WO2017025005A1 - 实现云平台安全 - Google Patents

实现云平台安全 Download PDF

Info

Publication number
WO2017025005A1
WO2017025005A1 PCT/CN2016/093909 CN2016093909W WO2017025005A1 WO 2017025005 A1 WO2017025005 A1 WO 2017025005A1 CN 2016093909 W CN2016093909 W CN 2016093909W WO 2017025005 A1 WO2017025005 A1 WO 2017025005A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
openflow
entry
port
bridge
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/093909
Other languages
English (en)
French (fr)
Inventor
侯叶飞
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hangzhou H3C Technologies Co Ltd
Original Assignee
Hangzhou H3C Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hangzhou H3C Technologies Co Ltd filed Critical Hangzhou H3C Technologies Co Ltd
Priority to JP2018506402A priority Critical patent/JP6595698B2/ja
Priority to US15/745,372 priority patent/US10887280B2/en
Priority to EP16834629.4A priority patent/EP3313032B1/en
Publication of WO2017025005A1 publication Critical patent/WO2017025005A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0245—Filtering by information in the payload
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4604—LAN interconnection over a backbone network, e.g. Internet, Frame Relay
    • H04L12/462—LAN interconnection over a bridge based backbone
    • H04L12/4625—Single bridge functionality, e.g. connection of two networks over a single bridge
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors
    • G06F9/45558—Hypervisor-specific management and integration aspects
    • G06F2009/45595—Network integration; Enabling network access in virtual machine instances
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general

Definitions

  • cloud platform security is achieved through dynamically learning iptables (iptables) and Layer 2 MAC forwarding tables.
  • FIG. 1 shows the structure of any cloud server in the open source cloud platform Openstack.
  • the native bridge of the Linux kernel (qbr bridge, also known as MAC bridge), as shown in Figure 1, MAC bridge_1, MAC bridge_2, and MAC bridge_3 implement OpenDB security for open source cloud platform through dynamic learning iptable and Layer 2 MAC forwarding table.
  • VM Virtual Machine
  • VM1 sends a packet through the local interface eth0.
  • the MAC bridge passes the VM1 virtual network card (Veth: Virtual ethernet) on the MAC bridge.
  • the port Veth1 receives the packet from the VM1, and filters and identifies the packet according to the iptable that is dynamically learned.
  • the Layer 2 MAC forwarding table that dynamically learns continues to forward the packet that passes the filtering.
  • Figure 1 shows a block diagram of any cloud server in the open source cloud platform Openstack
  • FIG. 2 is a structural diagram of any cloud server in the cloud platform provided in the example of the present application.
  • 3A is a flowchart of a method for implementing cloud platform security based on an OpenFlow table provided in an example of the present application
  • FIG. 3B is a schematic flowchart of the source Openflow bridge provided in the example of the present application forwarding the first packet according to the forwarding action in the found Openflow security table.
  • FIG. 4 is a schematic structural diagram of an application networking provided in an example of the present application.
  • FIG. 5 is a schematic structural diagram of an application networking provided in another example of the present application.
  • FIG. 6 is a structural diagram of an apparatus for implementing cloud platform security based on an Openflow table provided in an example of the present application
  • FIG. 7 is a hardware structural diagram of an apparatus for implementing cloud platform security based on an Openflow table provided in an example of the present application.
  • the MAC bridge on the cloud platform in the cloud platform is based on the iptable and the Layer 2 MAC forwarding table when implementing the Openstack security of the open source cloud platform, and the controllability of the iptable and the Layer 2 MAC forwarding table is relatively poor, far less than the Openflow table.
  • other bridges on the cloud server in the cloud platform such as internal bridges (BR-Int) and external bridges (BR-Ext), are all Openflow tables. Therefore, the iptable on the MAC bridge on the same cloud server.
  • the Layer 2 MAC forwarding table is not uniform with the Openflow table on other bridges.
  • FIG. 2 shows the application.
  • the location of the Openflow bridge is the same as that of the MAC bridge described in the background section, and is connected between the VM and the BR-Int, but compared to the MAC bridge through the dynamic learning iptable and the Layer 2 MAC forwarding table.
  • Cloud platform security In this application, the Openflow bridge implements cloud platform security based on a pre-configured Openflow security table.
  • the Openflow security table contains multiple Openflow security entries. Each Openflow security entry contains the following two parts: matching conditions and forwarding actions.
  • the matching condition herein may include a message receiving port and a report.
  • the packet attribute parameter carried in the packet may be at least one of a message quintuple or a quaternary group.
  • the packet quintuple is: destination IP address, source IP address, destination port number, source port number, and protocol type.
  • the packet quintuple is: destination IP address, source IP address, destination MAC address, and source MAC address. , destination port number, source port number, and protocol type.
  • the forwarding action may be a forwarding action performed on a message matching the Openflow security entry.
  • the following describes how to forward packets according to the forwarding action in the Openflow security entry, which is not mentioned here.
  • the Openflow bridge implements cloud platform security based on the pre-configured Openflow security table.
  • FIG. 3A is a flowchart of a method for implementing cloud platform security based on an Openflow table provided by the present application. The process is applied to the Openflow bridge as described above, as shown in FIG. 3A, which may include the following steps:
  • Step 301 Receive a message.
  • the packet may be the first packet sent from the local VM, or may be the second packet sent to the local VM.
  • first packet and the second packet are only used to facilitate distinguishing between the packet sent by the VM and the packet sent to the VM, and are not limited to the present application.
  • Step 302 When the packet is a packet sent by the local VM, or is a packet sent to the local VM, the port that receives the packet and the packet attribute parameter carried by the packet are used as a key. The word is searched for the Openflow security entry in the local pre-configured Openflow security table with the matching condition as the keyword. If found, the packet is forwarded according to the forwarding action in the found Openflow security entry, if not found. Discard the message.
  • the Openflow bridge when the Openflow bridge receives the first message sent from the local VM, the Openflow bridge is called the source Openflow bridge, and when the Openflow bridge receives the send to the local VM.
  • the second message is called the Openflow Bridge for the purpose of the Openflow Bridge.
  • the following is an Openflow bridge segmentation source Openflow bridge and a destination Openflow bridge description.
  • the source Openflow bridge will find the first port of the first packet and the packet attribute parameter carried in the first packet as the first keyword in the locally pre-configured Openflow security table to find the Openflow security with the matching condition as the first keyword. If the entry is found, the first packet is forwarded according to the forwarding action in the found Openflow security entry. If the entry is not found, the first packet is discarded.
  • the OpenFlow bridge searches for the second port of the second packet and the packet attribute parameter carried by the second packet as the second keyword in the locally configured Openflow security table to find the Openflow matching the second keyword. If the security entry is found, the second packet is forwarded to the VM through the first port according to the forwarding action in the found Openflow security entry. If the second packet is not found, the second packet is discarded.
  • forwarding the second packet according to the forwarding action in the found Openflow security entry may include: sending the second packet to the VM by using the first port of the Openflow bridge to connect to the VM.
  • FIG. 3B is a schematic flowchart of the source Openflow bridge provided in the example of the present application forwarding the first packet according to the forwarding action in the found Openflow security table.
  • the source Openflow bridge forwards the first packet according to the forwarding action in the found Openflow security entry, which may include:
  • step a1 the source Openflow bridge determines whether the first packet is the first packet. When the first packet is the first packet, step a2 is performed. When the first packet is not the first packet, step a3 is performed.
  • whether the first packet is the first packet is determined in a manner similar to the manner in which the first packet is determined, and the description is not performed.
  • the source Openflow bridge forwards the first packet to the third port of the pair of the peers (Peer) on the BR-Int and the second port through the second port on the OpenFlow bridge. End the current process.
  • This step a2 is performed on the premise that the first packet is the first packet.
  • the source Openflow bridge sends the first packet to the third port of the pair of peers (Peer) on the BR-Int and the second port through the second port on the Openflow bridge. After that, the first message will reach the third port on the BR-Int.
  • the BR-Int finds the Openflow forwarding entry matching the first packet in the local Openflow forwarding table, which is recorded as entry 1, according to the found entry 1 The forwarding action in the file continues to forward the first message.
  • the forwarding action in the entry 1 of the BR-Int is: sending the first packet to the fourth port on the BR-Int to
  • the Openport bridge that is, the destination Openflow bridge
  • the Openport bridge that is, the destination Openflow bridge
  • the BR-Int will pass through the fourth port on the BR-Int to the destination Openflow bridge.
  • the fifth port that is the peer of the fourth port is the first packet.
  • the five-port, first-message packet attribute parameter searches for the matching Openflow security entry in the local pre-configured Openflow security table, which is recorded as entry 2. If it is found, it depends on the forwarding action in the found entry 2. The first packet is sent to the destination device through the egress port of the destination device. The first packet is sent to the destination device. If no packet is found, the first packet is discarded.
  • the forwarding action in the entry 1 of the BR-Int is: sending the first port on the sixth port of the BR-Int.
  • the packet is the seventh port of the Peer on the BR-Ext and the sixth port.
  • the BR-Int sends the first packet to the seventh port on the BR-Ext and the sixth port, which is Peer, through the sixth port on the BR-Int.
  • the BR-Ext finds the Openflow forwarding entry matching the first packet in the local Openflow forwarding table, which is recorded as entry 3, according to the forwarding action in the found entry 3. Continue to forward the first message.
  • the forwarding action in the queried entry 3 may be: VXLAN encapsulation of the first packet, and forwarding the first packet after the VXLAN encapsulation through the physical port of the BR-Ext (the route egress port of the destination device) Finally, the first message will arrive at the destination device.
  • the first message is forwarded to the source Openflow bridge, the BR-Int, the destination Openflow bridge, or the first packet when the first packet is sent to the destination device and the destination device is the other VM on the same cloud server.
  • the description of the forwarding of the first packet in the source Openflow bridge, BR-Int, and BR-Ext is the first packet sent to the destination device and the destination device is the host on the physical network or other VMs on different cloud servers.
  • the controller on the cloud platform such as the SDN controller, can further dynamically generate an Openflow forwarding entry for forwarding the first packet, which is recorded as the entry 4 and sent to the source Openflow bridge for storage. For example, it is stored in the Openflow forwarding table of the source Openflow bridge.
  • the entry 4 is the first packet passing the source Openflow bridge, BR- according to the no-repeat principle.
  • the matching condition of the entry 4 is that the first packet is found through the source Openflow bridge and the first packet.
  • the matching condition in the Openflow security entry matching the packet the matching condition in the Openflow forwarding entry matched by the first packet when the first packet is matched by the BR-Int, and the first packet passing the destination Openflow bridge.
  • the combination of the matching conditions (note that the matching condition of the final combination is guaranteed to have no duplicate content), and the forwarding action of the entry 4 is the Openflow security entry that matches the first packet when the first packet is sent through the source Openflow bridge.
  • the entry 4 is the source OpenFlow of the first packet according to the no-repeat principle.
  • the matching condition of the entry 4 is the matching condition in the Openflow security entry matched by the first packet when the first packet is received by the source Openflow bridge, and the first packet is sent through the BR-
  • the combination of the matching condition in the Openflow forwarding entry that matches the first packet and the matching condition in the Openflow forwarding entry that matches the first packet when the first packet passes the BR-Ext (Note, The matching condition of the final combination needs to be ensured that there is no duplicate content.
  • the forwarding action of the entry 4 is the forwarding action in the Openflow security entry matching the first packet when the first packet is sent through the source Openflow bridge. Forwarding action in the Openflow forwarding entry matching the first packet and the forwarding action in the Openflow forwarding entry matching the first packet when the first packet passes the BR-Ext Combination (note, the final group In the forwarding operation, the forwarding operation of the intermediate link may be omitted, but other non-forwarding operations such as VXLAN encapsulation need not be omitted.
  • the first message is sent to the head of the destination device.
  • the entry 4 is finally gathered when the first packet is collected through the bridges on the cloud server.
  • the matching Openflow entry which ensures that the non-first packet sent to the destination device directly performs an Openflow forwarding entry search directly on the source Openflow bridge, and can be forwarded without looking for the Openflow entry in other bridges in the cloud server. Improve the packet forwarding efficiency to the destination device. For details, see step a3.
  • the source Openflow bridge searches for the Openflow forwarding entry matching the first packet in the local Openflow forwarding table (that is, the above-mentioned entry 4), and forwards the first report according to the forwarding action in the found Openflow forwarding entry. Text. End the current process.
  • This step a3 is performed on the premise that the first packet is not the first packet.
  • the entry 4 aggregates the Openflow entry that matches the first packet that is found when the first packet sent to the destination device passes through each bridge in the cloud server.
  • the Openflow forwarding entry matching the first packet in the local Openflow forwarding table in the step a3 is the above table entry 4 because the table is Item 4 aggregates the OpenFlow entries matching the first packet that are sent to the destination device through the respective bridges in the cloud server.
  • the forwarding action in the Openflow forwarding entry is found in step a3. Forwarding the first packet means that the first packet is directly forwarded through each bridge in the cloud server.
  • the Openflow forwarding table is executed only on the source Openflow bridge, and no other bridges in the cloud server are searched.
  • the Openflow entry can be forwarded to the first packet to the destination device, which improves packet forwarding efficiency.
  • the packet p1 is a non-first packet sent to the destination device (other VMs in the same cloud server).
  • the source Openflow bridge receives the packet p1, it finds that the packet p1 is the non-first packet sent to the destination device.
  • the Openflow forwarding entry matching the packet p1 is found, and the forwarding action in the Openflow forwarding entry is found. Forward the message p1.
  • the Openflow forwarding entry matching the packet p1 is a superposition of the matching Openflow entries found by the first packet sent to the destination device via the source Openflow bridge, the BR-Int, and the destination Openflow bridge, and thus, according to the found
  • the forwarding action forwarding message p1 in the Openflow forwarding entry is finally sent to the port of the destination device connected to the destination Openflow bridge through the source Openflow bridge, the BR-Int, and the destination Openflow bridge, and can be directly forwarded through the port. It is no longer necessary to find Openflow entry forwarding on the BR-Int and destination Openflow bridges.
  • the port communication between the bridges of the same cloud server through the port type is defined, specifically: the second port on the source Openflow bridge, the BR-Int
  • the third port that is Peer with the second port, the fourth port on the BR-Int, the fifth port on the destination Openflow bridge and the fourth port are Peer, the sixth port on the BR-Int, and the BR-Ext
  • the port type of the seventh port with six ports being Peer is patch.
  • the port type is patch, which ensures that the first packet is connected to each Openflow type bridge (which is a bridge with Openflow entries, namely Openflow bridge, BR-Int, BR-Ext, etc.) that is connected to the port of the patch type.
  • the Openflow entries of all Openflow-type bridges are automatically combined, and an Openflow forwarding entry is generated (such as the entry 4 when the first packet is the first packet in the above step a2) to guide the subsequent non-first packet traffic forwarding.
  • Step 302 is described above.
  • FIG. 4 is a schematic diagram of an application networking in an example.
  • the application networking of FIG. 4 is only taking the network of one of the servers of the cloud platform as an example.
  • VM_11 connects to the virtual network card Veth_11 on the Openflow bridge _11 through the local port eth_11.
  • VM_12 is connected to the virtual network card Veth_12 of the Openflow bridge _12 through the local port eth_12, and so on.
  • VM_1n passes this The ground port eth_1n is connected to the virtual network card Veth_1n of the Openflow bridge_1n.
  • Openflow Bridge_11 is connected to BR-Int port Patch_Int_11 through port Patch_VM_11
  • Openflow Bridge_12 is connected to BR-Int port Patch_Int_12 through port Patch_VM_12
  • Openflow Bridge_1n is connected to BR through port Patch_VM_1n -Int port Patch_Int_1n
  • port Patch_VM_11 on Openflow bridge _11 and port Patch_Int_11 on BR-Int are a pair of peers
  • port type is patch
  • ports on port Open on port _12 are patch_VM_12 and ports on BR-Int Patch_Int_12 is a pair of peers
  • the port type is patch, and so on.
  • the port Patch_VM_1n on the Openflow bridge_1n and the port Patch_Int_1n on the BR-Int are a pair of peers, and the port type is patch.
  • the BR-Int is connected to the port Patch_41 on the BR-Ext through the port Patch_40.
  • the port type of the Patch_40 and Patch_41 is Patch.
  • VM_11 in FIG. 4 up to VM_1n, Openflow Bridge_11 up to Openflow Bridge_1n, BR-Int, BR-Ext are located on the same cloud server.
  • VM_11 is accessed by VM_11 as an example.
  • VM_11 sends a message for accessing VM_12 through eth_11.
  • the message is recorded as message 01.
  • the Openflow bridge _11 receives the message 01 through the Veth_11, and finds that the message 01 is the packet that the VM_11 first accesses to the VM_12 (that is, the first packet), and the packet is carried in the Veth_11 and the packet 01.
  • the attribute parameter is used as a keyword to find an Openflow security entry with the matching condition as the keyword in the locally pre-configured Openflow security table.
  • Openflow Bridge_11 If Openflow Bridge_11 does not find an Openflow security entry, Openflow Bridge_11 directly discards message 01.
  • Openflow Bridge_11 finds an Openflow security entry (remember the found Openflow security entry as entry 41), it will continue according to the forwarding action in Table 41. Message 01 is sent out through the port Patch_VM_11 of this Openflow Bridge_11.
  • the BR-Int finds the Openflow forwarding entry matching the packet 01 in the local Openflow forwarding table (the found Openflow forwarding entry is recorded as the entry 42).
  • the forwarding action in item 42 forwards message 01 through port Patch_Int_12.
  • the Openflow bridge _12 receives the message 01 through the patch_VM_12, and finds that the message 01 is sent to the VM_12. Then, the packet attribute parameter carried in the patch_VM_12 and the message 01 is used as a keyword to find a match in the locally pre-configured Openflow security table. The condition is the Openflow security entry of the keyword. If it is found, the found Openflow security entry is recorded as entry 43, and then sent according to the forwarding action in the entry 43 through the port Veth_12 of the Openflow bridge _12. Message 01. Finally, the message 01 sent by VM_11 will reach VM_12, that is, VM_11 access VM_12 is realized.
  • the SDN controller on the cloud platform further forwards the entry 41 of the message 01 through the Openflow bridge _11 in the forwarding process of the message 01 from the Openflow bridge _11, the BR-Int, and the Openflow bridge _12.
  • the message 01 is superimposed by the entry 42 found in the BR-Int and the entry 01 found by the message 01 via the Openflow bridge _12 to generate an Openflow forwarding entry matching the message 01 (denoted as an entry) 40) Openflow forwarding table sent to Openflow Bridge_11.
  • the matching condition in the entry 40 is a non-repetitive overlay of the matching condition in the entry 41 to the entry 43.
  • the forwarding action in the entry 40 is a non-repetitive superposition of the forwarding action in the entry 41 to the entry 43.
  • the forwarding action is an example of forwarding through the port Veth_12 of Openflow Bridge_12.
  • VM_11 After VM_11 accesses VM_12 again, VM_11 sends a message for accessing VM_12 through eth_11. For convenience of description, the message is recorded as message 02 here.
  • the Openflow bridge _11 receives the message 02 through Veth_11, and finds that the message 02 does not access the VM_12 packet (that is, the non-first packet) for the VM_11 received by the Openflow bridge _11 for the first time. Then, the Openflow forwarding entry matching the packet 02 (that is, the entry 40 generated by the SDN controller) is searched for in the local Openflow forwarding table.
  • the Openflow bridge _11 transparently transmits the message 02 to the Veth_l2 of the Openflow bridge _12 according to the forwarding action in the found entry 40, and causes the Openflow bridge _12 to forward the message 02 through the Veth_12, and finally, the message sent by the VM_11 02 Will reach VM_12, which means that VM_11 accesses VM_12 again.
  • FIG. 5 is a schematic diagram of an application networking in another example.
  • the application networking of FIG. 5 is only taking the network of one of the servers of the cloud platform as an example.
  • VM_21 is connected to the virtual network card Veth_21 of Openflow Bridge_21 through the local port eth_21
  • VM_22 is connected to the virtual network card Veth_22 of Openflow Bridge _22 through the local port eth_22
  • VM_2n is connected to the Openflow bridge through the local port eth_2n.
  • _2n virtual network card Veth_2n virtual network card Veth_2n.
  • Openflow bridge _21 is connected to BR-Int port Patch_Int_21 through port Patch_VM_21
  • Openflow bridge _22 is connected to BR-Int port Patch_Int_22 through port Patch_VM_22, and so on
  • Openflow bridge _2n is connected to BR through port Patch_VM_2n Port of the -Int patch_Int_2n
  • the port Patch_VM_21 on the Openflow bridge _21 and the port Patch_Int_21 on the BR-Int are a pair of peers
  • the port type is Patch
  • the port on the Openflow bridge _22 is patch_VM_22 and the port on the BR-Int Patch_Int_22 is a pair of peers
  • the port type is patch, and so on.
  • the port Patch_VM_2n on the Openflow bridge_2n and the port Patch_Int_2n on the BR-Int are a pair of peers, and the port type is patch.
  • BR-Int is connected to port Patch_51 on BR-Ext through port Patch_50.
  • the port type of Patch_50 and Patch_51 is Patch.
  • VM_21 in Fig. 5 up to VM_2n, Openflow bridge_21 up to Openflow bridge_2n, BR-Int, BR-Ext are located on the same server.
  • VM_21 accesses the physical network host PM_21 as an example.
  • VM_21 sends a message for accessing PM_21 through eth_21, which is convenient for description. The message is recorded as message 21.
  • the Openflow bridge _21 receives the packet 21 through the Veth_21, and finds that the packet 21 is the packet that the VM_21 first accesses to the PM_21 (that is, the first packet) received by the OpenFlow bridge _21, and the packet carried by the Veth_21 and the packet 21
  • the attribute parameter is used as a keyword to search for an Openflow security entry whose matching condition is the keyword in the locally pre-configured Openflow security table.
  • the Openflow bridge _21 If the Openflow bridge _21 does not find the Openflow security entry, the Openflow bridge _21 directly discards the message 21;
  • the packet 21 continues to pass the port of the Openflow bridge_21 according to the forwarding action in the entry 51. Patch_VM_21 is sent out.
  • the Openflow forwarding entry matching the packet 21 is found in the local Openflow forwarding table (the found Openflow forwarding entry is recorded as the entry 52).
  • the forwarding action in item 52 forwards message 21 through port Patch_50.
  • the BR-Ext receives the packet 21 through the patch_51, and finds the Openflow forwarding entry matching the packet 21 in the local Openflow forwarding table (here, the found Openflow security entry is recorded as the entry 53), according to the search.
  • the encapsulation operation in the forwarding operation of the entry 53 causes the packet 21 to be VXLAN encapsulated and forwarded through the physical port Port_21 according to the forwarding operation in the forwarding action in the found entry 53.
  • the message 21 sent by VM_21 will reach PM_21, which realizes that VM_21 accesses PM_21.
  • the SDN controller on the cloud platform further forwards the entry 21 of the message 21 through the Openflow bridge _21 during the forwarding process of the message 21 from the Openflow bridge _21, BR-Int, and BR-Ext.
  • the text 21 is superimposed by the entry 52 found in the BR-Int and the entry 53 found by the message 21 through the BR-Ext to generate a match with the message 21.
  • the Openflow forwarding entry (denoted as entry 50) is sent to the Openflow forwarding table of Openflow Bridge_21.
  • the matching condition in the entry 50 is a non-repetitive superposition of the matching condition in the entry 51 to the entry 53.
  • the forwarding action in the entry 50 is a non-repetitive superposition of the forwarding action in the entry 51 to the entry 53.
  • the forwarding action is performed by VXLAN encapsulation and forwarding through the physical port Port_21.
  • VM_21 After VM_21 accesses PM_21 again, VM_21 sends a message for accessing PM_21 through eth_21. For convenience of description, the message is recorded as message 22.
  • the Openflow bridge _21 receives the packet 22 through the Veth_21, and finds that the packet 22 does not access the PM_22 packet (that is, the non-first packet) of the VM_21 received by the OpenFlow bridge _21 for the first time, and then searches and searches the local Openflow forwarding table.
  • the Openflow forwarding entry matched by the packet 22 that is, the entry 50 generated by the SDN controller described above).
  • the Openflow bridge _21 encapsulates the packet 22 in the VXLAN according to the forwarding action in the found entry 50 and transparently transmits it to the physical port Port_21 of the BR-Ext, so that the BR-Ext forwards the VXLAN encapsulated packet through the physical port Port_21. 22, finally, the message 22 sent by VM_21 will reach VM_21, that is, VM_21 is accessed again to access PM_21.
  • FIG. 6 is a structural diagram of an apparatus for implementing cloud platform security based on an Openflow table provided in an example of the present application.
  • the device is applied to an Openflow bridge created on the cloud server in the cloud platform to replace the MAC bridge.
  • the Openflow bridge is connected between the VM and the BR-Int on the cloud server.
  • the device may include: an Openflow entry storage unit 601.
  • the Openflow entry storage unit 601 is configured to store a pre-configured Openflow security table.
  • the outgoing traffic control unit 602 is configured to receive the first packet sent by the local VM, and receive The first port of the first packet and the packet attribute parameter carried in the first packet are used as the first keyword to search for Openflow security in the Openflow security table stored in the Openflow entry storage unit as the first keyword. If the entry is found, the first packet is forwarded according to the forwarding action in the found Openflow security entry. If the entry is not found, the first packet is discarded.
  • the inbound traffic control unit 603 is configured to receive the second packet sent to the VM, and use the second port of the second packet and the packet attribute parameter carried by the second packet as the second keyword in the Openflow.
  • the Openflow security table stored in the entry storage unit searches for an Openflow security entry whose matching condition is the second keyword. If found, the second packet is forwarded according to the forwarding action in the found Openflow security entry, if not found. Go to, discard the second message.
  • the Openflow entry storage unit 601 can further store an Openflow forwarding table.
  • the forwarding of the first packet according to the forwarding action in the found Openflow security entry may include: when the first packet is the first packet, the second port on the Openflow bridge is used. Transmitting the first packet on the third port of the BR-Int and the second port that is a pair of peers; and when the first packet is not the first packet, the Openflow stored in the Openflow entry storage unit 601
  • the Openflow forwarding entry matching the first packet is forwarded, and the first packet is forwarded according to the forwarding action in the found Openflow forwarding entry.
  • the Openflow entry storage unit 601 When the first packet is the first packet, the Openflow entry storage unit 601 further receives an Openflow forwarding entry that is generated and sent by the controller in the cloud platform and matches the first packet, and the received Openflow is transferred.
  • the published item is stored in the local Openflow forwarding table.
  • the Openflow forwarding entry matching the first packet is the first packet.
  • the Openflow forwarding entry matching the first packet is the first packet that is found when the first packet is accessed through the Openflow bridge.
  • the Openflow security entry matching the packet, the Openflow forwarding entry matched by the first packet when the first packet is received by the BR-Int, and the first packet obtained by the external bridge BR-Ext A combination of Openflow forwarding entries matching a message.
  • the Openflow bridge, BR-Int, and BR-Ext on the cloud server are connected through a port of the port type.
  • the inbound traffic control unit 603 forwarding the second packet according to the forwarding action in the found Openflow security entry may include: sending, by the Openflow bridge, the first port of the VM to the VM Second message.
  • FIG. 7 is a hardware structural diagram of an apparatus for implementing cloud platform security based on an Openflow table shown in FIG. 6 according to the present invention.
  • the hardware structure diagram can include a memory 710, a processor 720 communicatively coupled to the memory 710, and an interface 730.
  • the memory 710 may be a non-volatile storage medium storing computer executable instructions executable by the processor 720, which may implement cloud platform security as shown in any of FIGS. 3A-5. The operation of the method.
  • the computer executable instructions may also implement the operation of the apparatus for implementing cloud platform security based on the Openflow table shown in FIG. 6.
  • the memory 710 stores the Openflow entry storage unit 601, the outgoing flow control unit 602, and the incoming flow control unit 603 in FIG. 6 described above.
  • the processor 720 is configured to execute a control program run by the Openflow entry storage unit 601. The operation as described above is performed in the Openflow entry storage unit 601 in the control memory 710; a control program for executing the operation of the flow control unit 602 to control the outflow control unit 602 in the memory 710 to perform the operations as described above; A control program for executing the operation of the inflow control unit 603 to control the inflow control unit 603 in the memory 710 performs the operations as described above.
  • the application provides a method and apparatus for implementing cloud platform security.
  • an Openflow bridge for replacing a MAC bridge is created on a cloud server in a cloud platform, and an Openflow bridge implements cloud platform security through an Openflow security table, which achieves the purpose of implementing cloud platform security based on the Openflow table, and improves the security of the cloud platform. Controllable performance; and, in this application, since the Openflow bridge implements cloud platform security using an Openflow type flow table, this can be combined with other bridges on the cloud server such as BR-Int, BR-Ext (also using Openflow type flow) Table) Unified use of the same flow table management to simplify network configuration and management.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了实现云平台安全的方法和装置。本申请中，云平台中的云服务器上创建用于代替MAC桥的Openflow桥，Openflow桥通过Openflow安全表实现云平台安全。

Description

实现云平台安全
背景
安全一直是各云平台的必选特性，在目前的开源云平台和非开源云平台中，都是通过动态学习的ip表(iptable)和二层MAC转发表实现云平台安全的。
以开源云平台Openstack为例，非开源云平台原理类似。图1示出了开源云平台Openstack中任一云服务器的结构图。Linux内核的原生桥(qbr网桥，也称为MAC桥)，如图1所示的MAC bridge_1、MAC bridge_2、MAC bridge_3是通过动态学习的iptable和二层MAC转发表实现开源云平台Openstack安全。以如图1所示的虚拟机(VM：Virtual Machine)1发送报文至VM2为例，VM1通过本地接口eth0发送报文，MAC桥通过VM1的虚拟网卡(Veth：Virtual ethernet)在MAC桥的端口Veth1接收到来自VM1发送的报文，依赖于之前动态学习的iptable对报文进行过滤识别，依赖于动态学习的二层MAC转发表继续转发通过过滤的报文。
附图简要说明
图1示出了开源云平台Openstack中任一云服务器的结构图；
图2为本申请例子中提供的云平台中任一云服务器的结构图；
图3A为本申请例子中提供的基于开放流(Openflow)表实现云平台安全的方法流程图；
图3B为本申请例子中提供的源Openflow桥根据查找到的Openflow安全表中的转发动作转发第一报文的流程示意图。
图4为本申请一个例子中提供的应用组网的结构示意图；
图5为本申请又一个例子中提供的应用组网的结构示意图；
图6为本申请例子中提供的基于Openflow表实现云平台安全的装置结构图；
图7为本申请例子中提供的基于Openflow表实现云平台安全的装置硬件结构图。
实施本申请的方式
目前云平台中云服务器上的MAC桥在实现开源云平台Openstack安全时是基于iptable和二层MAC转发表实现，而iptable和二层MAC转发表的可控制性比较差，远远不如Openflow表。并且，目前云平台中云服务器上的其他网桥比如内部桥(BR-Int)、外部桥((BR-Ext)内的表项都是Openflow表，因此，同一云服务器上MAC桥上的iptable和二层MAC转发表会和其他网桥上的Openflow表不统一。
为了使本申请的目的、技术方案和优点更加清楚，下面结合附图和具体实施例对本申请进行详细描述。
本申请中，为实现基于Openflow表实现云平台安全，在云平台中的云服务器上创建Openflow桥，由Openflow桥替换背景技术部分描述的MAC桥来实现云平台安全，图2示出了本申请提供的云平台中任一云服务器的结构图。如图2所示，Openflow桥的位置与背景技术部分描述的MAC桥的位置相同，连接在VM和BR-Int之间，但相比于MAC桥通过动态学习的iptable和二层MAC转发表实现云平台安全，本申请中，Openflow桥是基于预先配置的Openflow安全表实现云平台安全。
本申请中，Openflow安全表包含多条Openflow安全表项，每一Openflow安全表项包含以下两部分：匹配条件和转发动作。
作为本申请的一个例子，这里的匹配条件可包含报文接收端口、报 文携带的报文属性参数。在一个例子中，报文携带的报文属性参数可以为报文五元组或者七元组中的至少一个。其中，报文五元组为：目的IP地址、源IP地址、目的端口号、源端口号、协议类型；报文七元组为：目的IP地址、源IP地址、目的MAC地址、源MAC地址、目的端口号、源端口号、协议类型。
作为本申请的一个例子，转发动作可以为对匹配Openflow安全表项的报文执行的转发动作。下文具体描述了如何依据Openflow安全表项中的转发动作转发报文，这里暂不赘述。
基于上面的描述，下面对Openflow桥如何基于预先配置的Openflow安全表实现云平台安全的过程进行详细描述。
参见图3A，图3A为本申请提供的基于Openflow表实现云平台安全的的方法流程图。该流程应用于如上所述的Openflow桥，如图3A所示，该流程可包括以下步骤：
步骤301，接收报文。
本步骤中，所述报文可以为来自本地VM发送的第一报文；或者也可以为发向本地VM的第二报文。
需要说明的是，这里的第一报文、第二报文只是为便于区分VM发送的报文和发向VM的报文，并非限定本申请。
步骤302，当所述报文为来自本地VM发送的报文，或者为发向本地VM的报文时，将接收到所述报文的端口、所述报文携带的报文属性参数作为关键词在本地预先配置的Openflow安全表中查找匹配条件为所述关键词的Openflow安全表项，若查找到，依据查找到的Openflow安全表项中的转发动作转发所述报文，若未查找到，丢弃所述报文。
为便于描述，当Openflow桥接收来自本地VM发送的第一报文，则称Openflow桥为源Openflow桥，而当Openflow桥接收发向本地VM 的第二报文，则称Openflow桥为目的Openflow桥。以下均以Openflow桥细分源Openflow桥和目的Openflow桥描述。
源Openflow桥将收到第一报文的第一端口、第一报文携带的报文属性参数作为第一关键词在本地预先配置的Openflow安全表中查找匹配条件为第一关键词的Openflow安全表项，若查找到，依据查找到的Openflow安全表项中的转发动作转发第一报文，若未查找到，丢弃第一报文。
目的Openflow桥将收到第二报文的第二端口、第二报文携带的报文属性参数作为第二关键词在本地预先配置的Openflow安全表查找匹配条件为所述第二关键词的Openflow安全表项，若查找到，依据查找到的Openflow安全表项中的转发动作通过第一端口向VM转发第二报文，若未查找到，丢弃第二报文。
作为一个例子，依据查找到的Openflow安全表项中的转发动作转发第二报文可包括：通过本Openflow桥连接VM的第一端口向VM发送第二报文。
至此，完成图3A所示的流程。
作为本申请的一个例子，图3B为本申请例子中提供的源Openflow桥根据查找到的Openflow安全表中的转发动作转发第一报文的流程示意图。如图3B所示，源Openflow桥依据查找到的Openflow安全表项中的转发动作转发第一报文可包括：
步骤a1，源Openflow桥确定第一报文是否为首包，在第一报文为首包时，执行步骤a2，在第一报文不为首包时，执行步骤a3。
这里，第一报文是否为首包的确定方式类似现有确定首包的方式，不再展开描述。
步骤a2，源Openflow桥通过本Openflow桥上的第二端口向BR-Int上与所述第二端口互为一对(Peer)的第三端口转发第一报文。结束当前流程。
本步骤a2是在第一报文为首包的前提下执行的。
本申请中，在第一报文为首包时，当源Openflow桥通过本Openflow桥上第二端口向BR-Int上与第二端口互为一对(Peer)的第三端口发送第一报文后，第一报文会到达BR-Int上的第三端口。当BR-Int通过第三端口收到第一报文后，会在本地Openflow转发表中查找到与第一报文匹配的Openflow转发表项，记为表项1，按照查找到的表项1中的转发动作继续转发第一报文。
当第一报文的目的设备是同一云服务器上的其他VM时，上述BR-Int查找到的表项1中的转发动作就是：通过本BR-Int上的第四端口发送第一报文至接入目的设备的Openflow桥(即为目的Openflow桥)上与第四端口互为Peer的第五端口，基于此，BR-Int就会通过本BR-Int上的第四端口向目的Openflow桥上与第四端口互为Peer的第五端口发送第一报文。当目的Openflow桥通过第五端口收到第一报文时，因为第一报文是发向本地VM的，则目的Openflow桥就会按照类似步骤303的描述，依据收到第一报文的第五端口、第一报文携带的报文属性参数在本地预先配置的Openflow安全表查找匹配的Openflow安全表项，记为表项2，若查找到，依据查找到的表项2中的转发动作通过连接目的设备的出端口发送第一报文至目的设备，最终，第一报文会到达目的设备，若未查找到，丢弃第一报文。
当第一报文的目的设备是物理网络上的主机或者不同云服务器上其他VM时，BR-Int查找到的表项1中的转发动作就是：通过本BR-Int上第六端口发送第一报文至BR-Ext上与第六端口互为Peer的第七端口， 基于此，BR-Int就会通过本BR-Int上的第六端口向BR-Ext上与第六端口互为Peer的第七端口发送第一报文。当BR-Ext收到第一报文后，会在本地Openflow转发表中查找到与第一报文匹配的Openflow转发表项，记为表项3，依据查找到的表项3中的转发动作继续转发第一报文。这里，查找到的表项3中的转发动作可以为：对第一报文进行VXLAN封装，并通过BR-Ext上物理端口(到达目的设备的路由出端口)转发VXLAN封装后的第一报文，最终，第一报文会到达目的设备。
基于上面描述的第一报文为发向目的设备的首包且目的设备为同一云服务器上其他VM时第一报文在源Openflow桥、BR-Int、目的Openflow桥的转发，或者第一报文为发向目的设备的首包且目的设备为物理网络上的主机或者不同云服务器上的其他VM时第一报文在源Openflow桥、BR-Int、BR-Ext的转发描述，本申请中，云平台上的控制器比如SDN控制器还可进一步动态生成用于转发第一报文的Openflow转发表项，记为表项4，并下发至源Openflow桥进行存储。例如，存储在源Openflow桥的Openflow转发表中。
在本申请中，当第一报文是发向目的设备的首包且目的设备为同一云服务器上其他VM时，表项4就是按照无重复原则对第一报文经由源Openflow桥、BR-Int、目的Openflow桥时查找到的与第一报文匹配的Openflow表项进行组合形成的表项；举例描述，当第一报文是发向目的设备的首包且目的设备为同一云服务器上其他VM时，基于上面描述的第一报文在源Openflow桥、BR-Int、目的Openflow桥的转发，则表项4的匹配条件就是第一报文经由源Openflow桥时查找到的与第一报文匹配的Openflow安全表项中的匹配条件、第一报文经由BR-Int时查找到的与第一报文匹配的Openflow转发表项中的匹配条件、第一报文经由目的Openflow桥时查找到的与第一报文匹配的Openflow安全表项中的 匹配条件的组合(注意，最终组合的匹配条件需保证没有重复的内容)，表项4的转发动作就是第一报文经由源Openflow桥时查找到的与第一报文匹配的Openflow安全表项中的转发动作、第一报文经由BR-Int时查找到的与第一报文匹配的Openflow转发表项中的转发动作、第一报文经由目的Openflow桥时查找到的与第一报文匹配的Openflow安全表项中的转发动作的组合(注意，最终组合的转发动作中可省略掉中间环节的转发操作，即仅保留上面描述的表项2中的转发操作)。
而当第一报文是发向目的设备的首包且目的设备为物理网络上的主机或者不同云服务器上的其他VM时，表项4就是按照无重复原则对第一报文经由的源Openflow桥、BR-Int、BR-Ext时查找到的与第一报文匹配的Openflow表项进行组合形成的表项。举例描述，当第一报文是发向目的设备的首包且目的设备为物理网络上的主机或者不同网络节点上的其他VM时，基于上面描述的第一报在源Openflow桥、BR-Int、BR-Ext的转发，则表项4的匹配条件就是第一报文经由源Openflow桥时查找到的与第一报文匹配的Openflow安全表项中的匹配条件、第一报文经由BR-Int时查找到的与第一报文匹配的Openflow转发表项中的匹配条件、第一报文经由BR-Ext时与第一报文匹配的Openflow转发表项中的匹配条件的组合(注意，最终组合的匹配条件需保证没有重复的内容)，表项4的转发动作就是第一报文经由源Openflow桥时查找到的与第一报文匹配的Openflow安全表项中的转发动作、第一报文经由BR-Int时查找到的与第一报文匹配的Openflow转发表项中的转发动作、第一报文经由BR-Ext时与第一报文匹配的Openflow转发表项中的转发动作的组合(注意，最终组合的转发动作中可省略掉中间环节的转发操作，但其他非转发操作比如VXLAN封装等不需要省略)。
基于上面描述的表项4可以看出，在第一报文为发向目的设备的首 包时，不管目的设备为同一云服务器上其他VM，还是为物理网络上的主机或者不同云服务器上的其他VM，表项4最终汇聚了第一报文经由云服务器上各个网桥时查找到的匹配的Openflow表项，这能够保证后续发向目的设备的非首包直接在源Openflow桥执行一次Openflow转发表项查找，不必再在云服务器中的其他各个网桥查找Openflow表项就能转发至目的设备，提高报文转发效率，具体见步骤a3。
步骤a3，源Openflow桥在本地Openflow转发表中查找与第一报文匹配的Openflow转发表项(也即上述的表项4)，按照查找到的Openflow转发表项中的转发动作转发第一报文。结束当前流程。
本步骤a3是在第一报文为非首包的前提下执行的。
基于上面描述的表项4可以看出，表项4汇聚了发向目的设备的首包经由云服务器中各个网桥时查找到的与首包匹配的Openflow表项，基于此，当第一报文为发向目的设备的非首包时，本步骤a3中源Openflow桥在本地Openflow转发表中查找到的与第一报文匹配的Openflow转发表项也即为上述的表项4，因为表项4汇聚了发向目的设备的首包经由云服务器中各个网桥时查找到的与首包匹配的Openflow表项，基于此，本步骤a3中按照查找到的Openflow转发表项中的转发动作转发第一报文，也就意味着第一报文直接穿越云服务器中各个网桥进行转发，实现了只需在源Openflow桥执行一次Openflow转发表，不必再在云服务器中其他各个网桥查找Openflow表项就能转发至第一报文至目的设备，提高了报文转发效率。
举例描述，以报文p1为发向目的设备(同一云服务器中其他VM)的非首包为例，当源Openflow桥收到报文p1时，发现报文p1为发向目的设备的非首包，则在本地Openflow转发表中查找到与报文p1匹配的Openflow转发表项，按照查找到的Openflow转发表项中的转发动作 转发报文p1。这里与报文p1匹配的Openflow转发表项是对发向目的设备的首包经由源Openflow桥、BR-Int、目的Openflow桥时查找到的匹配的Openflow表项的叠加，如此，按照查找到的Openflow转发表项中的转发动作转发报文p1最终是穿越源Openflow桥、BR-Int、目的Openflow桥将报文p1发向目的Openflow桥上连接目的设备的端口，直接通过该端口转发即可，无需再在BR-Int、目的Openflow桥上查找Openflow表项转发。
本申请中，为了保证步骤a1至步骤a3顺利实现，可限定同一云服务器中的各个网桥之间通过端口类型为Patch的端口联通，具体为：源Openflow桥上第二端口、BR-Int上与第二端口互为Peer的第三端口、BR-Int上第四端口、目的Openflow桥上与第四端口互为Peer的第五端口、BR-Int上第六端口、BR-Ext上与第六端口互为Peer的第七端口的端口类型都为Patch。端口类型为Patch，能够保证首包在穿越类型为patch的端口联通的各个Openflow类型的网桥(实质是具有Openflow表项的网桥，即Openflow桥、BR-Int、BR-Ext等)时，会自动组合所有Openflow类型的网桥的Openflow表项，最终生成一条Openflow转发表项(如上述步骤a2中当第一报文为首包时生成的表项4)指导后续非首包的流量转发。
以上对步骤302进行了描述。
下面通过两个具体例子对图3A所示方法流程进行描述：
图4为一个例子中的应用组网示意图。图4的应用组网仅以云平台的其中一个服务器的网络为例。如图4所示，VM_11通过本地端口eth_11连接Openflow桥_11上的虚拟网卡Veth_11，VM_12通过本地端口eth_12连接至Openflow桥_12的虚拟网卡Veth_12，依次类推，VM_1n通过本 地端口eth_1n连接至Openflow桥_1n的虚拟网卡Veth_1n。在图4中，Openflow桥_11通过端口Patch_VM_11连接至BR-Int的端口Patch_Int_11，Openflow桥_12通过端口Patch_VM_12连接至BR-Int的端口Patch_Int_12，依次类推，Openflow桥_1n通过端口Patch_VM_1n连接至BR-Int的端口Patch_Int_1n，其中，Openflow桥_11上的端口Patch_VM_11与BR-Int上的端口Patch_Int_11互为一对Peer，端口类型为Patch，Openflow桥_12上的端口Patch_VM_12与BR-Int上的端口Patch_Int_12互为一对Peer，端口类型为Patch，依次类推，Openflow桥_1n上的端口Patch_VM_1n与BR-Int上的端口Patch_Int_1n互为一对Peer，端口类型为Patch。在图4中，BR-Int通过端口Patch_40连接至BR-Ext上的端口Patch_41，Patch_40、Patch_41的端口类型为Patch。在图4中的VM_11直至VM_1n、Openflow桥_11直至Openflow桥_1n、BR-Int、BR-Ext位于同一云服务器上。
在本例子中，以VM_11访问VM_12为例，则，
VM_11通过eth_11发送用于访问VM_12的报文，为便于描述，这里将报文记为报文01。
Openflow桥_11通过Veth_11收到报文01，发现报文01为本Openflow桥_11首次收到的VM_11访问VM_12的报文(即为首包)，则以Veth_11、以及报文01携带的报文属性参数作为关键词在本地预先配置的Openflow安全表中查找匹配条件为该关键词的Openflow安全表项。
假如Openflow桥_11未查找到Openflow安全表项，则Openflow桥_11直接丢弃报文01。
假如Openflow桥_11查找到Openflow安全表项(将该查找到的Openflow安全表项记为表项41)，则按照表项41中的转发动作继续将 报文01通过本Openflow桥_11的端口Patch_VM_11发送出去。
BR-Int通过Patch_Int_11收到报文01时，在本地的Openflow转发表中查找到与报文01匹配的Openflow转发表项(将该查找到的Openflow转发表项记为表项42)，按照表项42中的转发动作将报文01通过端口Patch_Int_12转发。
Openflow桥_12通过Patch_VM_12接收到报文01，发现报文01是发向VM_12的，则以Patch_VM_12、报文01携带的报文属性参数作为关键词在本地预先配置的Openflow安全表中查找到匹配条件为该关键词的Openflow安全表项，如果查找到，这里将该查找到的Openflow安全表项记为表项43，则按照表项43中的转发动作通过本Openflow桥_12的端口Veth_12发送报文01。最终，VM_11发送的报文01会到达VM_12，即实现了VM_11访问VM_12。
云平台上的SDN控制器在报文01从Openflow桥_11、BR-Int、Openflow桥_12三者的转发过程中，进一步将报文01经由Openflow桥_11时查找到的表项41、报文01经由BR-Int时查找到的表项42、以及报文01经由Openflow桥_12时查找到的表项43进行叠加生成一个与报文01匹配的Openflow转发表项(记为表项40)下发至Openflow桥_11的Openflow转发表。该表项40中的匹配条件为表项41至表项43中匹配条件的无重复叠加，该表项40中的转发动作为表项41至表项43中转发动作的无重复叠加，这里以转发动作为通过Openflow桥_12的端口Veth_12转发为例。
之后，VM_11再次访问VM_12时，VM_11通过eth_11发送用于访问VM_12的报文，为便于描述，这里将报文记为报文02。
Openflow桥_11通过Veth_11收到报文02，发现报文02不为本Openflow桥_11首次收到的VM_11访问VM_12的报文(即为非首包)， 则在本地Openflow转发表中查找与报文02匹配的Openflow转发表项(即上述SDN控制器生成的表项40)。
Openflow桥_11按照查找到的表项40中的转发动作将报文02透传至Openflow桥_12的Veth_l2，触使Openflow桥_12通过Veth_12转发报文02，最终，VM_11发送的报文02会到达VM_12，即实现了VM_11再次访问VM_12。
图5为另一个例子中的应用组网示意图。图5的应用组网仅以云平台的其中一个服务器的网络为例。如图5所示，VM_21通过本地端口eth_21连接至Openflow桥_21的虚拟网卡Veth_21，VM_22通过本地端口eth_22连接至Openflow桥_22的虚拟网卡Veth_22，依次类推，VM_2n通过本地端口eth_2n连接至Openflow桥_2n的虚拟网卡Veth_2n。在图5中，Openflow桥_21通过端口Patch_VM_21连接至BR-Int的端口Patch_Int_21，Openflow桥_22通过端口Patch_VM_22连接至BR-Int的端口Patch_Int_22，依次类推，Openflow桥_2n通过端口Patch_VM_2n连接至BR-Int的端口Patch_Int_2n，其中，Openflow桥_21上的端口Patch_VM_21与BR-Int上的端口Patch_Int_21互为一对Peer，端口类型为Patch，Openflow桥_22上的端口Patch_VM_22与BR-Int上的端口Patch_Int_22互为一对Peer，端口类型为Patch，依次类推，Openflow桥_2n上的端口Patch_VM_2n与BR-Int上的端口Patch_Int_2n互为一对Peer，端口类型为Patch。在图5中，BR-Int通过端口Patch_50连接至BR-Ext上的端口Patch_51，Patch_50、Patch_51的端口类型为Patch。在图5中的VM_21直至VM_2n、Openflow桥_21直至Openflow桥_2n、BR-Int、BR-Ext位于同一服务器上。
在本例子中，以VM_21访问物理网络主机PM_21为例，则，
VM_21通过eth_21发送用于访问PM_21的报文，为便于描述，这 里将报文记为报文21。
Openflow桥_21通过Veth_21收到报文21，发现报文21为本Openflow桥_21首次收到的VM_21访问PM_21的报文(即为首包)，则以Veth_21、以及报文21携带的报文属性参数作为关键词在本地预先配置的Openflow安全表中查找匹配条件为该关键词的Openflow安全表项；
假如Openflow桥_21未查找到Openflow安全表项，则Openflow桥_21直接丢弃报文21；
假如Openflow桥_21查找到Openflow安全表项(将该查找到的Openflow安全表项记为表项51)，则按照表项51中的转发动作继续将报文21通过本Openflow桥_21的端口Patch_VM_21发送出去。
BR-Int通过Patch_Int_21收到报文21时，在本地的Openflow转发表中查找到与报文21匹配的Openflow转发表项(将该查找到的Openflow转发表项记为表项52)，按照表项52中的转发动作将报文21通过端口Patch_50转发。
BR-Ext通过Patch_51接收到报文21，在本地的Openflow转发表中查找到与报文21匹配的Openflow转发表项(这里将该查找到的Openflow安全表项记为表项53)，按照查找到的表项53中转发动作中的封装操作将报文21进行VXLAN封装并按照查找到的表项53中转发动作中的转发操作通过物理端口Port_21转发出去。最终，VM_21发送的报文21会到达PM_21，即实现了VM_21访问PM_21。
云平台上的SDN控制器在报文21从Openflow桥_21、BR-Int、BR-Ext三者的转发过程中，进一步将报文21经由Openflow桥_21时查找到的表项51、报文21经由BR-Int时查找到的表项52、以及报文21经由BR-Ext时查找到的表项53进行叠加生成一个与报文21匹配的 Openflow转发表项(记为表项50)下发至Openflow桥_21的Openflow转发表。该表项50中的匹配条件为表项51至表项53中匹配条件的无重复叠加，该表项50中的转发动作为表项51至表项53中转发动作的无重复叠加，这里以转发动作为进行VXLAN封装并通过物理端口Port_21转发为例。
之后，VM_21再次访问PM_21时，VM_21通过eth_21发送用于访问PM_21的报文，为便于描述，这里将报文记为报文22。
Openflow桥_21通过Veth_21收到报文22，发现报文22不为本Openflow桥_21首次收到的VM_21访问PM_22的报文(即为非首包)，则在本地Openflow转发表中查找与报文22匹配的Openflow转发表项(即上述SDN控制器生成的表项50)。
Openflow桥_21按照查找到的表项50中的转发动作将报文22进行VXLAN封装并透传至BR-Ext的物理端口Port_21，触使BR-Ext通过物理端口Port_21转发VXLAN封装后的报文22，最终，VM_21再次发送的报文22会到达VM_21，即实现了VM_21再次访问PM_21。
至此，完成本申请提供的方法描述。下面对本申请提供的装置进行描述。
参见图6，图6为本申请例子中提供的基于Openflow表实现云平台安全的装置结构图。该装置应用于在云平台中云服务器上创建出的用于代替MAC桥的Openflow桥，Openflow桥连接在云服务器上的VM和BR-Int之间，该装置可包括：Openflow表项存储单元601、出流量控制单元602和入流量控制单元603。
其中，Openflow表项存储单元601用于存储预先配置的Openflow安全表。
出流量控制单元602用于接收来自本地VM发送的第一报文，将收 到第一报文的第一端口、第一报文携带的报文属性参数作为第一关键词在所述Openflow表项存储单元存储的Openflow安全表中查找匹配条件为第一关键词的Openflow安全表项，若查找到，依据查找到的Openflow安全表项中的转发动作转发第一报文，若未查找到，丢弃第一报文。
入流量控制单元603用于接收发向所述VM的第二报文，将收到第二报文的第二端口、第二报文携带的报文属性参数作为第二关键词在所述Openflow表项存储单元存储的Openflow安全表查找匹配条件为所述第二关键词的Openflow安全表项，若查找到，依据查找到的Openflow安全表项中的转发动作转发第二报文，若未查找到，丢弃第二报文。
优选地，Openflow表项存储单元601可进一步存储Openflow转发表。
基于此，所述出流量控制单元602依据查找到的Openflow安全表项中的转发动作转发第一报文可包括：在所述第一报文为首包时，通过本Openflow桥上第二端口向BR-Int上与所述第二端口互为一对Peer的第三端口发送第一报文；在所述第一报文不为首包时，在所述Openflow表项存储单元601存储的Openflow转发表中查找与第一报文匹配的Openflow转发表项，按照查找到的Openflow转发表项中的转发动作转发第一报文。
其中，在所述第一报文为首包时，所述Openflow表项存储单元601进一步接收云平台中控制器生成并下发的与第一报文匹配的Openflow转发表项，将接收的Openflow转发表项存储至本地Openflow转发表中.
其中，当第一报文是所述VM发向目的设备的首包且目的设备为同一云服务器上的其他VM时，与第一报文匹配的Openflow转发表项为所述第一报文经由本Openflow桥时查找到的与第一报文匹配的Openflow安全表项、第一报文经由BR-Int时查找到的与第一报文匹配 的Openflow转发表项、第一报文经由所述目的设备接入的目的Openflow桥时查找到的与第一报文匹配的Openflow安全表项的组合；当第一报文是发向目的设备的首包且目的设备为物理网络上的主机或者不同云服务器上的其他VM时，与第一报文匹配的Openflow转发表项是所述第一报文经由本Openflow桥时查找到的与第一报文匹配的Openflow安全表项、第一报文经由BR-Int时查找到的与第一报文匹配的Openflow转发表项、第一报文经由外部网桥BR-Ext时查找到的与第一报文匹配的Openflow转发表项的组合。
在一个例子中，云服务器上的Openflow桥、BR-Int、BR-Ext通过端口类型为Patch的端口联通。
在一个例子中，所述入流量控制单元603依据查找到的Openflow安全表项中的转发动作转发第二报文可包括：通过所述Openflow桥连接所述VM的第一端口向所述VM发送第二报文。
至此，完成图6所示的装置结构描述。
本发明还提供了图6所示装置的硬件结构图。参见图7，图7为本发明提供的图6所示基于Openflow表实现云平台安全的装置的硬件结构图。如图7所示，该硬件结构图可包括：存储器710、与存储器710通信连接的处理器720、以及接口730。其中存储器710可以为非易性存储介质，其存储有可由处理器720执行的计算机可执行指令，该计算机可执行指令可实现如图3A至图5中任一图中所示实现云平台安全的方法的操作。此外，所述计算机可执行指令也可实现图6所示基于Openflow表实现云平台安全的装置的操作。
或者，也可以理解为该存储器710存储有上述图6中的Openflow表项存储单元601、出流量控制单元602和入流量控制单元603。相应地，处理器720用于执行Openflow表项存储单元601运行的控制程序 以控制存储器710中的Openflow表项存储单元601执行如上所述的操作；用于执行出流量控制单元602运行的控制程序以控制存储器710中的出流量控制单元602执行如上所述的操作；以及用于执行入流量控制单元603运行的控制程序以控制存储器710中的入流量控制单元603执行如上所述的操作。
本申请提供了实现云平台安全的方法和装置。本申请中，云平台中的云服务器上创建用于代替MAC桥的Openflow桥，Openflow桥通过Openflow安全表实现云平台安全，这达到了基于Openflow表实现云平台安全的目的，提高了云平台安全的可控制性能；并且，本申请中，由于Openflow桥采用Openflow类型的流表实现云平台安全，这可以与云服务器上的其他网桥比如BR-Int、BR-Ext(也采用Openflow类型的流表)统一采用相同的流表管理，简化网络配置和管理。
以上所述仅为本申请的较佳实施例而已，并不用以限制本申请，凡在本申请的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本申请保护的范围之内。

Claims (10)

  1. 一种实现云平台安全的方法，其特征在于，该方法应用于在云平台中的云服务器上创建出的用于代替MAC桥的Openflow桥，Openflow桥位于所述云服务器上的虚拟机VM和内部桥BR-Int之间，该方法包括：
    接收报文；
    当所述报文为来自本地VM发送的报文，或者为发向本地VM的报文时，将接收到所述报文的端口、以及所述报文携带的报文属性参数作为关键词在本地预先配置的Openflow安全表中查找匹配条件为所述关键词的Openflow安全表项，若查找到，依据查找到的Openflow安全表项中的转发动作转发所述报文，若未查找到，丢弃所述报文。
  2. 根据权利要求1所述的方法，当所述报文为来自本地VM发送的报文，且接收到所述报文的端口为第一端口时，所述依据查找到的Openflow安全表项中的转发动作转发所述报文，具体包括：
    在所述报文为首包时，通过本Openflow桥上的第二端口向BR-Int上与所述第二端口互为一对Peer的第三端口发送所述报文；
    在所述报文不为首包时，在本地Openflow转发表中查找与所述报文匹配的Openflow转发表项，按照查找到的Openflow转发表项中的转发动作转发所述报文。
  3. 根据权利要求2所述的方法，在所述所述报文为首包时，该方法进一步包括：
    接收云平台中控制器生成并下发的与所述报文匹配的Openflow转发表项，在本地Openflow转发表中存储接收的Openflow转发表项；
    其中，当所述报文是所述VM发向目的设备的首包且目的设备为同 一云服务器上的其他VM时，与所述报文匹配的Openflow转发表项为所述报文经由本Openflow桥时查找到的与所述报文匹配的Openflow安全表项、所述报文经由BR-Int时查找到的与所述报文匹配的Openflow转发表项、所述报文经由所述目的设备接入目的Openflow桥时查找到的与所述报文匹配的Openflow安全表项的组合；
    当所述报文是发向目的设备的首包且目的设备为物理网络上的主机或者不同云服务器上的其他VM时，与所述报文匹配的Openflow转发表项是所述报文经由本Openflow桥时查找到的与所述报文匹配的Openflow安全表项、所述报文经由BR-Int时查找到的与所述报文匹配的Openflow转发表项、所述报文经由外部网桥BR-Ext时查找到的与所述报文匹配的Openflow转发表项的组合。
  4. 根据权利要求3所述的方法，所述云服务器上的Openflow桥、BR-Int、BR-Ext通过端口类型为Patch的端口联通。
  5. 根据权利要求1所述的方法，当所述报文为发向本地VM的报文，且接收到所述报文的端口为第二端口时，所述依据查找到的Openflow安全表项中的转发动作转发所述报文，具体包括：
    通过所述Openflow桥连接所述VM的第一端口向所述VM发送所述报文。
  6. 一种实现云平台安全的装置，该装置应用于在云平台中云服务器上创建出的用于代替MAC桥的Openflow桥，Openflow桥位于所述云服务器上的虚拟机VM和内部桥BR-Int之间，该装置包括：处理器和存储器；
    所述存储器中存储有可被所述处理器执行的计算机可执行指令，所述计算机可执行指令用于使所述处理器执行如下操作：接收报文；
    当所述报文为来自本地VM发送的报文，或者为发向本地VM的报 文时，将接收到所述报文的端口、所述报文携带的报文属性参数作为关键词在本地预先存储的Openflow安全表中查找匹配条件为所述关键词的Openflow安全表项，若查找到，依据查找到的Openflow安全表项中的转发动作转发所述报文，若未查找到，丢弃所述报文。
  7. 根据权利要求6所述的装置，当所述报文为来自本地VM发送的报文，且接收到所述报文的端口为第一端口时，所述计算机可执行指令用于使所述处理器具体执行如下操作：
    在所述报文为首包时，通过本Openflow桥上第二端口向BR-Int上与所述第二端口互为一对Peer的第三端口发送第一报文；
    在所述报文不为首包时，在所述Openflow表项存储单元存储的Openflow转发表中查找与所述报文匹配的Openflow转发表项，按照查找到的Openflow转发表项中的转发动作转发所述报文。
  8. 根据权利要求7所述的装置，在所述报文为首包时，所述计算机可执行指令用于使所述处理器进一步执行如下操作：
    接收云平台中控制器生成并下发的与所述报文匹配的Openflow转发表项，将接收的Openflow转发表项存储至本地Openflow转发表中；
    其中，当所述报文是所述VM发向目的设备的首包且目的设备为同一云服务器上的其他VM时，与所述报文匹配的Openflow转发表项为所述报文经由本Openflow桥时查找到的与所述报文匹配的Openflow安全表项、所述报文经由BR-Int时查找到的与所述报文匹配的Openflow转发表项、所述报文经由所述目的设备接入的目的Openflow桥时查找到的与所述报文匹配的Openflow安全表项的组合；
    当所述报文是发向目的设备的首包且目的设备为物理网络上的主机或者不同云服务器上的其他VM时，与所述报文匹配的Openflow转发表项是所述报文经由本Openflow桥时查找到的与所述报文匹配的 Openflow安全表项、所述报文经由BR-Int时查找到的与所述报文匹配的Openflow转发表项、所述报文经由外部网桥BR-Ext时查找到的与所述报文匹配的Openflow转发表项的组合。
  9. 根据权利要求8所述的装置，所述云服务器上的Openflow桥、BR-Int、BR-Ext通过端口类型为Patch的端口联通。
  10. 根据权利要求6所述的装置，当所述报文为发向所述VM的报文，且接收到所述报文的端口为第二端口时，所述计算机可执行指令用于使所述处理器具体执行如下操作：
    通过所述Openflow桥连接所述VM的第一端口向所述VM发送所述报文。
PCT/CN2016/093909 2015-08-07 2016-08-08 实现云平台安全 Ceased WO2017025005A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
JP2018506402A JP6595698B2 (ja) 2015-08-07 2016-08-08 クラウドプラットフォームのセキュリティの実現
US15/745,372 US10887280B2 (en) 2015-08-07 2016-08-08 Cloud platform security achievement
EP16834629.4A EP3313032B1 (en) 2015-08-07 2016-08-08 Cloud platform security realization

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510478224.8 2015-08-07
CN201510478224.8A CN106385365B (zh) 2015-08-07 2015-08-07 基于开放流Openflow表实现云平台安全的方法和装置

Publications (1)

Publication Number Publication Date
WO2017025005A1 true WO2017025005A1 (zh) 2017-02-16

Family

ID=57916401

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/093909 Ceased WO2017025005A1 (zh) 2015-08-07 2016-08-08 实现云平台安全

Country Status (5)

Country Link
US (1) US10887280B2 (zh)
EP (1) EP3313032B1 (zh)
JP (1) JP6595698B2 (zh)
CN (1) CN106385365B (zh)
WO (1) WO2017025005A1 (zh)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106385365B (zh) 2015-08-07 2019-09-06 新华三技术有限公司 基于开放流Openflow表实现云平台安全的方法和装置
CN107547439B (zh) * 2017-09-08 2021-01-05 中国银联股份有限公司 一种网络流量控制方法和计算节点
CN108183862B (zh) * 2018-01-24 2021-02-09 上海宽带技术及应用工程研究中心 软件定义交换网的通信方法/系统、可读存储介质及设备
CN109309663B (zh) * 2018-08-13 2021-03-19 厦门集微科技有限公司 云计算环境下实现docker网络穿透两层协议栈的方法及装置
CN109120556B (zh) * 2018-08-21 2019-07-09 广州市品高软件股份有限公司 一种云主机访问对象存储服务器的方法及系统
CN111885044A (zh) * 2020-07-20 2020-11-03 平安科技（深圳）有限公司 云主机多网卡配置方法、装置、设备及存储介质
CN113726637B (zh) * 2021-09-09 2022-11-01 华云数据控股集团有限公司 一种基于云平台的网络流量透传方法、装置及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110134931A1 (en) * 2009-12-08 2011-06-09 Jacobus Van Der Merwe Virtual router migration
CN104283756A (zh) * 2013-07-02 2015-01-14 杭州华三通信技术有限公司 一种实现分布式多租户虚拟网络的方法和装置
CN104394083A (zh) * 2014-09-22 2015-03-04 华为技术有限公司 转发表项处理的方法、报文转发的方法及其装置和系统
CN104518993A (zh) * 2014-12-29 2015-04-15 华为技术有限公司 云化网络通信路径的分配方法、装置及系统

Family Cites Families (33)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100455130B1 (ko) 2000-12-23 2004-11-08 엘지전자 주식회사 가상 에이알피 패킷을 이용한 프록시 에이알피 동작 방법
US20070022474A1 (en) 2005-07-21 2007-01-25 Mistletoe Technologies, Inc. Portable firewall
CN100553220C (zh) 2007-08-22 2009-10-21 杭州华三通信技术有限公司 一种实现vlan内下行用户隔离的方法及设备
CN102549977B (zh) 2009-09-24 2014-11-05 日本电气株式会社 虚拟服务器间通信识别系统和虚拟服务器间通信识别方法
WO2011083780A1 (ja) 2010-01-05 2011-07-14 日本電気株式会社 通信システム、制御装置、処理規則の設定方法、パケットの送信方法およびプログラム
US20110299533A1 (en) 2010-06-08 2011-12-08 Brocade Communications Systems, Inc. Internal virtual network identifier and internal policy identifier
WO2012033041A1 (ja) 2010-09-09 2012-03-15 日本電気株式会社 コンピュータシステム、及びコンピュータシステムにおける通信方法
CN102571738B (zh) 2010-12-08 2015-09-16 中国电信股份有限公司 基于虚拟局域网交换的入侵防御方法与系统
EP2651081A1 (en) 2010-12-09 2013-10-16 Nec Corporation Computer system, controller, and network monitoring method
US8761187B2 (en) 2011-06-14 2014-06-24 Futurewei Technologies, Inc. System and method for an in-server virtual switch
US9424144B2 (en) 2011-07-27 2016-08-23 Microsoft Technology Licensing, Llc Virtual machine migration to minimize packet loss in virtualized network
US9167501B2 (en) * 2011-08-29 2015-10-20 Telefonaktiebolaget L M Ericsson (Publ) Implementing a 3G packet core in a cloud computer with openflow data and control planes
US8762501B2 (en) * 2011-08-29 2014-06-24 Telefonaktiebolaget L M Ericsson (Publ) Implementing a 3G packet core in a cloud computer with openflow data and control planes
US9185056B2 (en) 2011-09-20 2015-11-10 Big Switch Networks, Inc. System and methods for controlling network traffic through virtual switches
JP2013074362A (ja) * 2011-09-27 2013-04-22 Nec Corp 仮想マシン管理装置、仮想マシン管理方法、及びプログラム
US9154433B2 (en) 2011-10-25 2015-10-06 Nicira, Inc. Physical controller
US20130195113A1 (en) 2012-01-30 2013-08-01 Dell Products, Lp System and Method for Network Switch Data Plane Virtualization
US9350671B2 (en) 2012-03-22 2016-05-24 Futurewei Technologies, Inc. Supporting software defined networking with application layer traffic optimization
JP5987902B2 (ja) 2012-04-03 2016-09-07 日本電気株式会社 ネットワークシステム、コントローラ、及びパケット認証方法
US8989188B2 (en) 2012-05-10 2015-03-24 Cisco Technology, Inc. Preventing leaks among private virtual local area network ports due to configuration changes in a headless mode
CN102739549B (zh) 2012-07-13 2015-10-21 华为技术有限公司 接收报文的方法、发送报文的方法及装置
CN102857416B (zh) 2012-09-18 2016-09-28 中兴通讯股份有限公司 一种实现虚拟网络的方法、控制器和虚拟网络
US9178715B2 (en) 2012-10-01 2015-11-03 International Business Machines Corporation Providing services to virtual overlay network traffic
US9215093B2 (en) 2012-10-30 2015-12-15 Futurewei Technologies, Inc. Encoding packets for transport over SDN networks
US9923831B2 (en) * 2012-11-29 2018-03-20 Futurewei Technologies, Inc. Packet prioritization in a software-defined network implementing OpenFlow
US9609086B2 (en) * 2013-03-15 2017-03-28 International Business Machines Corporation Virtual machine mobility using OpenFlow
CN104823428B (zh) * 2013-08-31 2019-05-10 华为技术有限公司 存储系统中操作请求处理方法和装置
EP3072263B1 (en) * 2013-11-18 2017-10-25 Telefonaktiebolaget LM Ericsson (publ) Multi-tenant isolation in a cloud environment using software defined networking
US9264400B1 (en) * 2013-12-02 2016-02-16 Trend Micro Incorporated Software defined networking pipe for network traffic inspection
CN104468389B (zh) * 2014-11-27 2018-02-06 华为技术有限公司 消息的处理方法、服务器和服务器系统
US9614789B2 (en) * 2015-01-08 2017-04-04 Futurewei Technologies, Inc. Supporting multiple virtual switches on a single host
US9628292B2 (en) * 2015-04-23 2017-04-18 Fortinet, Inc. Intelligent bridging of Wi-Fi flows in a software-defined network (SDN)
CN106385365B (zh) 2015-08-07 2019-09-06 新华三技术有限公司 基于开放流Openflow表实现云平台安全的方法和装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110134931A1 (en) * 2009-12-08 2011-06-09 Jacobus Van Der Merwe Virtual router migration
CN104283756A (zh) * 2013-07-02 2015-01-14 杭州华三通信技术有限公司 一种实现分布式多租户虚拟网络的方法和装置
CN104394083A (zh) * 2014-09-22 2015-03-04 华为技术有限公司 转发表项处理的方法、报文转发的方法及其装置和系统
CN104518993A (zh) * 2014-12-29 2015-04-15 华为技术有限公司 云化网络通信路径的分配方法、装置及系统

Also Published As

Publication number Publication date
CN106385365A (zh) 2017-02-08
EP3313032A1 (en) 2018-04-25
EP3313032B1 (en) 2020-07-08
US10887280B2 (en) 2021-01-05
CN106385365B (zh) 2019-09-06
JP2018527813A (ja) 2018-09-20
JP6595698B2 (ja) 2019-10-23
US20180212929A1 (en) 2018-07-26
EP3313032A4 (en) 2018-07-25

Similar Documents

Publication Publication Date Title
WO2017025005A1 (zh) 实现云平台安全
KR101969194B1 (ko) 네트워킹 장치 가상화를 위한 패킷 처리 오프로딩 기법
US9363180B2 (en) Service chaining in a cloud environment using Software Defined Networking
CN106664251B (zh) 网络环境中的双向流粘性
US11936562B2 (en) Virtual machine packet processing offload
US9571507B2 (en) Providing a virtual security appliance architecture to a virtual cloud infrastructure
CN105052113B (zh) 提供针对网络设备的共同代理框架的方法、设备及介质
CN104488235B (zh) 报文转发方法和网络设备
EP3292661B1 (en) Packet forwarding
WO2016082739A1 (en) Layer-3 forwarding in vxlan
US10938679B2 (en) Packet monitoring
WO2017198163A1 (zh) 接入控制
WO2016192686A1 (zh) 数据报文转发
CN107800626B (zh) 数据报文的处理方法、装置及设备
WO2017113300A1 (zh) 路由确定方法、网络配置方法以及相关装置
KR20130126833A (ko) 네트워크 가상화를 위한 고속 스위칭 방법 및 고속 가상 스위치
US20180367499A1 (en) Network-address-to-identifier translation in virtualized computing environments
US10313275B2 (en) Packet forwarding
WO2017194989A1 (en) Mechanism for inline packet response generation in software defined networks
Ha et al. Efficient flow table management scheme in SDN-based cloud computing networks
US20170237691A1 (en) Apparatus and method for supporting multiple virtual switch instances on a network switch
WO2015149367A1 (zh) 报文处理的方法与设备
WO2023019876A1 (zh) 基于智能决策的数据传输方法、装置、设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16834629

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15745372

Country of ref document: US

WWE Wipo information: entry into national phase

Ref document number: 2016834629

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2018506402

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE