specific implementation methods for expanding, shrinking, or terminating the target cluster described above and will not be described in detail here. The server can determine the cluster to be expanded based on the cluster identifier in the cluster expansion request, determine the cluster to be shrunk based on the cluster identifier in the cluster shrink request, and determine the cluster to be terminated based on the cluster identifier in the cluster termination request.

[0100] Please refer to Figure 9, which is a schematic block diagram of the structure of a network function virtualization orchestrator provided in an embodiment of the present application.

[0101] As shown in Figure 9, the network function virtualization orchestrator 200 includes: an acquisition module 210, configured to obtain a cluster creation request, wherein the cluster creation request includes network information of the control node of the target cluster to be created; a firewall configuration module 220, configured to create and configure a first virtual firewall between the control node and the NFVO based on the network information of the control node; a node creation module 230, configured to create the control node and, when the control node is created and enters a working state, create at least one working node; the firewall configuration module 220 is further configured to create and configure a second virtual firewall between the control node and the working node based on the network information of each of the created working nodes and the network information of the control node.

[0102] In some embodiments, the firewall configuration module 220 is further configured to: divide the created working nodes into multiple working node groups based on the network information of each created working node and the node grouping rules carried by the cluster creation request; create and configure a second virtual firewall between the control node and each of the working node groups based on the network information of each working node in each of the working node groups and the network information of the control node.

[0103] In some implementations, the second virtual firewalls between the control node and different working node groups are different, and the second virtual firewalls between the control node and each working node in the working node group are the same.

[0104] In some embodiments, the acquisition module 210 is further configured to obtain status information of each of the working nodes; the network function virtualization orchestrator 200 further includes: a display module, configured to display the network topology diagram of the target cluster in the cluster management page of the NFVO when it is determined according to the status information that the current status of each of the working nodes is in a working state.

[0105] In some embodiments, the network function virtualization orchestrator 200 also includes a cluster expansion module, which is configured to: when a cluster expansion request of the target cluster is obtained, create at least one new working node according to the cluster expansion information carried in the cluster expansion request; and update the access rules of the second virtual firewall according to the network information of each of the new working nodes that have been created.

[0106] In some embodiments, the network function virtualization orchestrator 200 also includes a cluster scaling-in module, which is configured to: when a cluster scaling-in request is obtained, send cluster scaling-in information carried in the cluster scaling-in request to the control node, so that the control node removes the corresponding working node from the target cluster according to the cluster scaling-in information; and delete the access rules corresponding to the removed working node from the second virtual firewall according to the cluster scaling-in information.

[0107] In some embodiments, the network function virtualization orchestrator 200 further includes a cluster termination module, which is configured to: upon receiving a cluster termination request of the target cluster, send the cluster termination request to the control node, so that the control node deletes all working nodes in the target cluster according to the cluster termination request; if it is determined that all working nodes in the target cluster have been deleted, delete the control node of the target cluster; if the control node has been deleted, delete the access rules corresponding to the control node from the first virtual firewall.

[0108] It should be noted that technical personnel in the relevant field can clearly understand that for the convenience and conciseness of description, the specific working process of the network function virtualization orchestrator described above can refer to the corresponding process in the aforementioned firewall configuration method implementation method, and will not be repeated here.

[0109] An embodiment of the present application also provides a computer-readable storage medium storing at least one computer program, which can be executed by at least one processor to enable the at least one processor to implement the firewall configuration method provided in the embodiment description of the present application.

[0110] The storage medium may be an internal storage unit of the server described in the aforementioned embodiment, such as a hard disk or memory of the server. The storage medium may also be an external storage device of the server, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the server.

[0111] It will be appreciated by those skilled in the art that all or some of the steps in the method disclosed above, and the functional modules / units in the device can be implemented as software, firmware, hardware, and appropriate combinations thereof. In a hardware embodiment, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor (such as a central processing unit, a digital signal processor, or a microprocessor), or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As is well known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media generally embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0112] It should be understood that the term "and / or" used in this specification and the appended claims refers to any combination of one or more of the associated listed items and all possible combinations, including these combinations. It should be noted that, in this article, the terms "include", "comprise" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or system that includes a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements that are inherent to such process, method, article or system. In the absence of further restrictions, an element defined by the sentence "including a..." does not exclude the presence of other identical elements in the process, method, article or system that includes the element.

[0113] The serial numbers of the embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments. The above are only specific embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application shall be based on the scope of protection of the claims.

Claims

1. A firewall configuration method, comprising: Obtaining a cluster creation request, wherein the cluster creation request includes network information of a control node of a target cluster to be created; Creating and configuring a first virtual firewall between the control node and a network function virtualization orchestrator NFVO according to the network information of the control node; Creating the control node, and when the control node is created and enters a working state, creating at least one working node; According to the created network information of each of the working nodes and the network information of the control node, a second virtual firewall between the control node and the working nodes is created and configured.

2. The firewall configuration method according to claim 1, wherein: The creating and configuring a second virtual firewall between the control node and the working node according to the created network information of each working node and the network information of the control node comprises: According to the network information of each of the created working nodes and the node grouping rule carried in the cluster creation request, each of the created working nodes is divided into a plurality of working node groups; A second virtual firewall between the control node and each of the working node groups is created and configured according to the network information of each working node in each of the working node groups and the network information of the control node.

3. The firewall configuration method according to claim 2, wherein: The second virtual firewalls between the control node and different working node groups are different, and the second virtual firewalls between the control node and each working node in the working node group are the same.

4. The firewall configuration method according to claim 1, further comprising: After creating and configuring the second virtual firewall between the control node and the working nodes according to the created network information of each of the working nodes and the network information of the control node, obtaining the status information of each of the working nodes; After determining according to the status information that the current status of each working node is in a working state, When the target cluster is in the state, the network topology diagram of the target cluster is displayed in the cluster management page of the NFVO.

5. The firewall configuration method according to claim 1, further comprising: When a cluster expansion request of the target cluster is obtained, creating at least one new working node according to the cluster expansion information carried in the cluster expansion request; The access rules of the second virtual firewall are updated according to the network information of each of the newly created working nodes.

6. The firewall configuration method according to any one of claims 1 to 5, further comprising: After creating and configuring the second virtual firewall between the control node and the working node according to the network information of each of the working nodes and the network information of the control node, when a cluster shrinking request is obtained, the cluster shrinking information carried in the cluster shrinking request is sent to the control node, so that the control node removes the corresponding working node from the target cluster according to the cluster shrinking information; According to the cluster shrinkage information, the access rule corresponding to the removed working node is deleted from the second virtual firewall.

7. The firewall configuration method according to any one of claims 1 to 5, further comprising: After creating and configuring the second virtual firewall between the control node and the working nodes according to the network information of each of the working nodes and the network information of the control node, upon obtaining a cluster termination request of the target cluster, sending the cluster termination request to the control node, so that the control node deletes all the working nodes in the target cluster according to the cluster termination request; When it is determined that all working nodes in the target cluster have been deleted, deleting the control node of the target cluster; In a case where the control node has been deleted, the access rule corresponding to the control node is deleted from the first virtual firewall.

8. A network function virtualization orchestrator NFVO, comprising: The acquisition module is configured to acquire a cluster creation request, wherein the cluster creation request includes The network information of the control node of the created target cluster; a firewall configuration module, configured to create and configure a first virtual firewall between the control node and the NFVO according to the network information of the control node; A node creation module is configured to create the control node, and when the control node is created and enters a working state, create at least one working node; The firewall configuration module is further configured to create and configure a second virtual firewall between the control node and the working nodes according to the created network information of each working node and the network information of the control node.

9. A server, comprising a processor, a memory, a computer program stored in the memory and executable by the processor, and a data bus for realizing connection and communication between the processor and the memory, wherein when the computer program is executed by the processor, the processor implements the firewall configuration method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing at least one computer program, wherein the at least one computer program can be executed by at least one processor, so that the at least one processor implements the firewall configuration method according to any one of claims 1 to 7.

Images