WO2023207547A1 - 一种流量传输控制方法、装置、设备及存储介质 - Google Patents

一种流量传输控制方法、装置、设备及存储介质 Download PDF

Info

Publication number
WO2023207547A1
WO2023207547A1 PCT/CN2023/086761 CN2023086761W WO2023207547A1 WO 2023207547 A1 WO2023207547 A1 WO 2023207547A1 CN 2023086761 W CN2023086761 W CN 2023086761W WO 2023207547 A1 WO2023207547 A1 WO 2023207547A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
traffic
transport layer
network
traffic filtering
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2023/086761
Other languages
English (en)
French (fr)
Inventor
张晨
罗辉
郭建新
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Volcano Engine Technology Co Ltd
Original Assignee
Beijing Volcano Engine Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Volcano Engine Technology Co Ltd filed Critical Beijing Volcano Engine Technology Co Ltd
Priority to EP23794980.5A priority Critical patent/EP4518246A4/en
Publication of WO2023207547A1 publication Critical patent/WO2023207547A1/zh
Priority to US18/930,882 priority patent/US12323388B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/20—Traffic policing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/02—Capturing of monitoring data
    • H04L43/028—Capturing of monitoring data by filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2475—Traffic characterised by specific attributes, e.g. priority or QoS for supporting traffic characterised by the type of applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Definitions

  • the present disclosure relates to the field of Internet technology, specifically, to a flow transmission control method, device, equipment and storage medium.
  • the container network is an open network architecture.
  • the general network diversion and blocking solution is to use the Container Network Interface (CNI) plug-in.
  • CNI Container Network Interface
  • the CNI plug-in needs to match the container network to obtain traffic data and perform corresponding security scans. and network policy blocking.
  • This control method is mainly based on the protocol stack of the host network to filter traffic data to achieve network isolation. This technical solution can meet the business needs of a single container network environment.
  • Embodiments of the present disclosure provide at least a flow transmission control method, device, equipment and storage medium.
  • an embodiment of the present disclosure provides a traffic transmission control method, which method includes:
  • the traffic data is subjected to transport layer traffic filtering processing, and the traffic data processed by the transport layer traffic filtering is used as the third one data;
  • the first data is forwarded to the application layer detector through the network bridge connected to the target container, and the first data is subjected to application layer traffic filtering processing by the application layer detector, and the first data is passed through the application layer.
  • the traffic data processed by traffic filtering is used as the second data;
  • the second data is sent to the host connected to the network bridge through the network bridge, and sent to the destination corresponding to the second data through the host.
  • the method before performing transport layer traffic filtering processing on the traffic data based on the transport layer traffic filtering policy set inside the target container, the method further includes:
  • the transport layer traffic filtering policy corresponding to the target container generated by the network policyr, and send the transport layer traffic filtering policy to the network bridge;
  • the transport layer traffic filtering policy indicates that there are five traffic layers that meet the transmission requirements. Tuple information and quintuple information that do not meet transmission requirements;
  • the step of performing transport layer traffic filtering processing on the traffic data based on the transport layer traffic filtering policy set inside the target container includes:
  • the transport layer traffic filtering policy is read from the independent network namespace, based on the five-tuple information carried by the traffic data, and the five-tuple information that meets the transmission requirements and is not indicated by the transport layer traffic filtering policy. Five-tuple information that meets the transmission requirements is used to perform transport layer traffic filtering on the traffic data.
  • the target container is provided with a first network interface
  • the host is provided with a second network interface
  • the network bridge is provided with a third network interface and a fourth network interface; Wherein, the first network interface and the third network interface are communicatively connected, and the second network interface and the fourth network interface are communicatively connected;
  • Forwarding the first data to the application layer detector through the network bridge connected to the target container includes:
  • the first data transmitted by the first network interface of the target container is received through the third network interface of the network bridge connected to the target container, and the packet forwarding function of the network bridge is called to forward the data. forwarding the first data to the application layer detector;
  • the sending of the second data to the host connected to the network bridge through the network bridge includes:
  • the second data is forwarded to the second network interface of the host connected to the network bridge through the fourth network interface of the network bridge.
  • performing application layer traffic filtering processing on the first data through the application layer detector includes:
  • a traffic filtering model associated with the target container from a set of pre-trained traffic filtering models
  • application layer traffic filtering processing is performed on the first data.
  • embodiments of the present disclosure provide a traffic transmission control method, which method includes:
  • the third data is sent to a target container connected to the network bridge through the network bridge, and based on the transport layer traffic filtering policy set inside the target container, the third data is processed for transport layer traffic. Filtering, using the traffic data processed by the transport layer traffic filtering as fourth data;
  • the fourth data is processed in the target container.
  • the target container is provided with a first network interface
  • the host is provided with a second network interface
  • the network bridge is provided with a third network interface and a fourth network interface; Wherein, the first network interface and the third network interface are communicatively connected, and the second network interface and the fourth network interface are communicatively connected;
  • the forwarding of the traffic data to the application layer detector through the network bridge connected to the host includes:
  • the traffic data transmitted by the second network interface of the host is received through the fourth network interface of the network bridge connected to the host, and the packet forwarding function of the network bridge is called to transfer the traffic data Forwarded to application layer detector;
  • the sending of the third data to the target container connected to the network bridge through the network bridge includes:
  • the third data is forwarded to the first network interface of the target container connected to the network bridge through the third network interface of the network bridge.
  • application layer traffic filtering processing is performed on the traffic data through the application layer detector, including:
  • a traffic filtering model associated with the target container from a set of pre-trained traffic filtering models
  • application layer traffic filtering processing is performed on the traffic data.
  • the method before performing transport layer traffic filtering processing on the third data based on the transport layer traffic filtering policy set inside the target container, the method further includes:
  • the transport layer traffic filtering policy corresponding to the target container generated by the network policyr, and send the transport layer traffic filtering policy to the network bridge;
  • the transport layer traffic filtering policy indicates that there are five traffic layers that meet the transmission requirements. Tuple information and quintuple information that do not meet transmission requirements;
  • the step of performing transport layer traffic filtering processing on the third data based on the transport layer traffic filtering policy set inside the target container includes:
  • the transport layer traffic filtering policy is read from the independent network namespace, based on the five-tuple information carried by the third data and the five-tuple information indicated by the transport layer traffic filtering policy that meets the transmission requirements and For quintuple information that does not meet the transmission requirements, the third data is subjected to transport layer traffic filtering processing.
  • an embodiment of the present disclosure also provides a flow transmission control device, which includes:
  • the first filtering module is configured to respond to the traffic data generated by the target container, perform transport layer traffic filtering processing on the traffic data based on the transport layer traffic filtering policy set inside the target container, and filter the traffic data passing through the transport layer.
  • the filtered traffic data is used as the first data;
  • a second filtering module configured to forward the first data to an application layer detector through a network bridge connected to the target container, and perform application layer traffic filtering processing on the first data through the application layer detector. , using the traffic data processed by the application layer traffic filtering as the second data;
  • a first processing module configured to send the second data to a host connected to the network bridge through the network bridge, and to a destination corresponding to the second data through the host.
  • an embodiment of the present disclosure also provides a flow transmission control device, which includes:
  • the third filtering module is configured to respond to the traffic data received by the host and forward the traffic data to the application layer detector through the network bridge connected to the host, so as to filter the traffic data through the application layer detector. Perform application layer traffic filtering processing, and use the traffic data that passes the application layer traffic filtering processing as third data;
  • a fourth filtering module configured to send the third data to a target container connected to the network bridge through the network bridge, and filter the traffic layer based on the transport layer traffic filtering policy set inside the target container.
  • the third data is subjected to transport layer traffic filtering processing, and the traffic data that passes the transport layer traffic filtering processing is used as the fourth data;
  • the second processing module is used to process the fourth data in the target container.
  • embodiments of the present disclosure further provide an electronic device, including: a processor, a memory, and a bus.
  • the memory stores machine-readable instructions executable by the processor.
  • the processing There is communication between the processor and the memory through a bus, and when the machine-readable instructions are executed by the processor, the above-mentioned first aspect, or the steps of any possible traffic transmission control method in the first aspect, or the second aspect, or either of the second aspects may The steps of a capable traffic transmission control method.
  • embodiments of the present disclosure also provide a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program.
  • the computer program When the computer program is run by a processor, it executes the above-mentioned first aspect, or any of the first aspects.
  • the transport layer traffic filtering policy is directly applied inside the container, so that the traffic data generated by the container is directly processed by transport layer traffic filtering inside the container, which can reduce the impact on the container.
  • the influence of the cluster prevents container cluster failures due to network protection policy errors or abnormalities; in addition, by configuring a network bridge between the target container and the host, the target container can pass the traffic data processed by the transport layer traffic filtering through After the network bridge forwards it to the application layer detector for application layer traffic filtering and processing, the traffic data processed by the application layer traffic filtering is sent to the host. Since the network bridge can be compatible with the traffic data transmission of containers with different business characteristics, it has Good adaptability, versatility, and robustness can ensure the stability and integrity of traffic transmission, thereby achieving safe detection and normal transmission of traffic data in a container environment.
  • the host forwards the traffic data to the application layer detector through the network bridge configured between the host and the container for application layer traffic filtering processing, and then The traffic data processed by application layer traffic filtering is forwarded to the container, and the transport layer traffic filtering process is directly performed through the transport layer traffic filtering policy set inside the container.
  • the impact on the transport layer can be reduced.
  • the impact of container clusters prevents container cluster failures due to network protection policy errors or abnormalities;
  • the network bridge configured between the host and the container can be compatible with the traffic data transmission of containers with various business characteristics. , has good adaptability, versatility, and robustness, which can ensure the stability and integrity of traffic transmission, thereby achieving safe detection and normal transmission of traffic data in a container environment.
  • Figure 1 shows a schematic diagram of an application scenario provided by an embodiment of the present disclosure
  • Figure 2 shows a flow chart of a traffic transmission control method provided by an embodiment of the present disclosure
  • Figure 3 shows a schematic diagram of a network interface provided by an embodiment of the present disclosure
  • Figure 4 shows a schematic diagram of a packet forwarding process provided by an embodiment of the present disclosure
  • Figure 5 shows a flow chart of yet another traffic transmission control method provided by an embodiment of the present disclosure
  • Figure 6 shows a flow chart of another traffic transmission control method provided by an embodiment of the present disclosure
  • Figure 7 shows a flow chart of yet another traffic transmission control method provided by an embodiment of the present disclosure
  • Figure 8 shows one of the schematic diagrams of a flow transmission control device provided by an embodiment of the present disclosure
  • Figure 9 shows the second schematic diagram of a flow transmission control device provided by an embodiment of the present disclosure.
  • Figure 10 shows one of the schematic diagrams of another flow transmission control device provided by an embodiment of the present disclosure.
  • Figure 11 shows the second schematic diagram of another flow transmission control device provided by an embodiment of the present disclosure.
  • FIG. 12 shows a schematic diagram of an electronic device provided by an embodiment of the present disclosure.
  • a and/or B can mean: A alone exists, A and B exist simultaneously, and B alone exists. situation.
  • at least one herein means any one of a plurality or any combination of at least two of a plurality, for example, including at least one of A, B, and C, which can mean including from A, Any one or more elements selected from the set composed of B and C.
  • the general network diversion and blocking solution is to use the Container Network Interface (CNI) plug-in, that is, using the CNI plug-in that matches the container network to obtain traffic data and perform corresponding security scanning and network policy blocking.
  • CNI Container Network Interface
  • the results of subsequent traffic detection make it difficult to ensure the integrity of traffic data transmission, affecting the security and stability of the container environment.
  • the present disclosure provides a traffic transmission control method.
  • the traffic data is forwarded to the application layer detector through the network bridge for application layer traffic filtering processing, which is compatible with A variety of target containers with different business characteristics improve the stability of traffic transmission; and the transport layer traffic filtering policy is directly applied inside the container, and the transport layer traffic is filtered inside the container to prevent the container from being damaged due to network protection policy errors or abnormalities.
  • security detection and normal transmission of traffic data in the container environment are achieved.
  • the execution subject of the flow transmission control method provided by the embodiment of the disclosure is generally a computer device with certain computing capabilities.
  • the computer device includes, for example: a terminal device or a server or other processing device.
  • the traffic transmission control method can be implemented by the processor calling computer-readable instructions stored in the memory.
  • Figure 1 is a schematic diagram of an application scenario provided by an embodiment of the present disclosure.
  • a network bridge can be used to configure the network bridge between the target container and the host. Data is transmitted between the target container and the host through the network bridge.
  • the packet forwarding function of the network bridge can also be used to forward the traffic data to the application layer detector for application layer traffic filtering, thereby improving the stability of traffic transmission. Ensure the normal flow of traffic transmission in the container environment.
  • Figure 2 is a flow chart of a traffic transmission control method provided by an embodiment of the present disclosure.
  • the traffic transmission control method can be considered to be executed by a network traffic controller.
  • the network traffic controller can be deployed on an independent computer.
  • the traffic transmission control method provided by the embodiment of the present disclosure includes steps S201 to S203, wherein:
  • S201 In response to the traffic data generated by the target container, based on the transport layer traffic filtering policy set inside the target container, perform transport layer traffic filtering processing on the traffic data, and filter the traffic data processed by the transport layer traffic as the first data.
  • traffic data is data generated by the target container based on the network transmission protocol and to be sent to other containers or hosts.
  • the traffic data is subjected to transport layer traffic filtering processing according to the traffic filtering policy set inside the target container, and the traffic that does not pass the transport layer traffic filtering processing is data, intercept it, determine the traffic data processed by the transport layer traffic filtering process as the first data, and release it.
  • the transport layer traffic filtering process is a four-layer traffic filtering process, and the four-layer traffic filtering process refers to the fourth layer transport layer of the Open System Interconnection Reference Model (OSI), based on the five-element Group information is used to filter and protect traffic data.
  • OSI Open System Interconnection Reference Model
  • the five-tuple information includes the source Internet Protocol (IP) address, source port, destination IP address, destination port and transport layer protocol.
  • IP Internet Protocol
  • the transport layer traffic filtering process is to obtain the quintuple information carried by the traffic data, and obtain the quintuple information that meets the transmission requirements and the quintuple information that does not meet the transmission requirements indicated by the transport layer traffic filtering policy to detect Whether the five-tuple information of the traffic data meets the transmission requirements indicated by the transport layer traffic filtering policy.
  • a corresponding transport layer traffic filtering policy needs to be set in the target container in advance.
  • the method before performing transport layer traffic filtering processing on the traffic data based on the transport layer traffic filtering policy set inside the target container, the method further includes:
  • the transport layer traffic filtering policy corresponding to the target container generated by the network policyr, and send the transport layer traffic filtering policy to the network bridge;
  • the transport layer traffic filtering policy indicates that there are five traffic layers that meet the transmission requirements. Tuple information and quintuple information that do not meet transmission requirements;
  • the transport layer traffic filtering policy is set in an independent network namespace of the target container through the network bridge.
  • the transport layer traffic filtering policy generated by the network policyr can be obtained.
  • the transport layer traffic filtering policy corresponds to the target container, so that the traffic generated by the target container can be subsequently processed according to the transport layer traffic filtering policy.
  • the data is subjected to transport layer traffic filtering processing.
  • the transport layer traffic filtering policy can be sent to the network bridge, and the transmission layer traffic filtering policy can be sent to the network bridge through the network bridge.
  • layer The traffic filtering policy is set in the independent network namespace of the target container.
  • the transport layer traffic filtering policy may be generated based on the network access interface rules set by the secure transmission.
  • the transport layer traffic filtering policy indicates the situations in which the target container can be accessed and the situations in which it cannot be accessed, that is, indicating compliance with Five-tuple information required for transmission and five-tuple information not meeting transmission requirements.
  • the transport layer traffic transmission policy indicates that the container A cannot access the 3306 port of the container B. Then the access process of the container A to the 3306 port of the container B corresponds to the five elements.
  • the group information is the five-tuple information that does not meet the transmission requirements as indicated by the transport layer traffic transmission policy.
  • the transport layer traffic filtering policy can be read from the independent network namespace, and the transport layer traffic filtering policy is configured according to the transport layer traffic filtering policy.
  • the traffic data is subjected to transport layer traffic filtering processing.
  • performing transport layer traffic filtering processing on the traffic data based on the transport layer traffic filtering policy set inside the target container includes:
  • the transport layer traffic filtering policy is read from the independent network namespace, based on the five-tuple information carried by the traffic data, and the five-tuple information that meets the transmission requirements and is not indicated by the transport layer traffic filtering policy. Five-tuple information that meets the transmission requirements is used to perform transport layer traffic filtering on the traffic data.
  • the traffic data if the five-tuple information carried by the traffic data matches the five-tuple information that meets the transmission requirements indicated by the transport layer traffic filtering policy, it can be determined that the traffic data passes the transport layer traffic filtering process, so that all traffic data are processed. The traffic data is released; on the contrary, if the five-tuple information carried by the traffic data matches the five-tuple information that does not meet the transmission requirements indicated by the transport layer traffic filtering policy, it can be determined that the traffic data has not been transmitted. Layer traffic filtering processing to intercept and filter the traffic data.
  • S202 Forward the first data to the application layer detector through the network bridge connected to the target container, perform application layer traffic filtering processing on the first data through the application layer detector, and filter the first data through the application layer detector.
  • the traffic data processed by the application layer traffic filtering is used as the second data.
  • the first data can be transmitted from the target container to the network bridge, and then forwarded to the application layer detector through the network bridge to pass the
  • the application layer detector performs application layer traffic filtering on the first data, intercepts the first data that does not pass the application layer traffic filtering, and intercepts the first data that passes the application layer traffic filtering. , determine it as the second data, and release it.
  • Network interfaces appear in pairs. One end of the network interface is connected to the corresponding virtual network device, and the other end is connected to each other.
  • the target container is provided with a first network interface
  • the host is provided with a second network interface
  • the network bridge is provided with a third network interface and a fourth network interface. ; Wherein, the first network interface and the third network interface are communicatively connected, and the second network interface and the fourth network interface are communicatively connected.
  • FIG. 3 is a schematic diagram of a network interface provided by an embodiment of the present disclosure.
  • the traditional mode is to generate a pair of network interfaces, one network interface is set on the target container, and the other network interface is set on the host.
  • the first network is set on the target container.
  • the host is provided with a second network interface, the first network interface and the second network interface are connected for communication, and the traffic data generated by the target container is sent through the first network interface Secondary network interface to the host.
  • a network bridge is added, and the network bridge is provided with a third network interface and a fourth network interface.
  • the first network interface and the third network interface are communicatively connected
  • the second network interface and the fourth network interface are communicatively connected, so that the traffic data generated by the target container can be sent to the host through the network bridge.
  • forwarding the first data to the application layer detector through a network bridge connected to the target container includes:
  • the first data transmitted by the first network interface of the target container is received through the third network interface of the network bridge connected to the target container, and the packet forwarding function of the network bridge is called to forward the data.
  • the first data is forwarded to the application layer detector.
  • the data transmitted by the first network interface of the target container can be received through the third network interface of the network bridge.
  • first data to transmit the first data from the target container to the network bridge and then call the packet forwarding function of the network bridge to forward the first data to the application layer detector to pass the application layer
  • the detector performs application layer traffic filtering on the first data.
  • the application layer traffic filtering process is seven-layer traffic filtering process.
  • the seven-layer traffic filtering process refers to the seventh layer application layer of the Open System Interconnection Reference Model (OSI).
  • OSI Open System Interconnection Reference Model
  • According to the application layer Use business rules to identify and filter traffic data.
  • application layer traffic filtering processing is performed on the first data through the application layer detector, including:
  • a traffic filtering model associated with the target container from a set of pre-trained traffic filtering models
  • application layer traffic filtering processing is performed on the first data.
  • the traffic filtering model set includes multiple traffic filtering models, and each traffic filtering model stores its corresponding business container, so it can be called from the traffic filtering model set through the application layer detector A traffic filtering model associated with the target container, thereby performing application layer traffic filtering processing on the first data based on the called traffic filtering model.
  • the mmap mechanism is a duplex communication mechanism that can be used to operate data transfer and sharing between kernel mode and user mode communication processes, that is, both parties read and write the same block.
  • the data in the memory space is used to complete the communication.
  • FIG. 4 is a schematic diagram of a packet forwarding process provided by an embodiment of the present disclosure.
  • the traditional mode is to send the transport layer traffic filtering policy generated by the network policyr (that is, the four-layer filtering policy in the figure) directly to the host of the target container and transmit it through the host's protocol stack.
  • Layer traffic filtering processing In this embodiment, the transport layer traffic filtering policy is directly applied inside the target container to perform transport layer traffic filtering on the traffic data, thereby reducing the impact on the container cluster and preventing the container from being damaged due to errors or abnormalities in the network protection policy. If a cluster failure occurs, the packet forwarding function of the network bridge can also be used to forward the traffic data to the application layer detector for application layer traffic filtering.
  • the seven-layer protection strategy is applied to user mode filtering.
  • engine to The traffic data is processed by application layer traffic filtering.
  • the network bridge can be compatible with target containers with different business characteristics, thereby improving the stability of traffic transmission, improving the integrity of the received traffic data, and realizing the security of traffic data in the container environment. detection and normal transmission.
  • the first data transmitted by the first network interface of the target container is received through the third network interface of the network bridge.
  • the first data is in the kernel state process.
  • the detection result information does not include data information, but includes information about the To determine whether the first data has passed the application layer traffic filtering process, the detection result information can be passed to the kernel state process based on the mmap mechanism, and the kernel state process performs data interception or release processing. If the traffic data has not been Through application layer traffic filtering processing, the traffic data is filtered out through the kernel state filtering engine, that is, data interception processing is performed. On the contrary, if the traffic data passes application layer traffic filtering processing, data release processing is performed.
  • S203 Send the second data to the host connected to the network bridge through the network bridge, and send it to the destination corresponding to the second data through the host.
  • the network interface can also be used to send the second data to the host through the network bridge.
  • the second data carries If there is a network link for sending, the host sends it to the destination corresponding to the second data according to the network link carried by the second data.
  • the second network interface and the fourth network interface are communicatively connected. Therefore, in some possible implementations, the second data is sent through the network bridge to the device connected to the network interface.
  • the hosts connected to the network bridge described above include:
  • the second data is forwarded to the second network interface of the host connected to the network bridge through the fourth network interface of the network bridge.
  • the second data can be forwarded to the second network interface of the host through the fourth network interface of the network bridge.
  • a network interface is configured to transmit the second data processed by the application layer traffic filtering from the network bridge to the host.
  • FIG. 5 is a flow chart of yet another traffic transmission control method provided by an embodiment of the present disclosure.
  • the traffic data generated by the target container first perform transport layer traffic filtering processing on the traffic data according to the transport layer traffic filtering policy set inside the target container, and obtain The first data that passes the transport layer traffic filtering process is released, the traffic data that does not pass the transport layer traffic filtering process is intercepted and filtered, and then the first data is forwarded to the application layer detector through the network bridge.
  • the application layer traffic filtering process is used to obtain the second data that has passed the application layer traffic filtering process, the second data is released, the first data that has not passed the application layer traffic filtering process is intercepted and filtered, and then the second data is bridged through the network
  • the server sends it to the host, and then sends it to the destination corresponding to the second data through the host.
  • the traffic transmission control method provided by the embodiment of the present disclosure can respond to the traffic data generated by the target container and perform transport layer traffic filtering processing on the traffic data based on the transport layer traffic filtering policy set inside the target container.
  • the traffic data processed by the transport layer traffic filtering is used as the first data; the first data is forwarded to the application layer detector through the network bridge connected to the target container, and the third data is forwarded by the application layer detector.
  • One data is subjected to application layer traffic filtering processing, and the traffic data processed by the application layer traffic filtering is used as second data; the second data is sent to the host connected to the network bridge through the network bridge, and send it through the host sent to the destination corresponding to the second data.
  • the transport layer traffic filtering policy is directly applied inside the container, so that the traffic data generated by the container is directly processed by the transport layer traffic filtering inside the container, which can reduce the impact on the container cluster.
  • the target container can forward traffic data processed by transport layer traffic filtering through the network bridge
  • the traffic data processed by the application layer traffic filtering is sent to the host. Since the network bridge can be compatible with the traffic data transmission of containers with various business characteristics, it has good adaptability. The stability, versatility, and robustness can ensure the stability and integrity of traffic transmission, thereby achieving safe detection and normal transmission of traffic data in a container environment.
  • Figure 6 is a flow chart of another traffic transmission control method provided by an embodiment of the present disclosure.
  • the traffic transmission control method can be considered to be executed by a network traffic controller.
  • the network traffic controller can be deployed on an independent On the computer equipment or on the host computer where the embodiment of the present disclosure performs network traffic processing.
  • the traffic transmission control method provided by the embodiment of the present disclosure includes steps S601 to S603, wherein:
  • S601 In response to the traffic data received by the host, forward the traffic data to the application layer detector through the network bridge connected to the host, so as to perform application layer traffic filtering on the traffic data through the application layer detector. Processing, using the traffic data processed by the application layer traffic filtering as third data.
  • the traffic data represents the traffic data received by the host, generated based on the network transmission protocol, and to be sent to the container.
  • the traffic data is subjected to application layer traffic filtering processing. Specifically, the traffic data is first transmitted from the host to the network bridge, and then the traffic data is filtered through the network bridge. The data is forwarded to the application layer detector for application layer traffic filtering processing.
  • the application layer traffic filtering process is seven-layer traffic filtering process, and the seven-layer traffic filtering process refers to the seventh layer application layer of the Open System Interconnection Reference Model (OSI).
  • OSI Open System Interconnection Reference Model
  • According to the application layer Use business rules to identify and filter traffic data.
  • the application layer traffic filtering process is to detect whether the business information carried by the traffic data meets the transmission requirements according to the business rules of the application layer.
  • the business information carried by the traffic data may include a Uniform Resource Locator (Uniform Resource Locator). Resource Locator, URL) address, request body (Body) parameter information, etc.
  • Network interfaces appear in pairs. One end of the network interface is connected to the corresponding virtual network device, and the other end is connected to each other.
  • the target container is provided with a first network interface
  • the host is provided with a second network interface
  • the network bridge is provided with a third network interface and a fourth network interface. ; Wherein, the first network interface and the third network interface are communicatively connected, and the second network interface and the fourth network interface are communicatively connected.
  • Figure 3 is a schematic diagram of a network interface provided by an embodiment of the present disclosure.
  • the traditional mode is to generate a pair of network interfaces, one network interface is set on the target container, and the other network interface is set on the host.
  • the first network interface is set on the target container.
  • the host is provided with a second network interface, the first network interface and the second network interface are communicatively connected, and the traffic data received by the host is sent to the first network interface of the target container through the second network interface.
  • a network bridge is added, and the network bridge is provided with a third network interface and a fourth network interface.
  • the first network interface and the third network interface are communicatively connected
  • the second network interface and the fourth network interface are communicatively connected, so that the traffic data received by the host can be sent to the target container through the network bridge.
  • forwarding the traffic data to the application layer detector through a network bridge connected to the host includes:
  • the traffic data transmitted by the second network interface of the host is received through the fourth network interface of the network bridge connected to the host, and the packet forwarding function of the network bridge is called to transfer the traffic data Forwarded to application layer detector.
  • the second network interface and the fourth network interface are communicatively connected, all the data transmitted by the second network interface of the host can be received through the fourth network interface of the network bridge.
  • the traffic data is transmitted from the host to the network bridge.
  • the packet forwarding function of the network bridge can be called to transmit the traffic data.
  • the application layer detector Forwarded to the application layer detector to perform application layer traffic filtering processing on the traffic data through the application layer detector.
  • the application layer detector performs application layer traffic filtering processing on the traffic data, including:
  • a traffic filtering model associated with the target container from a set of pre-trained traffic filtering models
  • application layer traffic filtering processing is performed on the traffic data.
  • the traffic filtering model set includes multiple traffic filtering models, and each traffic filtering model stores its corresponding business container, so it can be called from the traffic filtering model set through the application layer detector A traffic filtering model associated with the target container, thereby performing application layer traffic filtering processing on the traffic data based on the called traffic filtering model.
  • the mmap mechanism is a duplex communication mechanism that can be used to operate data transfer and sharing between kernel mode and user mode communication processes, that is, both parties read and write the same block.
  • the data in the memory space is used to complete the communication.
  • FIG 4 is a schematic diagram of a packet forwarding process provided by an embodiment of the present disclosure.
  • the traditional mode is to send the transport layer traffic filtering policy generated by the network policyr (that is, the four-layer filtering policy in the figure) directly to the host of the target container and transmit it through the host's protocol stack.
  • Layer traffic filtering processing In this embodiment, the transport layer traffic filtering policy is directly applied inside the target container to perform transport layer traffic filtering on the traffic data, thereby reducing the impact on the container cluster and preventing the container from being damaged due to errors or abnormalities in the network protection policy. If a cluster failure occurs, the packet forwarding function of the network bridge can also be used to forward the traffic data to the application layer detector for application layer traffic filtering.
  • the seven-layer protection strategy is applied to user mode filtering. engine to perform application-layer traffic filtering on traffic data.
  • the network bridge can be compatible with target containers with various business characteristics, thereby improving the stability of traffic transmission, improving the integrity of received traffic data, and realizing control over container environments. Security detection and normal transmission of traffic data.
  • the second network interface transmission of the host is received through the fourth network interface of the network bridge.
  • Traffic data is in the kernel state process.
  • the traffic data can be transferred to the user state process based on the mmap mechanism.
  • the user state process performs application layer traffic filtering and generates detection result information.
  • the detection results The information does not include data information, but includes the determination result of whether the traffic data has been processed by the application layer traffic filtering.
  • the detection result information can be transferred to the kernel state process based on the mmap mechanism, and the data is processed in the kernel state process.
  • Interception or release processing if the traffic data does not pass the application layer traffic filtering process, the traffic data will be filtered out through the kernel state filtering engine, that is, data interception processing will be performed. On the contrary, if the traffic data passes the application layer traffic filtering process, Perform data release processing.
  • S602 Send the third data to the target container connected to the network bridge through the network bridge, and transmit the third data based on the transport layer traffic filtering policy set inside the target container.
  • the layer traffic filtering process uses the traffic data that has passed the transport layer traffic filtering process as the fourth data.
  • the network interface can also be used to send the third data to the target container through the network bridge, so that the third data can be sent to the target container according to the settings inside the target container.
  • Transport layer traffic filtering strategy perform transport layer traffic filtering processing on the third data, intercept the third data that has not passed the transport layer traffic filtering process, and intercept the third data that has passed the transport layer traffic filtering process.
  • the third data is determined as the fourth data and released.
  • the transport layer traffic filtering process is a four-layer traffic filtering process, and the four-layer traffic filtering process refers to the fourth layer transport layer of the Open System Interconnection Reference Model (OSI), based on the five-element Group information is used to filter and protect traffic data.
  • OSI Open System Interconnection Reference Model
  • the five-tuple information includes the source Internet Protocol (IP) address, source port, destination IP address, destination port and transport layer protocol.
  • IP Internet Protocol
  • the transport layer traffic filtering process is to obtain the quintuple information carried by the third data, and obtain the quintuple information that meets the transmission requirements and the quintuple information that does not meet the transmission requirements indicated by the transport layer traffic filtering policy, so as to It is detected whether the five-tuple information of the third data meets the transmission requirements indicated by the transport layer traffic filtering policy.
  • the first network interface and the third network interface are communicatively connected. Therefore, in some possible implementations, the third data is sent through the network bridge to the device connected to the third network interface.
  • the target containers to which the network bridge is connected include:
  • the third data is forwarded to the first network interface of the target container connected to the network bridge through the third network interface of the network bridge.
  • the third data can be forwarded to the target container through the third network interface of the network bridge.
  • the first network interface further performs transport layer traffic filtering on the third data based on the transport layer traffic filtering policy set inside the target container.
  • the method before performing transport layer traffic filtering processing on the third data based on the transport layer traffic filtering policy set inside the target container, the method further includes:
  • the transport layer traffic filtering policy corresponding to the target container generated by the network policyr, and send the transport layer traffic filtering policy to the network bridge;
  • the transport layer traffic filtering policy indicates that there are five traffic layers that meet the transmission requirements. Tuple information and quintuple information that do not meet transmission requirements;
  • the transport layer traffic filtering policy is set in an independent network namespace of the target container through the network bridge.
  • the transport layer traffic filtering policy generated by the network policyr can be obtained.
  • the transport layer traffic filtering policy corresponds to the target container, so that the traffic received by the target container can be subsequently processed according to the transport layer traffic filtering policy.
  • the data is subjected to transport layer traffic filtering processing.
  • the transport layer traffic filtering policy can be sent to the network bridge, and the transmission layer traffic filtering policy can be sent to the network bridge through the network bridge.
  • the layer traffic filtering policy is set in the independent network namespace of the target container.
  • the transport layer traffic filtering policy can be read from the independent network namespace, and the transport layer traffic filtering policy is configured according to the transport layer traffic filtering policy.
  • the traffic data is subjected to transport layer traffic filtering processing.
  • performing transport layer traffic filtering processing on the third data based on the transport layer traffic filtering policy set inside the target container includes:
  • the transport layer traffic filtering policy is read from the independent network namespace, based on the five-tuple information carried by the third data and the five-tuple information indicated by the transport layer traffic filtering policy that meets the transmission requirements and For quintuple information that does not meet the transmission requirements, the third data is subjected to transport layer traffic filtering processing.
  • the fifth-tuple information carried by the third data matches the five-tuple information that meets the transmission requirements indicated by the transport layer traffic filtering policy, it can be determined that the third data is processed by the transport layer traffic filtering, so that The third data is released; on the contrary, if the five-tuple information carried by the third data matches the five-tuple information that does not meet the transmission requirements indicated by the transport layer traffic filtering policy, it can be determined that the third data The third data does not pass the transport layer traffic filtering process, so the third data is intercepted and filtered.
  • S603 Process the fourth data in the target container.
  • the fourth data received by the target container can be processed in a service process corresponding to the target container.
  • FIG. 7 is a flow chart of yet another traffic transmission control method provided by an embodiment of the present disclosure.
  • the traffic data received by the host is first forwarded to the application layer detector through the network bridge for application layer traffic filtering processing, and the application layer traffic is obtained.
  • Filter the processed third data release the third data, intercept and filter the traffic data that has not passed the application layer traffic filtering process, and then send the third data to the target container through the network bridge, according to the settings inside the target container
  • Transport layer traffic filtering strategy perform transport layer traffic filtering on the third data, obtain the fourth data that passes the transport layer traffic filtering, release the fourth data, and filter the third data that does not pass the transport layer traffic filtering. Intercept and filter, and then process the fourth data in the target container.
  • the traffic transmission control method provided by the embodiment of the present disclosure can respond to the traffic data received by the host and forward the traffic data to the application layer detector through the network bridge connected to the host to pass the application layer detector. Perform application layer traffic filtering processing on the traffic data, and use the traffic data processed by the application layer traffic filtering as third data; send the third data to the network connected to the network bridge through the network bridge.
  • the target container based on the transport layer traffic filtering policy set inside the target container, performs transport layer traffic filtering processing on the third data, and uses the traffic data processed by the transport layer traffic filtering as the fourth data; in The target container The fourth data is processed.
  • the host after the host receives the traffic data, it forwards the traffic data to the application layer detector through the network bridge configured between the host and the container for application layer traffic filtering processing, and then forwards the traffic data processed by the application layer traffic filtering
  • the transport layer traffic is filtered directly through the transport layer traffic filtering policy set inside the container; on the one hand, through the mechanism of transport layer traffic filtering and processing inside the container, the impact on the container cluster can be reduced and prevent network protection policies from Errors or abnormalities lead to malfunctions in the container cluster; on the other hand, because the network bridge configured between the host and the container can be compatible with the traffic data transmission of containers with various business characteristics, it has good adaptability, versatility, and robustness, thus ensuring the stability and integrity of traffic transmission, thereby achieving safe detection and normal transmission of traffic data in a container environment.
  • the writing order of each step does not mean a strict execution order and does not constitute any limitation on the implementation process.
  • the specific execution order of each step should be based on its function and possible The internal logic is determined.
  • the embodiments of the disclosure also provide a flow transmission control device corresponding to the flow transmission control method. Since the principle of solving the problem of the device in the embodiment of the disclosure is similar to the above-mentioned flow transmission control method in the embodiment of the disclosure, therefore For the implementation of the device, please refer to the implementation of the method, and repeated details will not be repeated.
  • FIG. 8 is a first schematic diagram of a flow transmission control device provided by an embodiment of the present disclosure.
  • FIG. 9 is a second schematic diagram of a flow transmission control device provided by an embodiment of the present disclosure.
  • the traffic transmission control device 800 provided by the embodiment of the present disclosure includes:
  • the first filtering module 801 is configured to respond to the traffic data generated by the target container, perform transport layer traffic filtering processing on the traffic data based on the transport layer traffic filtering policy set inside the target container, and filter the traffic data through the transport layer
  • the traffic data processed by traffic filtering is used as the first data
  • the second filtering module 802 is configured to forward the first data to an application layer detector through a network bridge connected to the target container, and perform application layer traffic filtering on the first data through the application layer detector. Processing, using the traffic data processed by the application layer traffic filtering as the second data;
  • the first processing module 803 is configured to send the second data to the host connected to the network bridge through the network bridge, and to the destination corresponding to the second data through the host.
  • the flow transmission control device 800 further includes a first setting module 804, the first setting module 804 is used for:
  • the transport layer traffic filtering policy corresponding to the target container generated by the network policyr, and send the transport layer traffic filtering policy to the network bridge;
  • the transport layer traffic filtering policy indicates that there are five traffic layers that meet the transmission requirements. Tuple information and quintuple information that do not meet transmission requirements;
  • the first filtering module 801 When the first filtering module 801 is used to perform transport layer traffic filtering processing on the traffic data based on the transport layer traffic filtering policy set inside the target container, it is specifically used to:
  • the transport layer traffic filtering policy is read from the independent network namespace, based on the five-tuple information carried by the traffic data, and the five-tuple information that meets the transmission requirements and is not indicated by the transport layer traffic filtering policy. Five-tuple information that meets the transmission requirements is used to perform transport layer traffic filtering on the traffic data.
  • the target container is provided with a first network interface
  • the host is provided with a second network interface
  • the network bridge is provided with a third network interface and a fourth network interface; Wherein, the first network interface and the third network interface are communicatively connected, and the second network interface and the fourth network interface are communicatively connected;
  • the second filtering module 802 When the second filtering module 802 is used to forward the first data to the application layer detector through the network bridge connected to the target container, it is specifically used to:
  • the first data transmitted by the first network interface of the target container is received through the third network interface of the network bridge connected to the target container, and the packet forwarding function of the network bridge is called to forward the data. forwarding the first data to the application layer detector;
  • the first processing module 803 When the first processing module 803 is used to send the second data to the host connected to the network bridge through the network bridge, it is specifically used to:
  • the second data is forwarded to the second network interface of the host connected to the network bridge through the fourth network interface of the network bridge.
  • the second filtering module 802 when used to perform application layer traffic filtering processing on the first data through the application layer detector, it is specifically used to:
  • a traffic filtering model associated with the target container from a set of pre-trained traffic filtering models
  • FIG. 10 is a first schematic diagram of another flow transmission control device provided by an embodiment of the present disclosure.
  • FIG. 11 is a second schematic diagram of another flow transmission control device provided by an embodiment of the present disclosure.
  • the traffic transmission control device 1000 provided by the embodiment of the present disclosure includes:
  • the third filtering module 1001 is configured to respond to the traffic data received by the host and forward the traffic data to the application layer detector through the network bridge connected to the host, so as to filter the traffic through the application layer detector.
  • the data is subjected to application layer traffic filtering processing, and the traffic data processed by the application layer traffic filtering is used as third data;
  • the fourth filtering module 1002 is configured to send the third data to a target container connected to the network bridge through the network bridge, and filter all the data based on the transport layer traffic filtering policy set inside the target container.
  • the third data is subjected to transport layer traffic filtering processing, and the traffic data that passes the transport layer traffic filtering processing is used as the fourth data;
  • the second processing module 1003 is used to process the fourth data in the target container.
  • the target container is provided with a first network interface
  • the host is provided with a second network interface
  • the network bridge is provided with a third network interface and a fourth network interface; Wherein, the first network interface and the third network interface are communicatively connected, and the second network interface and the fourth network interface are communicatively connected;
  • the third filtering module 1001 When the third filtering module 1001 is used to forward the traffic data to the application layer detector through the network bridge connected to the host, it is specifically used to:
  • the traffic data transmitted by the second network interface of the host is received through the fourth network interface of the network bridge connected to the host, and the packet forwarding function of the network bridge is called to transfer the traffic data Forwarded to application layer detector;
  • the fourth filtering module 1002 When the fourth filtering module 1002 is used to send the third data to the target container connected to the network bridge through the network bridge, it is specifically used to:
  • the third data is forwarded to the first network interface of the target container connected to the network bridge through the third network interface of the network bridge.
  • the fourth filtering module 1002 when used to perform application layer traffic filtering processing on the traffic data through the application layer detector, it is specifically used to:
  • a traffic filtering model associated with the target container from a set of pre-trained traffic filtering models
  • application layer traffic filtering processing is performed on the traffic data.
  • the flow transmission control device 1000 further includes a second setting module 1004, the second setting module 1004 is used for:
  • the transport layer traffic filtering policy corresponding to the target container generated by the network policyr, and send the transport layer traffic filtering policy to the network bridge;
  • the transport layer traffic filtering policy indicates that there are five traffic layers that meet the transmission requirements. Tuple information and quintuple information that do not meet transmission requirements;
  • the fourth filtering module 1002 When the fourth filtering module 1002 is used to perform transport layer traffic filtering processing on the third data based on the transport layer traffic filtering policy set inside the target container, it is specifically used to:
  • the transport layer traffic filtering policy is read from the independent network namespace, based on the five-tuple information carried by the third data and the five-tuple information indicated by the transport layer traffic filtering policy that meets the transmission requirements and For quintuple information that does not meet the transmission requirements, the third data is subjected to transport layer traffic filtering processing.
  • a schematic structural diagram of an electronic device 1200 provided for an embodiment of the present disclosure includes:
  • the processor 1210 and the memory 1220 communicate through the bus 1230, so that The processor 1210 can execute the execution instructions mentioned in the above-mentioned traffic transmission control method embodiment.
  • Embodiments of the present disclosure also provide a computer-readable storage medium.
  • a computer program is stored on the computer-readable storage medium. When the computer program is run by a processor, the steps of the flow transmission control method described in the above method embodiment are executed.
  • the storage medium may be a volatile or non-volatile computer-readable storage medium.
  • Embodiments of the present disclosure also provide a computer program product.
  • the computer program product includes computer instructions.
  • the steps of the flow transmission control method described in the above method embodiments can be performed. For details, see The above method embodiments will not be described again here.
  • the above-mentioned computer program product can be specifically implemented by hardware, software or a combination thereof.
  • the computer program product is embodied as a computer storage medium.
  • the computer program product is embodied as a software product, such as a Software Development Kit (SDK), etc. wait.
  • SDK Software Development Kit
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in various embodiments of the present disclosure may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor.
  • the technical solution of the present disclosure is essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product.
  • the computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present disclosure.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program code. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Traffic Control Systems (AREA)

Abstract

本公开提供了一种流量传输控制方法、装置、设备及存储介质，通过在目标容器和主机之间配置网络桥接器，通过网络桥接器将流量数据转发到应用层检测器进行应用层流量过滤处理，可以兼容各种不同业务特性的目标容器，提升流量传输的稳定性；并且将传输层流量过滤策略直接作用于容器内部，在容器内部进行传输层流量过滤处理，防止由于网络防护策略的失误或异常导致容器集群出现故障问题，实现对容器环境下流量数据的安全检测和正常传输。

Description

一种流量传输控制方法、装置、设备及存储介质
本公开要求于2022年04月29日提交中国专利局、申请号为202210468297.9、申请名称为“一种流量传输控制方法、装置、设备及存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本公开涉及互联网技术领域，具体而言，涉及一种流量传输控制方法、装置、设备及存储介质。
背景技术
容器网络是一个开放的网络架构，一般的网络导流与阻断方案是使用容器网络接口(Container Network Interface，CNI)插件，CNI插件需要与容器网络匹配，才能获取流量数据并进行相应的安全扫描和网络策略阻断。这种控制方式主要是基于宿主机的网络的协议栈进行流量数据的过滤，达到网络隔离的目的，这种技术方案可以满足单一的容器网络环境的业务需求。
但是，随着容器技术的发展，出现了混合网络模式，很多容器的流量数据不再进入主机的协议栈，而是通过宿主机的物理网卡直接流向外部的虚拟交换机，如果仍然采用CNI插件，会由于无法获取到相关的流量数据而导致无效的安全扫描和网络策略阻断，进而可能出现无法对流量数据进行导流和传输的情况，影响流量数据传输的完整性，并且影响后续对流量数据进行流量检测的结果，降低容器环境的安全性和稳定性。
发明内容
本公开实施例至少提供一种流量传输控制方法、装置、设备及存储介质。
第一方面，本公开实施例提供了一种流量传输控制方法，所述方法包括：
响应于目标容器产生的流量数据，基于在所述目标容器内部设置的传输层流量过滤策略，对所述流量数据进行传输层流量过滤处理，将通过所述传输层流量过滤处理的流量数据作为第一数据；
通过与所述目标容器相连接的网络桥接器向应用层检测器转发所述第一数据，通过所述应用层检测器对所述第一数据进行应用层流量过滤处理，将通过所述应用层流量过滤处理的流量数据作为第二数据；
通过所述网络桥接器将所述第二数据发送到与所述网络桥接器连接的主机，并通过主机发送至所述第二数据对应的目的端。
一种可选的实施方式中，在基于在所述目标容器内部设置的传输层流量过滤策略，对所述流量数据进行传输层流量过滤处理之前，还包括：
获取网络策略器生成的与所述目标容器对应的传输层流量过滤策略，并将所述传输层流量过滤策略发送至所述网络桥接器；所述传输层流量过滤策略指示有符合传输要求的五元组信息和不符合传输要求的五元组信息；
通过所述网络桥接器将所述传输层流量过滤策略设置在所述目标容器的独立网络命名空间中；
所述基于在所述目标容器内部设置的传输层流量过滤策略，对所述流量数据进行传输层流量过滤处理，包括：
从所述独立网络命名空间中读取所述传输层流量过滤策略，基于所述流量数据携带的五元组信息，以及所述传输层流量过滤策略指示的符合传输要求的五元组信息和不符合传输要求的五元组信息，对所述流量数据进行传输层流量过滤处理。
一种可选的实施方式中，所述目标容器上设置有第一网络接口，所述主机上设置有第二网络接口；所述网络桥接器上设置有第三网络接口和第四网络接口；其中，所述第一网络接口和所述第三网络接口通信连接，所述第二网络接口和所述第四网络接口通信连接；
所述通过与所述目标容器相连接的网络桥接器向应用层检测器转发所述第一数据，包括：
通过与所述目标容器相连接的网络桥接器的第三网络接口接收所述目标容器的所述第一网络接口传输的所述第一数据，并调用所述网络桥接器的包转发功能将所述第一数据转发到应用层检测器；
所述通过所述网络桥接器将所述第二数据发送到与所述网络桥接器连接的主机，包括：
通过所述网络桥接器的所述第四网络接口将所述第二数据转发到与所述网络桥接器连接的主机的第二网络接口。
一种可选的实施方式中，通过所述应用层检测器对所述第一数据进行应用层流量过滤处理，包括：
通过所述应用层检测器从预先训练的流量过滤模型集中调用与所述目标容器关联的流量过滤模型；
基于调用的所述流量过滤模型，对所述第一数据进行应用层流量过滤处理。
第二方面，本公开实施例提供了一种流量传输控制方法，所述方法包括：
响应于主机接收的流量数据，通过与所述主机相连接的网络桥接器向应用层检测器转发所述流量数据，以通过所述应用层检测器对所述流量数据进行应用层流量过滤处理，将通过所述应用层流量过滤处理的流量数据作为第三数据；
通过所述网络桥接器将所述第三数据发送到与所述网络桥接器连接的目标容器，基于在所述目标容器内部设置的传输层流量过滤策略，对所述第三数据进行传输层流量过滤处理，将通过所述传输层流量过滤处理的流量数据作为第四数据；
在所述目标容器对所述第四数据进行处理。
一种可选的实施方式中，所述目标容器上设置有第一网络接口，所述主机上设置有第二网络接口；所述网络桥接器上设置有第三网络接口和第四网络接口；其中，所述第一网络接口和所述第三网络接口通信连接，所述第二网络接口和所述第四网络接口通信连接；
所述通过与所述主机相连接的网络桥接器向应用层检测器转发所述流量数据，包括：
通过与所述主机相连接的网络桥接器的第四网络接口接收所述主机的所述第二网络接口传输的所述流量数据，并调用所述网络桥接器的包转发功能将所述流量数据转发到应用层检测器；
所述通过所述网络桥接器将所述第三数据发送到与所述网络桥接器连接的目标容器，包括：
通过所述网络桥接器的所述第三网络接口将所述第三数据转发到与所述网络桥接器连接的目标容器的第一网络接口。
一种可选的实施方式中，通过所述应用层检测器对所述流量数据进行应用层流量过滤处理，包括：
通过所述应用层检测器从预先训练的流量过滤模型集中调用与所述目标容器关联的流量过滤模型；
基于调用的所述流量过滤模型，对所述流量数据进行应用层流量过滤处理。
一种可选的实施方式中，在基于在所述目标容器内部设置的传输层流量过滤策略，对所述第三数据进行传输层流量过滤处理之前，还包括：
获取网络策略器生成的与所述目标容器对应的传输层流量过滤策略，并将所述传输层流量过滤策略发送至所述网络桥接器；所述传输层流量过滤策略指示有符合传输要求的五元组信息和不符合传输要求的五元组信息；
通过所述网络桥接器将所述传输层流量过滤策略设置在所述目标容器的独立网络命名空间中；
所述基于在所述目标容器内部设置的传输层流量过滤策略，对所述第三数据进行传输层流量过滤处理，包括：
从所述独立网络命名空间中读取所述传输层流量过滤策略，基于所述第三数据携带的五元组信息，以及所述传输层流量过滤策略指示的符合传输要求的五元组信息和不符合传输要求的五元组信息，对所述第三数据进行传输层流量过滤处理。
第三方面，本公开实施例还提供一种流量传输控制装置，所述装置包括：
第一过滤模块，用于响应于目标容器产生的流量数据，基于在所述目标容器内部设置的传输层流量过滤策略，对所述流量数据进行传输层流量过滤处理，将通过所述传输层流量过滤处理的流量数据作为第一数据；
第二过滤模块，用于通过与所述目标容器相连接的网络桥接器向应用层检测器转发所述第一数据，通过所述应用层检测器对所述第一数据进行应用层流量过滤处理，将通过所述应用层流量过滤处理的流量数据作为第二数据；
第一处理模块，用于通过所述网络桥接器将所述第二数据发送到与所述网络桥接器连接的主机，并通过主机发送至所述第二数据对应的目的端。
第四方面，本公开实施例还提供一种流量传输控制装置，所述装置包括：
第三过滤模块，用于响应于主机接收的流量数据，通过与所述主机相连接的网络桥接器向应用层检测器转发所述流量数据，以通过所述应用层检测器对所述流量数据进行应用层流量过滤处理，将通过所述应用层流量过滤处理的流量数据作为第三数据；
第四过滤模块，用于通过所述网络桥接器将所述第三数据发送到与所述网络桥接器连接的目标容器，基于在所述目标容器内部设置的传输层流量过滤策略，对所述第三数据进行传输层流量过滤处理，将通过所述传输层流量过滤处理的流量数据作为第四数据；
第二处理模块，用于在所述目标容器对所述第四数据进行处理。
第五方面，本公开实施例还提供一种电子设备，包括：处理器、存储器和总线，所述存储器存储有所述处理器可执行的机器可读指令，当电子设备运行时，所述处理器与所述存储器之间通过总线通信，所述机器可读指令被所述处理器执行时执行上述第一方面，或第一方面中任一种可能的流量传输控制方法的步骤，或第二方面，或第二方面中任一种可 能的流量传输控制方法的步骤。
第六方面，本公开实施例还提供一种计算机可读存储介质，该计算机可读存储介质上存储有计算机程序，该计算机程序被处理器运行时执行上述第一方面，或第一方面中任一种可能的流量传输控制方法的步骤，或第二方面，或第二方面中任一种可能的流量传输控制方法的步骤。
关于上述的流量传输控制装置、电子设备、及计算机可读存储介质的效果描述参见上述流量传输控制方法的说明，这里不再赘述。
本公开实施例中，在流量数据从容器流出的场景下，将传输层流量过滤策略直接作用于容器内部，以对容器产生的流量数据在容器内部直接进行传输层流量过滤处理，可以降低对容器集群的影响，防止由于网络防护策略的失误或异常导致容器集群出现故障问题；另外，通过将网络桥接器配置在目标容器和主机之间，目标容器可以将通过传输层流量过滤处理的流量数据通过网络桥接器转发到应用层检测器进行应用层流量过滤处理后，将通过应用层流量过滤处理的流量数据发送到主机，由于网络桥接器可以兼容各种不同业务特性的容器的流量数据传输，具备良好的适应性、通用性、和鲁棒性，从而可以保障流量传输的稳定性和完整性，进而实现对容器环境下流量数据的安全检测和正常传输。
相应地，在流量数据流入容器的场景下，主机在接收到流量数据后，通过配置在主机与容器之间的网络桥接器将流量数据转发到应用层检测器进行应用层流量过滤处理，再将通过应用层流量过滤处理的流量数据转发到容器，通过容器内部设置的传输层流量过滤策略直接进行传输层流量过滤处理；一方面，通过在容器内部进行传输层流量过滤处理的机制，可以降低对容器集群的影响，防止由于网络防护策略的失误或异常导致容器集群出现故障问题；另一方面，由于配置在主机和容器之间的网络桥接器可以兼容各种不同业务特性的容器的流量数据传输，具备良好的适应性、通用性、和鲁棒性，从而可以保障流量传输的稳定性和完整性，进而实现对容器环境下流量数据的安全检测和正常传输。
为使本公开的上述目的、特征和优点能更明显易懂，下文特举较佳实施例，并配合所附附图，作详细说明如下。
附图说明
为了更清楚地说明本公开实施例的技术方案，下面将对实施例中所需要使用的附图作简单地介绍，此处的附图被并入说明书中并构成本说明书中的一部分，这些附图示出了符合本公开的实施例，并与说明书一起用于说明本公开的技术方案。应当理解，以下附图仅示出了本公开的某些实施例，因此不应被看作是对范围的限定，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他相关的附图。
图1示出了本公开实施例所提供的一种应用场景示意图；
图2示出了本公开实施例所提供的一种流量传输控制方法的流程图；
图3示出了本公开实施例所提供的一种网络接口示意图；
图4示出了本公开实施例所提供的一种包转发过程示意图；
图5示出了本公开实施例所提供的又一种流量传输控制方法的流程图；
图6示出了本公开实施例所提供的另一种流量传输控制方法的流程图；
图7示出了本公开实施例所提供的又一种流量传输控制方法的流程图；
图8示出了本公开实施例所提供的一种流量传输控制装置的示意图之一；
图9示出了本公开实施例所提供的一种流量传输控制装置的示意图之二；
图10示出了本公开实施例所提供的另一种流量传输控制装置的示意图之一；
图11示出了本公开实施例所提供的另一种流量传输控制装置的示意图之二；
图12示出了本公开实施例所提供的一种电子设备的示意图。
具体实施方式
为使本公开实施例的目的、技术方案和优点更加清楚，下面将结合本公开实施例中附图，对本公开实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本公开一部分实施例，而不是全部的实施例。通常在此处附图中描述和示出的本公开实施例的组件可以以各种不同的配置来布置和设计。因此，以下对在附图中提供的本公开的实施例的详细描述并非旨在限制要求保护的本公开的范围，而是仅仅表示本公开的选定实施例。基于本公开的实施例，本领域技术人员在没有做出创造性劳动的前提下所获得的所有其他实施例，都属于本公开保护的范围。
应注意到：相似的标号和字母在下面的附图中表示类似项，因此，一旦某一项在一个附图中被定义，则在随后的附图中不需要对其进行进一步定义和解释。
本文中术语“和/或”，仅仅是描述一种关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中术语“至少一种”表示多种中的任意一种或多种中的至少两种的任意组合，例如，包括A、B、C中的至少一种，可以表示包括从A、B和C构成的集合中选择的任意一个或多个元素。
经研究发现，一般的网络导流与阻断方案是使用容器网络接口(Container Network Interface，CNI)插件，即使用与容器网络匹配的CNI插件获取流量数据并进行相应的安全扫描和网络策略阻断，然而这无法适配容器环境中混合网络模式下的流量阻断与引流需求，并且CNI插件离容器较远，传输的流量数据存在完整性缺失的风险，导致获取到的流量数据失真，进而影响后续流量检测的结果，难以保证流量数据传输的完整性，影响容器环境的安全性和稳定性。
基于上述研究，本公开提供了一种流量传输控制方法，通过在目标容器和主机之间配置网络桥接器，通过网络桥接器将流量数据转发到应用层检测器进行应用层流量过滤处理，可以兼容各种不同业务特性的目标容器，提升流量传输的稳定性；并且将传输层流量过滤策略直接作用于容器内部，在容器内部进行传输层流量过滤处理，防止由于网络防护策略的失误或异常导致容器集群出现故障问题，实现对容器环境下流量数据的安全检测和正常传输。
为便于对本实施例进行理解，首先对本公开实施例所公开的一种流量传输控制方法进行详细介绍，本公开实施例所提供的流量传输控制方法的执行主体一般为具有一定计算能力的计算机设备，该计算机设备例如包括：终端设备或服务器或其它处理设备。在一些可能的实现方式中，该流量传输控制方法可以通过处理器调用存储器中存储的计算机可读指令的方式来实现。
下面对本公开实施例提供的流量传输控制方法加以说明。
请参阅图1，图1为本公开实施例提供的一种应用场景示意图。如图1中所示，为了 对从目标容器传输至主机的流量数据、以及从主机传输至目标容器的流量数据进行流量的过滤处理和传输控制，可以利用网络桥接器，将网络桥接器配置在目标容器和主机之间，以通过网络桥接器进行目标容器和主机之间的数据传输，进而还可以利用网络桥接器的包转发功能将流量数据转发到应用层检测器进行应用层流量过滤处理，从而提升流量传输的稳定性，保障容器环境下流量传输的正常进行。
请参阅图2，图2为本公开实施例提供的一种流量传输控制方法的流程图，该流量传输控制方法可以认为由网络流量管控器执行，该网络流量管控器可以部署在一个独立的计算机设备上或本公开实施例进行网络流量处理的主机上。如图2中所示，本公开实施例提供的流量传输控制方法包括步骤S201～S203，其中：
S201：响应于目标容器产生的流量数据，基于在所述目标容器内部设置的传输层流量过滤策略，对所述流量数据进行传输层流量过滤处理，将通过所述传输层流量过滤处理的流量数据作为第一数据。
这里，流量数据是目标容器基于网络传输协议生成的、待发送给其他容器或主机的数据。该步骤中，在检测到目标容器产生的流量数据后，根据在目标容器内部设置的流量过滤策略，对所述流量数据进行传输层流量过滤处理，针对未通过所述传输层流量过滤处理的流量数据，对其进行拦截，针对通过所述传输层流量过滤处理的流量数据，将其确定为第一数据，对其进行放行。
其中，所述传输层流量过滤处理为四层流量过滤处理，四层流量过滤处理是指在开放式系统互联通信参考模型(Open System Interconnection Reference Model，OSI)的第四层传输层，基于五元组信息进行流量数据的过滤与防护。
这里，五元组信息包括源互联网协议(Internet Protocol Address，IP)地址、源端口、目的IP地址、目的端口和传输层协议。
可以理解，传输层流量过滤处理即为获取流量数据携带的五元组信息，并获取传输层流量过滤策略指示的符合传输要求的五元组信息和不符合传输要求的五元组信息，以检测该流量数据的五元组信息是否符合传输层流量过滤策略指示的传输要求。
这里，为了能够在目标容器内部对所述流量数据进行传输层流量过滤处理，需要预先在目标容器内部设置相应的传输层流量过滤策略。
相应地，在一些可能的实施方式中，在基于在所述目标容器内部设置的传输层流量过滤策略，对所述流量数据进行传输层流量过滤处理之前，还包括：
获取网络策略器生成的与所述目标容器对应的传输层流量过滤策略，并将所述传输层流量过滤策略发送至所述网络桥接器；所述传输层流量过滤策略指示有符合传输要求的五元组信息和不符合传输要求的五元组信息；
通过所述网络桥接器将所述传输层流量过滤策略设置在所述目标容器的独立网络命名空间中。
该步骤中，可以获取网络策略器生成的传输层流量过滤策略，这里，所述传输层流量过滤策略与所述目标容器对应，以便在后续按照所述传输层流量过滤策略对目标容器产生的流量数据进行传输层流量过滤处理，在获取到所述传输层流量过滤策略的情况下，可以将所述传输层流量过滤策略发送至所述网络桥接器，并通过所述网络桥接器将所述传输层 流量过滤策略设置在所述目标容器的独立网络命名空间中。
可选地，所述传输层流量过滤策略可以是基于安全传输设定的网络访问接口规则生成的，所述传输层流量过滤策略指示目标容器可以访问的情况和不可以访问的情况，即指示符合传输要求的五元组信息和不符合传输要求的五元组信息。示例性的，针对目标容器A生成的、访问容器B的流量数据，传输层流量传输策略表征容器A不能访问容器B的3306端口，则容器A访问容器B的3306端口的访问过程对应的五元组信息即为传输层流量传输策略指示的不符合传输要求的五元组信息。
在将传输层流量过滤策略设置在所述目标容器的独立网络命名空间中后，就可以从所述独立网络命名空间中读取所述传输层流量过滤策略，按照所述传输层流量过滤策略对所述流量数据进行传输层流量过滤处理。
因此，在一些可能的实施方式中，所述基于在所述目标容器内部设置的传输层流量过滤策略，对所述流量数据进行传输层流量过滤处理，包括：
从所述独立网络命名空间中读取所述传输层流量过滤策略，基于所述流量数据携带的五元组信息，以及所述传输层流量过滤策略指示的符合传输要求的五元组信息和不符合传输要求的五元组信息，对所述流量数据进行传输层流量过滤处理。
可以理解，若所述流量数据携带的五元组信息与所述传输层流量过滤策略指示的符合传输要求的五元组信息匹配，可以确定所述流量数据通过传输层流量过滤处理，从而对所述流量数据进行放行；相反的，若所述流量数据携带的五元组信息与所述传输层流量过滤策略指示的不符合传输要求的五元组信息匹配，可以确定所述流量数据未通过传输层流量过滤处理，从而对所述流量数据进行拦截和过滤。
S202：通过与所述目标容器相连接的网络桥接器向应用层检测器转发所述第一数据，通过所述应用层检测器对所述第一数据进行应用层流量过滤处理，将通过所述应用层流量过滤处理的流量数据作为第二数据。
该步骤中，针对通过所述传输层流量过滤处理的第一数据，可以将所述第一数据从目标容器传输至网络桥接器，再通过网络桥接器转发到应用层检测器，以通过所述应用层检测器对所述第一数据进行应用层流量过滤处理，针对未通过所述应用层流量过滤处理的第一数据，对其进行拦截，针对通过所述应用层流量过滤处理的第一数据，将其确定为第二数据，对其进行放行。
其中，流量数据在虚拟网络设备之间的传输需要利用网络接口，网络接口均为成对出现，网络接口的一端连接着各自对应的虚拟网络设备，另一端彼此相连。
进而，在一些可能的实施方式中，所述目标容器上设置有第一网络接口，所述主机上设置有第二网络接口；所述网络桥接器上设置有第三网络接口和第四网络接口；其中，所述第一网络接口和所述第三网络接口通信连接，所述第二网络接口和所述第四网络接口通信连接。
请同时参阅图3，图3为本公开实施例提供的一种网络接口示意图。如图3中所示，传统模式是生成一对网络接口，一个网络接口设置在目标容器上，另一个网络接口设置在主机上，如图3中所示即为目标容器上设置有第一网络接口，主机上设置有第二网络接口，第一网络接口和第二网络接口通信连接，目标容器产生的流量数据通过第一网络接口发送 到主机的第二网络接口。
而在本实施例中，在目标容器上设置有第一网络接口，主机上设置有第二网络接口的基础上，加入网络桥接器，网络桥接器上设置有第三网络接口和第四网络接口，第一网络接口和第三网络接口通信连接，第二网络接口和第四网络接口通信连接，从而使得目标容器产生的流量数据可以通过网络桥接器发送到主机。
相应地，在一些可能的实施方式中，所述通过与所述目标容器相连接的网络桥接器向应用层检测器转发所述第一数据，包括：
通过与所述目标容器相连接的网络桥接器的第三网络接口接收所述目标容器的所述第一网络接口传输的所述第一数据，并调用所述网络桥接器的包转发功能将所述第一数据转发到应用层检测器。
该步骤中，由于所述第一网络接口和所述第三网络接口通信连接，因此可以通过所述网络桥接器的第三网络接口接收所述目标容器的所述第一网络接口传输的所述第一数据，以将所述第一数据从目标容器传输至网络桥接器，进而调用所述网络桥接器的包转发功能将所述第一数据转发到应用层检测器，以通过所述应用层检测器对所述第一数据进行应用层流量过滤处理。
这里，所述应用层流量过滤处理为七层流量过滤处理，七层流量过滤处理是指在开放式系统互联通信参考模型(Open System Interconnection Reference Model，OSI)的第七层应用层，根据应用层的业务规则进行流量数据的识别与过滤。
具体的，在一些可能的实施方式中，通过所述应用层检测器对所述第一数据进行应用层流量过滤处理，包括：
通过所述应用层检测器从预先训练的流量过滤模型集中调用与所述目标容器关联的流量过滤模型；
基于调用的所述流量过滤模型，对所述第一数据进行应用层流量过滤处理。
针对预先训练的流量过滤模型集，所述流量过滤模型集中包括多个流量过滤模型，每个流量过滤模型存储有与其对应的业务容器，因此可以通过所述应用层检测器从流量过滤模型集中调用与所述目标容器关联的流量过滤模型，从而基于调用的所述流量过滤模型，对所述第一数据进行应用层流量过滤处理。
这里，基于所述网络桥接器的包转发功能，可以实现内核态和用户态之间的转换。
具体的，可以使用一种内存映射文件的方法(mmap)，mmap机制是一种双工通信机制，可用于操作内核态与用户态通信进程之间的数据传递共享，即双方都读写同一块内存空间的数据来完成通信。
请同时参阅图4，图4为本公开实施例提供的一种包转发过程示意图。如图4中所示，传统模式是将网络策略器生成的传输层流量过滤策略(即为图中的四层过滤策略)直接发送到目标容器的宿主机上，通过宿主机的协议栈进行传输层流量过滤处理。而在本实施例中是将传输层流量过滤策略直接作用于目标容器内部，以对流量数据进行传输层流量过滤处理，从而降低对容器集群的影响，防止由于网络防护策略的失误或异常导致容器集群出现故障问题，同时还可以利用网络桥接器的包转发功能将流量数据转发到应用层检测器进行应用层流量过滤处理，如图4中所示即为将七层防护策略作用于用户态过滤引擎，以对 流量数据进行应用层流量过滤处理，网络桥接器可以兼容各种不同业务特性的目标容器，从而提升流量传输的稳定性，提高接收到的流量数据的完整性，实现对容器环境下流量数据的安全检测和正常传输。
具体的，通过所述网络桥接器的第三网络接口接收所述目标容器的所述第一网络接口传输的所述第一数据，此时所述第一数据处于内核态进程，此时可以基于mmap机制，将所述第一数据传递给用户态进程，在用户态进程进行应用层流量过滤处理，并生成检测结果信息，这里，所述检测结果信息并不包括数据信息，而是包括对于该第一数据是否通过应用层流量过滤处理的判定结果，此时可以基于mmap机制，将所述检测结果信息传递给内核态进程，在内核态进程做数据拦截或放行的处理，若该流量数据未通过应用层流量过滤处理，通过内核态过滤引擎将该流量数据过滤掉，即进行数据拦截处理，相反的，若该流量数据通过应用层流量过滤处理，进行数据放行处理。
S203：通过所述网络桥接器将所述第二数据发送到与所述网络桥接器连接的主机，并通过主机发送至所述第二数据对应的目的端。
该步骤中，在得到通过所述应用层流量过滤处理的第二数据后，可以同样利用网络接口，通过所述网络桥接器将所述第二数据发送到主机，这里，所述第二数据携带有发送的网络链路，通过主机按照所述第二数据携带的网络链路发送至所述第二数据对应的目的端。
通过上文内容可知，所述第二网络接口和所述第四网络接口通信连接，因此，在一些可能的实施方式中，所述通过所述网络桥接器将所述第二数据发送到与所述网络桥接器连接的主机，包括：
通过所述网络桥接器的所述第四网络接口将所述第二数据转发到与所述网络桥接器连接的主机的第二网络接口。
该步骤中，由于所述第二网络接口和所述第四网络接口通信连接，因此可以通过所述网络桥接器的所述第四网络接口将所述第二数据转发到所述主机的第二网络接口，以将通过所述应用层流量过滤处理的第二数据从网络桥接器传输至主机。
请参阅图5，图5为本公开实施例提供的又一种流量传输控制方法的流程图。如图5中所示，在流量数据从容器流出的场景下，针对目标容器产生的流量数据，先根据在目标容器内部设置的传输层流量过滤策略，对流量数据进行传输层流量过滤处理，得到通过传输层流量过滤处理的第一数据，对第一数据进行放行，对未通过传输层流量过滤处理的流量数据进行拦截和过滤，然后将第一数据通过网络桥接器转发到应用层检测器进行应用层流量过滤处理，得到通过应用层流量过滤处理的第二数据，对第二数据进行放行，对未通过应用层流量过滤处理的第一数据进行拦截和过滤，进而将第二数据通过网络桥接器发送到主机，并通过主机发送至第二数据对应的目的端。
本公开实施例提供的流量传输控制方法，可以响应于目标容器产生的流量数据，基于在所述目标容器内部设置的传输层流量过滤策略，对所述流量数据进行传输层流量过滤处理，将通过所述传输层流量过滤处理的流量数据作为第一数据；通过与所述目标容器相连接的网络桥接器向应用层检测器转发所述第一数据，通过所述应用层检测器对所述第一数据进行应用层流量过滤处理，将通过所述应用层流量过滤处理的流量数据作为第二数据；通过所述网络桥接器将所述第二数据发送到与所述网络桥接器连接的主机，并通过主机发 送至所述第二数据对应的目的端。
这样，在流量数据从容器流出的场景下，将传输层流量过滤策略直接作用于容器内部，以对容器产生的流量数据在容器内部直接进行传输层流量过滤处理，可以降低对容器集群的影响，防止由于网络防护策略的失误或异常导致容器集群出现故障问题；另外，通过将网络桥接器配置在目标容器和主机之间，目标容器可以将通过传输层流量过滤处理的流量数据通过网络桥接器转发到应用层检测器进行应用层流量流量过滤处理后，将通过应用层流量过滤处理的流量数据发送到主机，由于网络桥接器可以兼容各种不同业务特性的容器的流量数据传输，具备良好的适应性、通用性、和鲁棒性，从而可以保障流量传输的稳定性和完整性，进而实现对容器环境下流量数据的安全检测和正常传输。
请参阅图6，图6为本公开实施例提供的另一种流量传输控制方法的流程图，该流量传输控制方法可以认为由网络流量管控器执行，该网络流量管控器可以部署在一个独立的计算机设备上或本公开实施例进行网络流量处理的主机上。如图6中所示，本公开实施例提供的流量传输控制方法包括步骤S601～S603，其中：
S601：响应于主机接收的流量数据，通过与所述主机相连接的网络桥接器向应用层检测器转发所述流量数据，以通过所述应用层检测器对所述流量数据进行应用层流量过滤处理，将通过所述应用层流量过滤处理的流量数据作为第三数据。
这里，所述流量数据表征主机接收到的、基于网络传输协议生成的、待发送给容器的流量数据。该步骤中，在检测到主机接收到流量数据后，对所述流量数据进行应用层流量过滤处理，具体的，先将流量数据从主机传输至网络桥接器，再通过网络桥接器将所述流量数据转发到应用层检测器以进行应用层流量过滤处理。
其中，所述应用层流量过滤处理为七层流量过滤处理，七层流量过滤处理是指在开放式系统互联通信参考模型(Open System Interconnection Reference Model，OSI)的第七层应用层，根据应用层的业务规则进行流量数据的识别与过滤。
可以理解，所述应用层流量过滤处理为根据应用层的业务规则，检测所述流量数据携带的业务信息是否符合传输要求，这里，所述流量数据携带的业务信息可以包括统一资源定位符(Uniform Resource Locator，URL)地址、请求体(Body)参数信息等。
这里，通过上文内容可知，流量数据在虚拟网络设备之间的传输需要利用网络接口，网络接口均为成对出现，网络接口的一端连接着各自对应的虚拟网络设备，另一端彼此相连。
进而，在一些可能的实施方式中，所述目标容器上设置有第一网络接口，所述主机上设置有第二网络接口；所述网络桥接器上设置有第三网络接口和第四网络接口；其中，所述第一网络接口和所述第三网络接口通信连接，所述第二网络接口和所述第四网络接口通信连接。
具体可参见图3，图3为本公开实施例提供的一种网络接口示意图。如图3中所示，传统模式是生成一对网络接口，一个网络接口设置在目标容器上，另一个网络接口设置在主机上，如图中所示即为目标容器上设置有第一网络接口，主机上设置有第二网络接口，第一网络接口和第二网络接口通信连接，主机接收到的流量数据通过第二网络接口发送到目标容器的第一网络接口。
而在本实施例中，在目标容器上设置有第一网络接口，主机上设置有第二网络接口的基础上，加入网络桥接器，网络桥接器上设置有第三网络接口和第四网络接口，第一网络接口和第三网络接口通信连接，第二网络接口和第四网络接口通信连接，从而使得主机接收到的流量数据可以通过网络桥接器发送到目标容器。
相应地，在一些可能的实施方式中，所述通过与所述主机相连接的网络桥接器向应用层检测器转发所述流量数据，包括：
通过与所述主机相连接的网络桥接器的第四网络接口接收所述主机的所述第二网络接口传输的所述流量数据，并调用所述网络桥接器的包转发功能将所述流量数据转发到应用层检测器。
该步骤中，由于所述第二网络接口和所述第四网络接口通信连接，因此可以通过所述网络桥接器的所述第四网络接口接收所述主机的所述第二网络接口传输的所述流量数据，以将所述流量数据从主机传输至网络桥接器，在所述网络桥接器接收到所述流量数据的情况下，可以调用所述网络桥接器的包转发功能将所述流量数据转发到应用层检测器，以通过所述应用层检测器对所述流量数据进行应用层流量过滤处理。
具体的，在一些可能的实施方式中，通过所述应用层检测器对所述流量数据进行应用层流量过滤处理，包括：
通过所述应用层检测器从预先训练的流量过滤模型集中调用与所述目标容器关联的流量过滤模型；
基于调用的所述流量过滤模型，对所述流量数据进行应用层流量过滤处理。
针对预先训练的流量过滤模型集，所述流量过滤模型集中包括多个流量过滤模型，每个流量过滤模型存储有与其对应的业务容器，因此可以通过所述应用层检测器从流量过滤模型集中调用与所述目标容器关联的流量过滤模型，从而基于调用的所述流量过滤模型，对所述流量数据进行应用层流量过滤处理。
这里，基于所述网络桥接器的包转发功能，可以实现内核态和用户态之间的转换。
具体的，可以使用一种内存映射文件的方法(mmap)，mmap机制是一种双工通信机制，可用于操作内核态与用户态通信进程之间的数据传递共享，即双方都读写同一块内存空间的数据来完成通信。
具体可参见图4，图4为本公开实施例提供的一种包转发过程示意图。如图4中所示，传统模式是将网络策略器生成的传输层流量过滤策略(即为图中的四层过滤策略)直接发送到目标容器的宿主机上，通过宿主机的协议栈进行传输层流量过滤处理。而在本实施例中是将传输层流量过滤策略直接作用于目标容器内部，以对流量数据进行传输层流量过滤处理，从而降低对容器集群的影响，防止由于网络防护策略的失误或异常导致容器集群出现故障问题，同时还可以利用网络桥接器的包转发功能将流量数据转发到应用层检测器进行应用层流量过滤处理，如图4中所示即为将七层防护策略作用于用户态过滤引擎，以对流量数据进行应用层流量过滤处理，网络桥接器可以兼容各种不同业务特性的目标容器，从而提升流量传输的稳定性，提高接收到的流量数据的完整性，实现对容器环境下流量数据的安全检测和正常传输。
具体的，通过所述网络桥接器的第四网络接口接收所述主机的所述第二网络接口传输 的流量数据，此时流量数据处于内核态进程，可以基于mmap机制，将流量数据传递给用户态进程，在用户态进程进行应用层流量过滤处理，并生成检测结果信息，这里，所述检测结果信息并不包括数据信息，而是包括对于该流量数据是否通过应用层流量过滤处理的判定结果，此时可以基于mmap机制，将所述检测结果信息传递给内核态进程，在内核态进程做数据拦截或放行的处理，若该流量数据未通过应用层流量过滤处理，通过内核态过滤引擎将该流量数据过滤掉，即进行数据拦截处理，相反的，若该流量数据通过应用层流量过滤处理，进行数据放行处理。
S602：通过所述网络桥接器将所述第三数据发送到与所述网络桥接器连接的目标容器，基于在所述目标容器内部设置的传输层流量过滤策略，对所述第三数据进行传输层流量过滤处理，将通过所述传输层流量过滤处理的流量数据作为第四数据。
该步骤中，在得到通过应用层流量过滤处理的第三数据后，可以同样利用网络接口，通过所述网络桥接器将所述第三数据发送到目标容器，从而根据在所述目标容器内部设置的传输层流量过滤策略，对所述第三数据进行传输层流量过滤处理，针对未通过所述传输层流量过滤处理的第三数据，对其进行拦截，针对通过所述传输层流量过滤处理的第三数据，将其确定为第四数据，对其进行放行。
其中，所述传输层流量过滤处理为四层流量过滤处理，四层流量过滤处理是指在开放式系统互联通信参考模型(Open System Interconnection Reference Model，OSI)的第四层传输层，基于五元组信息进行流量数据的过滤与防护。
这里，五元组信息包括源互联网协议(Internet Protocol Address，IP)地址、源端口、目的IP地址、目的端口和传输层协议。
可以理解，传输层流量过滤处理即为获取第三数据携带的五元组信息，并获取传输层流量过滤策略指示的符合传输要求的五元组信息和不符合传输要求的五元组信息，以检测该第三数据的五元组信息是否符合传输层流量过滤策略指示的传输要求。
通过上文内容可知，所述第一网络接口和所述第三网络接口通信连接，因此，在一些可能的实施方式中，所述通过所述网络桥接器将所述第三数据发送到与所述网络桥接器连接的目标容器，包括：
通过所述网络桥接器的所述第三网络接口将所述第三数据转发到与所述网络桥接器连接的目标容器的第一网络接口。
该步骤中，由于所述第一网络接口和所述第三网络接口通信连接，因此可以通过所述网络桥接器的所述第三网络接口，将所述第三数据转发到所述目标容器的第一网络接口，进而基于在所述目标容器内部设置的传输层流量过滤策略，对所述第三数据进行传输层流量过滤处理。
可以理解，为了能够在目标容器内部对所述第三数据进行传输层流量过滤处理，需要预先在目标容器内部设置相应的传输层流量过滤策略。
相应地，在一些可能的实施方式中，在基于在所述目标容器内部设置的传输层流量过滤策略，对所述第三数据进行传输层流量过滤处理之前，还包括：
获取网络策略器生成的与所述目标容器对应的传输层流量过滤策略，并将所述传输层流量过滤策略发送至所述网络桥接器；所述传输层流量过滤策略指示有符合传输要求的五 元组信息和不符合传输要求的五元组信息；
通过所述网络桥接器将所述传输层流量过滤策略设置在所述目标容器的独立网络命名空间中。
该步骤中，可以获取网络策略器生成的传输层流量过滤策略，这里，所述传输层流量过滤策略与所述目标容器对应，以便在后续按照所述传输层流量过滤策略对目标容器接收的流量数据进行传输层流量过滤处理，在获取到所述传输层流量过滤策略的情况下，可以将所述传输层流量过滤策略发送至所述网络桥接器，并通过所述网络桥接器将所述传输层流量过滤策略设置在所述目标容器的独立网络命名空间中。
在将传输层流量过滤策略设置在所述目标容器的独立网络命名空间中后，就可以从所述独立网络命名空间中读取所述传输层流量过滤策略，按照所述传输层流量过滤策略对所述流量数据进行传输层流量过滤处理。
因此，在一些可能的实施方式中，所述基于在所述目标容器内部设置的传输层流量过滤策略，对所述第三数据进行传输层流量过滤处理，包括：
从所述独立网络命名空间中读取所述传输层流量过滤策略，基于所述第三数据携带的五元组信息，以及所述传输层流量过滤策略指示的符合传输要求的五元组信息和不符合传输要求的五元组信息，对所述第三数据进行传输层流量过滤处理。
可以理解，若所述第三数据携带的五元组信息与所述传输层流量过滤策略指示的符合传输要求的五元组信息匹配，可以确定所述第三数据通过传输层流量过滤处理，从而对所述第三数据进行放行；相反的，若所述第三数据携带的五元组信息与所述传输层流量过滤策略指示的不符合传输要求的五元组信息匹配，可以确定所述第三数据未通过传输层流量过滤处理，从而对所述第三数据进行拦截和过滤。
S603：在所述目标容器对所述第四数据进行处理。
该步骤中，在确定通过所述传输层流量过滤处理的第四数据后，可以在目标容器相应的服务进程中，对目标容器接收到的所述第四数据进行处理。
请参阅图7，图7为本公开实施例提供的又一种流量传输控制方法的流程图。如图7中所示，在流量数据流入容器的场景下，针对主机接收到的流量数据，先将流量数据通过网络桥接器转发到应用层检测器进行应用层流量过滤处理，得到通过应用层流量过滤处理的第三数据，对第三数据进行放行，对未通过应用层流量过滤处理的流量数据进行拦截和过滤，然后将第三数据通过网络桥接器发送到目标容器，根据在目标容器内部设置的传输层流量过滤策略，对第三数据进行传输层流量过滤处理，得到通过传输层流量过滤处理的第四数据，对第四数据进行放行，对未通过传输层流量过滤处理的第三数据进行拦截和过滤，进而在目标容器对第四数据进行处理。
本公开实施例提供的流量传输控制方法，可以响应于主机接收的流量数据，通过与所述主机相连接的网络桥接器向应用层检测器转发所述流量数据，以通过所述应用层检测器对所述流量数据进行应用层流量过滤处理，将通过所述应用层流量过滤处理的流量数据作为第三数据；通过所述网络桥接器将所述第三数据发送到与所述网络桥接器连接的目标容器，基于在所述目标容器内部设置的传输层流量过滤策略，对所述第三数据进行传输层流量过滤处理，将通过所述传输层流量过滤处理的流量数据作为第四数据；在所述目标容器 对所述第四数据进行处理。
这样，主机在接收到流量数据后，通过配置在主机与容器之间的网络桥接器将流量数据转发到应用层检测器进行应用层流量过滤处理，再将通过应用层流量过滤处理的流量数据转发到容器，通过容器内部设置的传输层流量过滤策略直接进行传输层流量过滤处理；一方面，通过在容器内部进行传输层流量过滤处理的机制，可以降低对容器集群的影响，防止由于网络防护策略的失误或异常导致容器集群出现故障问题；另一方面，由于配置在主机和容器之间的网络桥接器可以兼容各种不同业务特性的容器的流量数据传输，具备良好的适应性、通用性、和鲁棒性，从而可以保障流量传输的稳定性和完整性，进而实现对容器环境下流量数据的安全检测和正常传输。
本领域技术人员可以理解，在具体实施方式的上述方法中，各步骤的撰写顺序并不意味着严格的执行顺序而对实施过程构成任何限定，各步骤的具体执行顺序应当以其功能和可能的内在逻辑确定。
基于同一发明构思，本公开实施例中还提供了与流量传输控制方法对应的流量传输控制装置，由于本公开实施例中的装置解决问题的原理与本公开实施例上述流量传输控制方法相似，因此装置的实施可以参见方法的实施，重复之处不再赘述。
请参阅图8和图9，图8为本公开实施例提供的一种流量传输控制装置的示意图之一，图9为本公开实施例提供的一种流量传输控制装置的示意图之二。如图8中所示，本公开实施例提供的流量传输控制装置800包括：
第一过滤模块801，用于响应于目标容器产生的流量数据，基于在所述目标容器内部设置的传输层流量过滤策略，对所述流量数据进行传输层流量过滤处理，将通过所述传输层流量过滤处理的流量数据作为第一数据；
第二过滤模块802，用于通过与所述目标容器相连接的网络桥接器向应用层检测器转发所述第一数据，通过所述应用层检测器对所述第一数据进行应用层流量过滤处理，将通过所述应用层流量过滤处理的流量数据作为第二数据；
第一处理模块803，用于通过所述网络桥接器将所述第二数据发送到与所述网络桥接器连接的主机，并通过主机发送至所述第二数据对应的目的端。
一种可选的实施方式中，如图9中所示，所述流量传输控制装置800还包括第一设置模块804，所述第一设置模块804用于：
获取网络策略器生成的与所述目标容器对应的传输层流量过滤策略，并将所述传输层流量过滤策略发送至所述网络桥接器；所述传输层流量过滤策略指示有符合传输要求的五元组信息和不符合传输要求的五元组信息；
通过所述网络桥接器将所述传输层流量过滤策略设置在所述目标容器的独立网络命名空间中；
所述第一过滤模块801在用于基于在所述目标容器内部设置的传输层流量过滤策略，对所述流量数据进行传输层流量过滤处理时，具体用于：
从所述独立网络命名空间中读取所述传输层流量过滤策略，基于所述流量数据携带的五元组信息，以及所述传输层流量过滤策略指示的符合传输要求的五元组信息和不符合传输要求的五元组信息，对所述流量数据进行传输层流量过滤处理。
一种可选的实施方式中，所述目标容器上设置有第一网络接口，所述主机上设置有第二网络接口；所述网络桥接器上设置有第三网络接口和第四网络接口；其中，所述第一网络接口和所述第三网络接口通信连接，所述第二网络接口和所述第四网络接口通信连接；
所述第二过滤模块802在用于通过与所述目标容器相连接的网络桥接器向应用层检测器转发所述第一数据时，具体用于：
通过与所述目标容器相连接的网络桥接器的第三网络接口接收所述目标容器的所述第一网络接口传输的所述第一数据，并调用所述网络桥接器的包转发功能将所述第一数据转发到应用层检测器；
所述第一处理模块803在用于通过所述网络桥接器将所述第二数据发送到与所述网络桥接器连接的主机时，具体用于：
通过所述网络桥接器的所述第四网络接口将所述第二数据转发到与所述网络桥接器连接的主机的第二网络接口。
一种可选的实施方式中，所述第二过滤模块802在用于通过所述应用层检测器对所述第一数据进行应用层流量过滤处理时，具体用于：
通过所述应用层检测器从预先训练的流量过滤模型集中调用与所述目标容器关联的流量过滤模型；
请参阅图10和图11，图10为本公开实施例提供的另一种流量传输控制装置的示意图之一，图11为本公开实施例提供的另一种流量传输控制装置的示意图之二。如图10中所示，本公开实施例提供的流量传输控制装置1000包括：
第三过滤模块1001，用于响应于主机接收的流量数据，通过与所述主机相连接的网络桥接器向应用层检测器转发所述流量数据，以通过所述应用层检测器对所述流量数据进行应用层流量过滤处理，将通过所述应用层流量过滤处理的流量数据作为第三数据；
第四过滤模块1002，用于通过所述网络桥接器将所述第三数据发送到与所述网络桥接器连接的目标容器，基于在所述目标容器内部设置的传输层流量过滤策略，对所述第三数据进行传输层流量过滤处理，将通过所述传输层流量过滤处理的流量数据作为第四数据；
第二处理模块1003，用于在所述目标容器对所述第四数据进行处理。
一种可选的实施方式中，所述目标容器上设置有第一网络接口，所述主机上设置有第二网络接口；所述网络桥接器上设置有第三网络接口和第四网络接口；其中，所述第一网络接口和所述第三网络接口通信连接，所述第二网络接口和所述第四网络接口通信连接；
所述第三过滤模块1001在用于通过与所述主机相连接的网络桥接器向应用层检测器转发所述流量数据时，具体用于：
通过与所述主机相连接的网络桥接器的第四网络接口接收所述主机的所述第二网络接口传输的所述流量数据，并调用所述网络桥接器的包转发功能将所述流量数据转发到应用层检测器；
所述第四过滤模块1002在用于将通过所述网络桥接器将所述第三数据发送到与所述网络桥接器连接的目标容器时，具体用于：
通过所述网络桥接器的所述第三网络接口将所述第三数据转发到与所述网络桥接器连接的目标容器的第一网络接口。
一种可选的实施方式中，所述第四过滤模块1002在用于通过所述应用层检测器对所述流量数据进行应用层流量过滤处理时，具体用于：
通过所述应用层检测器从预先训练的流量过滤模型集中调用与所述目标容器关联的流量过滤模型；
基于调用的所述流量过滤模型，对所述流量数据进行应用层流量过滤处理。
一种可选的实施方式中，如图11中所示，所述流量传输控制装置1000还包括第二设置模块1004，所述第二设置模块1004用于：
获取网络策略器生成的与所述目标容器对应的传输层流量过滤策略，并将所述传输层流量过滤策略发送至所述网络桥接器；所述传输层流量过滤策略指示有符合传输要求的五元组信息和不符合传输要求的五元组信息；
通过所述网络桥接器将所述传输层流量过滤策略设置在所述目标容器的独立网络命名空间中；
所述第四过滤模块1002在用于基于在所述目标容器内部设置的传输层流量过滤策略，对所述第三数据进行传输层流量过滤处理时，具体用于：
从所述独立网络命名空间中读取所述传输层流量过滤策略，基于所述第三数据携带的五元组信息，以及所述传输层流量过滤策略指示的符合传输要求的五元组信息和不符合传输要求的五元组信息，对所述第三数据进行传输层流量过滤处理。
关于装置中的各模块的处理流程、以及各模块之间的交互流程的描述可以参照上述方法实施例中的相关说明，这里不再详述。
基于同一技术构思，本公开实施例还提供了一种电子设备。参照图12所示，为本公开实施例提供的电子设备1200结构示意图，包括：
处理器1210、存储器1220、和总线1230；存储器1220用于存储执行指令，包括内存1221和外部存储器1222；这里的内存1221也称内存储器，用于暂时存放处理器1210中的运算数据，以及与硬盘等外部存储器1222交换的数据，处理器1210通过内存1221与外部存储器1222进行数据交换，当所述电子设备1200运行时，所述处理器1210与所述存储器1220之间通过总线1230通信，使得所述处理器1210可以执行上述的流量传输控制方法实施例中所提及的执行指令。
本公开实施例还提供一种计算机可读存储介质，该计算机可读存储介质上存储有计算机程序，该计算机程序被处理器运行时执行上述方法实施例中所述的流量传输控制方法的步骤。其中，该存储介质可以是易失性或非易失的计算机可读取存储介质。
本公开实施例还提供一种计算机程序产品，该计算机程序产品包括有计算机指令，所述计算机指令被处理器执行时可以执行上述方法实施例中所述的流量传输控制方法的步骤，具体可参见上述方法实施例，在此不再赘述。
其中，上述计算机程序产品可以具体通过硬件、软件或其结合的方式实现。在一个可选实施例中，所述计算机程序产品具体体现为计算机存储介质，在另一个可选实施例中，计算机程序产品具体体现为软件产品，例如软件开发包(Software Development Kit，SDK)等等。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的设备和装置的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。在本公开所提供的几个实施例中，应该理解到，所揭露的设备、装置和方法，可以通过其它的方式实现。以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，又例如，多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些通信接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本公开各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个处理器可执行的非易失的计算机可读取存储介质中。基于这样的理解，本公开的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本公开各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
最后应说明的是：以上所述实施例，仅为本公开的具体实施方式，用以说明本公开的技术方案，而非对其限制，本公开的保护范围并不局限于此，尽管参照前述实施例对本公开进行了详细的说明，本领域的普通技术人员应当理解：任何熟悉本技术领域的技术人员在本公开揭露的技术范围内，其依然可以对前述实施例所记载的技术方案进行修改或可轻易想到变化，或者对其中部分技术特征进行等同替换；而这些修改、变化或者替换，并不使相应技术方案的本质脱离本公开实施例技术方案的精神和范围，都应涵盖在本公开的保护范围之内。因此，本公开的保护范围应所述以权利要求的保护范围为准。

Claims (13)

  1. 一种流量传输控制方法，所述方法包括：
    响应于目标容器产生的流量数据，基于在所述目标容器内部设置的传输层流量过滤策略，对所述流量数据进行传输层流量过滤处理，将通过所述传输层流量过滤处理的流量数据作为第一数据；
    通过与所述目标容器相连接的网络桥接器向应用层检测器转发所述第一数据，通过所述应用层检测器对所述第一数据进行应用层流量过滤处理，将通过所述应用层流量过滤处理的流量数据作为第二数据；
    通过所述网络桥接器将所述第二数据发送到与所述网络桥接器连接的主机，并通过主机发送至所述第二数据对应的目的端。
  2. 根据权利要求1所述的方法，其中，在基于在所述目标容器内部设置的传输层流量过滤策略，对所述流量数据进行传输层流量过滤处理之前，还包括：
    获取网络策略器生成的与所述目标容器对应的传输层流量过滤策略，并将所述传输层流量过滤策略发送至所述网络桥接器；所述传输层流量过滤策略指示有符合传输要求的五元组信息和不符合传输要求的五元组信息；
    通过所述网络桥接器将所述传输层流量过滤策略设置在所述目标容器的独立网络命名空间中；
    所述基于在所述目标容器内部设置的传输层流量过滤策略，对所述流量数据进行传输层流量过滤处理，包括：
    从所述独立网络命名空间中读取所述传输层流量过滤策略，基于所述流量数据携带的五元组信息，以及所述传输层流量过滤策略指示的符合传输要求的五元组信息和不符合传输要求的五元组信息，对所述流量数据进行传输层流量过滤处理。
  3. 根据权利要求1所述的方法，其中，所述目标容器上设置有第一网络接口，所述主机上设置有第二网络接口；所述网络桥接器上设置有第三网络接口和第四网络接口；其中，所述第一网络接口和所述第三网络接口通信连接，所述第二网络接口和所述第四网络接口通信连接；
    所述通过与所述目标容器相连接的网络桥接器向应用层检测器转发所述第一数据，包括：
    通过与所述目标容器相连接的网络桥接器的第三网络接口接收所述目标容器的所述第一网络接口传输的所述第一数据，并调用所述网络桥接器的包转发功能将所述第一数据转发到应用层检测器；
    所述通过所述网络桥接器将所述第二数据发送到与所述网络桥接器连接的主机，包括：
    通过所述网络桥接器的所述第四网络接口将所述第二数据转发到与所述网络桥接器连接的主机的第二网络接口。
  4. 根据权利要求1所述的方法，其中，所述通过所述应用层检测器对所述第一数据进行应用层流量过滤处理，包括：
    通过所述应用层检测器从预先训练的流量过滤模型集中调用与所述目标容器关联的流量过滤模型；
    基于调用的所述流量过滤模型，对所述第一数据进行应用层流量过滤处理。
  5. 一种流量传输控制方法，所述方法包括：
    响应于主机接收的流量数据，通过与所述主机相连接的网络桥接器向应用层检测器转发所述流量数据，以通过所述应用层检测器对所述流量数据进行应用层流量过滤处理，将通过所述应用层流量过滤处理的流量数据作为第三数据；
    通过所述网络桥接器将所述第三数据发送到与所述网络桥接器连接的目标容器，基于在所述目标容器内部设置的传输层流量过滤策略，对所述第三数据进行传输层流量过滤处理，将通过所述传输层流量过滤处理的流量数据作为第四数据；
    在所述目标容器对所述第四数据进行处理。
  6. 根据权利要求5所述的方法，其中，所述目标容器上设置有第一网络接口，所述主机上设置有第二网络接口；所述网络桥接器上设置有第三网络接口和第四网络接口；其中，所述第一网络接口和所述第三网络接口通信连接，所述第二网络接口和所述第四网络接口通信连接；
    所述通过与所述主机相连接的网络桥接器向应用层检测器转发所述流量数据，包括：
    通过与所述主机相连接的网络桥接器的第四网络接口接收所述主机的所述第二网络接口传输的所述流量数据，并调用所述网络桥接器的包转发功能将所述流量数据转发到应用层检测器；
    所述通过所述网络桥接器将所述第三数据发送到与所述网络桥接器连接的目标容器，包括：
    通过所述网络桥接器的所述第三网络接口将所述第三数据转发到与所述网络桥接器连接的目标容器的第一网络接口。
  7. 根据权利要求5所述的方法，其中，所述通过所述应用层检测器对所述流量数据进行应用层流量过滤处理，包括：
    通过所述应用层检测器从预先训练的流量过滤模型集中调用与所述目标容器关联的流量过滤模型；
    基于调用的所述流量过滤模型，对所述流量数据进行应用层流量过滤处理。
  8. 根据权利要求5所述的方法，其中，在基于在所述目标容器内部设置的传输层流量过滤策略，对所述第三流量数据进行传输层流量过滤处理之前，还包括：
    获取网络策略器生成的与所述目标容器对应的传输层流量过滤策略，并将所述传输层流量过滤策略发送至所述网络桥接器；所述传输层流量过滤策略指示有符合传输要求的五元组信息和不符合传输要求的五元组信息；
    通过所述网络桥接器将所述传输层流量过滤策略设置在所述目标容器的独立网络命名空间中；
    所述基于在所述目标容器内部设置的传输层流量过滤策略，对所述第三数据进行传输层流量过滤处理，包括：
    从所述独立网络命名空间中读取所述传输层流量过滤策略，基于所述第三数据携带的五元组信息，以及所述传输层流量过滤策略指示的符合传输要求的五元组信息和不符合传输要求的五元组信息，对所述第三数据进行传输层流量过滤处理。
  9. 一种流量传输控制装置，所述装置包括：
    第一过滤模块，用于响应于目标容器产生的流量数据，基于在所述目标容器内部设置的传输层流量过滤策略，对所述流量数据进行传输层流量过滤处理，将通过所述传输层流量过滤处理的流量数据作为第一数据；
    第二过滤模块，用于通过与所述目标容器相连接的网络桥接器向应用层检测器转发所述第一数据，通过所述应用层检测器对所述第一数据进行应用层流量过滤处理，将通过所述应用层流量过滤处理的流量数据作为第二数据；
    第一处理模块，用于通过所述网络桥接器将所述第二数据发送到与所述网络桥接器连接的主机，并通过主机发送至所述第二数据对应的目的端。
  10. 一种流量传输控制装置，所述装置包括：
    第三过滤模块，用于响应于主机接收的流量数据，通过与所述主机相连接的网络桥接器向应用层检测器转发所述流量数据，以通过所述应用层检测器对所述流量数据进行应用层流量过滤处理，将通过所述应用层流量过滤处理的流量数据作为第三数据；
    第四过滤模块，用于通过所述网络桥接器将所述第三数据发送到与所述网络桥接器连接的目标容器，基于在所述目标容器内部设置的传输层流量过滤策略，对所述第三数据进行传输层流量过滤处理，将通过所述传输层流量过滤处理的流量数据作为第四数据；
    第二处理模块，用于在所述目标容器对所述第四数据进行处理。
  11. 一种电子设备，包括：处理器、存储器和总线，所述存储器存储有所述处理器可执行的机器可读指令，当电子设备运行时，所述处理器与所述存储器之间通过总线通信，所述机器可读指令被所述处理器执行时执行如权利要求1至4或者权利要求5至8中任一项所述的流量传输控制方法的步骤。
  12. 一种计算机可读存储介质，该计算机可读存储介质上存储有计算机程序，该计算机程序被处理器运行时执行如权利要求1至4或者权利要求5至8中任一项所述的流量传输控制方法的步骤。
  13. 一种计算机程序产品，所述计算机程序产品在设备上运行时，使得所述设备执行如权利要求1至4或者权利要求5至8中任一项所述的流量传输控制方法的步骤。
PCT/CN2023/086761 2022-04-29 2023-04-07 一种流量传输控制方法、装置、设备及存储介质 Ceased WO2023207547A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP23794980.5A EP4518246A4 (en) 2022-04-29 2023-04-07 TRAFFIC TRANSMISSION CONTROL METHOD AND APPARATUS, AND STORAGE DEVICE AND MEDIUM
US18/930,882 US12323388B2 (en) 2022-04-29 2024-10-29 Traffic transmission control method, apparatus, device, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210468297.9 2022-04-29
CN202210468297.9A CN114978610B (zh) 2022-04-29 2022-04-29 一种流量传输控制方法、装置、设备及存储介质

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/930,882 Continuation US12323388B2 (en) 2022-04-29 2024-10-29 Traffic transmission control method, apparatus, device, and storage medium

Publications (1)

Publication Number Publication Date
WO2023207547A1 true WO2023207547A1 (zh) 2023-11-02

Family

ID=82979229

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/086761 Ceased WO2023207547A1 (zh) 2022-04-29 2023-04-07 一种流量传输控制方法、装置、设备及存储介质

Country Status (4)

Country Link
US (1) US12323388B2 (zh)
EP (1) EP4518246A4 (zh)
CN (1) CN114978610B (zh)
WO (1) WO2023207547A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114978610B (zh) * 2022-04-29 2024-05-28 北京火山引擎科技有限公司 一种流量传输控制方法、装置、设备及存储介质
CN116226846B (zh) 2022-12-28 2024-07-23 北京火山引擎科技有限公司 一种容器的安全检测方法、装置及设备
US20250337788A1 (en) * 2024-04-26 2025-10-30 Oracle International Corporation Traffic aware policy engine

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090328210A1 (en) * 2008-06-30 2009-12-31 Microsoft Corporation Chain of events tracking with data tainting for automated security feedback
US20180278639A1 (en) * 2015-10-01 2018-09-27 Twistlock, Ltd. Dynamically adapted traffic inspection and filtering in containerized environments
US20190058722A1 (en) * 2015-10-01 2019-02-21 Twistlock, Ltd. Traffic enforcement in containerized environments
US20210067538A1 (en) * 2019-08-27 2021-03-04 Illumio, Inc. Virtual Patching In A Label-Based Segmented Network Environment
CN114978610A (zh) * 2022-04-29 2022-08-30 北京火山引擎科技有限公司 一种流量传输控制方法、装置、设备及存储介质

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8572717B2 (en) * 2008-10-09 2013-10-29 Juniper Networks, Inc. Dynamic access control policy with port restrictions for a network security appliance
CN104380667B (zh) * 2013-06-14 2017-09-12 华为技术有限公司 一种数据报文的路由方法和设备
CN107864062B (zh) * 2016-12-14 2021-02-09 中国电子科技网络信息安全有限公司 一种容器防火墙系统部署方法
CN107666446B (zh) * 2017-09-14 2020-06-05 北京京东尚科信息技术有限公司 下行流量、上行流量、双向流量限制方法和装置
CN107835179B (zh) * 2017-11-14 2021-05-04 超越科技股份有限公司 一种基于虚拟化容器的应用程序防护方法与装置
GB201721847D0 (en) * 2017-12-22 2018-02-07 Telecom Paris Tech Priority map for media files
CN109981549A (zh) * 2017-12-28 2019-07-05 中移（杭州）信息技术有限公司 一种安全防护系统、方法及介质
CN108200038A (zh) * 2017-12-28 2018-06-22 山东浪潮云服务信息科技有限公司 一种虚拟机安全防护方法、装置、可读介质及存储控制器
US11888899B2 (en) * 2018-01-24 2024-01-30 Nicira, Inc. Flow-based forwarding element configuration
US11283676B2 (en) * 2018-06-11 2022-03-22 Nicira, Inc. Providing shared memory for access by multiple network service containers executing on single service machine
US11431732B2 (en) * 2019-07-04 2022-08-30 Check Point Software Technologies Ltd. Methods and system for packet control and inspection in containers and meshed environments
US11431621B2 (en) * 2020-07-15 2022-08-30 Verizon Patent And Licensing Inc. Systems and methods for user plane function (“UPF”) offload at configurable routing fabric
CN114143203B (zh) * 2021-11-05 2023-11-10 华东师范大学 一种基于动态服务拓扑映射的Kubernetes容器网络数据包指标采集的方法及系统
CN114237928A (zh) * 2021-11-29 2022-03-25 南京中孚信息技术有限公司 容器间通信方法及装置、电子设备、计算机可读存储介质

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090328210A1 (en) * 2008-06-30 2009-12-31 Microsoft Corporation Chain of events tracking with data tainting for automated security feedback
US20180278639A1 (en) * 2015-10-01 2018-09-27 Twistlock, Ltd. Dynamically adapted traffic inspection and filtering in containerized environments
US20190058722A1 (en) * 2015-10-01 2019-02-21 Twistlock, Ltd. Traffic enforcement in containerized environments
US20210067538A1 (en) * 2019-08-27 2021-03-04 Illumio, Inc. Virtual Patching In A Label-Based Segmented Network Environment
CN114978610A (zh) * 2022-04-29 2022-08-30 北京火山引擎科技有限公司 一种流量传输控制方法、装置、设备及存储介质

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4518246A4 *

Also Published As

Publication number Publication date
US12323388B2 (en) 2025-06-03
US20250055832A1 (en) 2025-02-13
CN114978610A (zh) 2022-08-30
CN114978610B (zh) 2024-05-28
EP4518246A1 (en) 2025-03-05
EP4518246A4 (en) 2025-09-10

Similar Documents

Publication Publication Date Title
WO2023207547A1 (zh) 一种流量传输控制方法、装置、设备及存储介质
US8990433B2 (en) Defining network traffic processing flows between virtual machines
US8634437B2 (en) Extended network protocols for communicating metadata with virtual machines
US8954957B2 (en) Network traffic processing according to network traffic rule criteria and transferring network traffic metadata in a network device that includes hosted virtual machines
US8572609B2 (en) Configuring bypass functionality of a network device based on the state of one or more hosted virtual machines
US9064121B2 (en) Network data transmission analysis
US8555383B1 (en) Network data transmission auditing
US8416709B1 (en) Network data transmission analysis management
US8892733B2 (en) Network adapter based zoning enforcement
CN115714679A (zh) 网络数据包处理方法、装置、电子设备及存储介质
US20230418940A1 (en) Antivirus scanning architecture for uploaded files
CN109413001B (zh) 对云计算系统内的交互数据进行安全保护的方法及装置
CN102316035B (zh) 集群路由器系统中前后台通讯及数据安全处理方法
CN116170210A (zh) 一种报文的过滤方法、装置、设备及介质
US7853726B2 (en) FCP command-data matching for write operations
CN115361443A (zh) 一种报文处理方法及系统
EP3180705B1 (en) End point secured network
CN117544380A (zh) 隐藏信息检测方法、装置、电子设备及存储介质
KR101446280B1 (ko) 인터미디어트 드라이버를 이용한 변종 악성코드 탐지 및 차단 시스템 및 그 방법
CN115987574A (zh) 虚拟私有云安全检测方法、装置、设备及存储介质
TWI732708B (zh) 基於多接取邊緣運算的網路安全系統和網路安全方法
CN113438197B (zh) 跨网采集的多级级联通信系统、方法、计算机设备和介质
KR20050011191A (ko) 고속 네트워크 시스템 및 그 운영방법
CN116318883A (zh) 一种联盟链访问控制方法、装置、存储介质以及系统
CN118890327A (zh) 基于FreeBSD开源协议栈的DPU类交换机端口模式数据传输方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23794980

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 11202405786X

Country of ref document: SG

WWE Wipo information: entry into national phase

Ref document number: 2023794980

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2023794980

Country of ref document: EP

Effective date: 20241129

WWG Wipo information: grant in national office

Ref document number: 11202405786X

Country of ref document: SG