CN114629842A

CN114629842A - Flow table processing method, electronic device, readable storage medium and product

Info

Publication number: CN114629842A
Application number: CN202210332365.9A
Authority: CN
Inventors: 李嘉; 彭小新; 薛蹦蹦
Original assignee: Alibaba China Co Ltd
Current assignee: Alibaba China Co Ltd
Priority date: 2022-03-30
Filing date: 2022-03-30
Publication date: 2022-06-14

Abstract

The embodiment of the disclosure discloses a flow table processing method, an electronic device, a readable storage medium and a product, wherein the method comprises the following steps: receiving a message to be processed; in response to determining that the message to be processed is not matched with the flow table, sending the message to be processed; receiving first action group information sent by a service decision end, wherein the first action group information is used for indicating a first action group corresponding to a data stream of a message to be processed, and the first action group comprises at least one processing action; and generating a flow table entry corresponding to the message to be processed according to the first action group information, and updating the flow table according to the flow table entry corresponding to the message to be processed. According to the scheme, the whole flow table or the part of the flow table containing the multi-flow table entry does not need to be replaced, the flow table entry required when the message to be processed is processed only needs to be updated, and the utilization rate of processing resources is improved. In addition, on the premise of not influencing the processing of the received message, the difficulty of setting the processing action of the message is reduced.

Description

Flow table processing method, electronic device, readable storage medium and product

Technical Field

The present disclosure relates to the field of network technologies, and in particular, to a flow table processing method, an electronic device, a readable storage medium, and a product.

Background

With the continuous development of computer technology, people begin to widely use network-accessed devices in life in recent years. In the architecture of the related network, a plurality of network nodes may be included, and the network nodes may be configured to perform corresponding processing on a received packet, for example, forward the packet, discard the packet, modify the packet, and the like.

In the related art, in order to facilitate control of packet processing, a corresponding Flow table (Flow table) may be maintained on a network node, the Flow table may include at least one Flow entry, and the Flow entry may include a matching field (match) and a corresponding operation action (action). After receiving a data packet to which a certain data flow belongs, the network node may match each flow entry in its own flow table according to the corresponding attribute information of the data flow, and when matching succeeds, may process the data packet to which the data flow belongs according to an operation behavior in the flow entry that is successfully matched.

Although the above scheme may facilitate control of packet processing, as network environments and service requirements become more complex, new data flows may frequently occur, and a network node is allowed to perform new operation actions on data packets belonging to the corresponding data flows, and when the above situation occurs, the flow table maintained by the network node needs to be updated to ensure that the flow table contains corresponding flow table entries, so as to operate the corresponding packets according to the flow table entries. In the related art, when a flow table is updated, the whole flow table often needs to be replaced by a new flow table, or all flow table entries corresponding to corresponding interfaces in the flow table need to be replaced by new flow table entries, and the management mode is not flexible, so that the burden of a network node is increased, and the utilization rate of processing resources is reduced.

Disclosure of Invention

To solve the problems in the related art, embodiments of the present disclosure provide a flow table processing method, an electronic device, a readable storage medium, and a product.

In a first aspect, an embodiment of the present disclosure provides a flow table processing method, where the method is applied to a packet processing end, and the method includes:

receiving a message to be processed;

in response to determining that the message to be processed is not matched with the flow table, sending the message to be processed;

receiving first action group information sent by a service decision end, wherein the first action group information is used for indicating a first action group corresponding to a data stream of a message to be processed, and the first action group comprises at least one processing action;

and generating a flow table item corresponding to the message to be processed according to the first action group information, and updating the flow table according to the flow table item corresponding to the message to be processed.

In one implementation of the present disclosure, the method further comprises:

and responding to the fact that the message to be processed is matched with a target flow table entry in the flow table, and processing the message to be processed according to the target flow table entry.

In one implementation of the present disclosure, the method further comprises:

setting the state of a flow table item corresponding to the message to be processed in the updated flow table to be an effective state;

responding to the determination that the message to be processed is matched with a target flow table entry in the flow table, and processing the message to be processed according to the target flow table entry, wherein the processing comprises the following steps:

and responding to the situation that the message to be processed is matched with a target flow table entry in the flow table and the state of the target flow table entry is an effective state, and processing the message to be processed according to the target flow table entry.

In one implementation of the present disclosure, the method further comprises:

receiving state updating indication information sent by a service decision end;

and deleting the flow table entry generated according to the second action group from the flow table in response to the fact that the state updating indication information indicates that the second action group corresponding to the target data flow is in the failure state.

In one implementation of the present disclosure, the method further comprises:

the state of the deleted flow entry in the flow table is set to the invalid state.

In one implementation manner of the present disclosure, before receiving the status update indication information, the method further includes:

and sending state updating request information, wherein the state updating request information is used for indicating a service decision-making terminal to detect the data stream attribute information of at least one data stream, and the service decision-making terminal is also used for responding to the condition that the data stream attribute information of the target data stream is invalid according to the detection result and sending state updating indication information.

In a second aspect, an embodiment of the present disclosure provides a flow table processing method, where the method is applied to a service decision end, and the method includes:

receiving a message to be processed, and acquiring attribute information of the data stream to be processed of the data stream to which the message to be processed belongs, wherein the message to be processed is not matched with a stream table of a message processing end;

and determining a first action group corresponding to the data stream to which the message to be processed belongs according to the attribute information of the data stream to be processed, and sending first action group information used for indicating the first action group, wherein the first action group comprises at least one processing action.

In one implementation of the present disclosure, the method further comprises:

detecting data stream attribute information of at least one data stream;

and sending state updating indication information in response to the fact that the data stream attribute information of the target data stream is determined to be invalid according to the detection result, wherein the state updating indication information is used for indicating that a second action group corresponding to the target data stream is in an invalid state.

In one implementation manner of the present disclosure, before detecting the data stream attribute information of at least one data stream, the method further includes:

receiving state updating request information sent by a message processing end;

detecting data stream attribute information of at least one data stream, comprising:

in response to determining that the status update request information indicates detection of data stream attribute information for the at least one data stream, data stream attribute information for the at least one data stream is detected.

In a third aspect, there is provided in an implementation of the present disclosure a flow table processing apparatus, including:

the first message receiving module is configured to receive a message to be processed;

a message sending module configured to send the message to be processed in response to determining that the message to be processed does not match the flow table;

the message processing device comprises an action group information receiving module, a message processing module and a message processing module, wherein the action group information receiving module is configured to receive first action group information sent by a service decision end, the first action group information is used for indicating a first action group corresponding to a data stream to which a message to be processed belongs, and the first action group comprises at least one processing action;

and the flow table updating module is configured to generate a flow table entry corresponding to the message to be processed according to the first action group information and update the flow table according to the flow table entry corresponding to the message to be processed.

In a fourth aspect, there is provided in an implementation of the present disclosure a flow table processing apparatus, including:

the second message receiving module is configured to receive a message to be processed and acquire attribute information of the data stream to be processed of the data stream to which the message to be processed belongs, wherein the message to be processed is not matched with the stream table of the message processing end;

the action group information sending module is configured to determine a first action group corresponding to the data stream to which the message to be processed belongs according to the attribute information of the data stream to be processed, and send first action group information used for indicating the first action group, wherein the first action group comprises at least one processing action.

In a fifth aspect, an electronic device is provided in an implementation of the present disclosure and includes a memory and at least one processor; the memory is configured to store one or more computer instructions that are executed by the at least one processor to implement the method steps of any one of the implementations of the first aspect to the second aspect.

In a sixth aspect, this disclosure provides, in an implementation form thereof, a computer-readable storage medium having stored thereon computer instructions, which, when executed by a processor, implement the method steps of any one of the implementation forms of the first aspect to the second aspect.

In a seventh aspect, this disclosure provides, in an implementation form thereof, a computer program product including computer instructions that, when executed by a processor, implement the method steps according to any one of the implementation forms of the first aspect to the second aspect.

The technical scheme provided by the embodiment of the disclosure can have the following beneficial effects:

according to the technical scheme provided by the embodiment of the disclosure, by enabling a message processing end to receive a message to be processed and responding to the situation that the message to be processed is determined not to be matched with a flow table, that is, the flow table on the message processing end does not include a flow table item corresponding to the message to be processed, and the message to be processed is sent when the message to be processed cannot be processed, a service decision end can receive the message to be processed sent by the message processing end and acquire attribute information of the data flow to be processed of the data flow to which the message to be processed belongs, and a first action group corresponding to the data flow to which the message to be processed belongs is determined according to the attribute information of the data flow to be processed, wherein the first action group includes at least one processing action, and the processing action in the first action group can be understood as a processing action allowed to be performed on the message processing end on the message belonging to the data flow to which the message to be processed belongs. Then, the service decision end sends first action group information used for indicating a first action group, the message processing end receives the first action group information, generates a flow table item corresponding to the message to be processed according to the first action group information, and updates the flow table according to the flow table item corresponding to the message to be processed, so that the updated flow table is ensured to include the flow table item corresponding to the message to be processed, and when the message to be processed is processed according to the flow table item corresponding to the message to be processed, the processing action belongs to the first action group. Because the whole flow table or a part (for example, a part corresponding to a certain interface) of the flow table containing a plurality of flow table entries does not need to be replaced at the service decision end, the flow table entries required when the message to be processed is processed only need to be updated, the load of the service decision end is reduced, and the utilization rate of processing resources is improved. In addition, the action group corresponding to the corresponding data flow, which is determined by the service decision-making end according to the corresponding data flow attribute information, can be set, so that the processing action of the message processing end is matched with the corresponding setting when the message processing end processes the corresponding message according to the corresponding flow table item in the updated flow table, the difficulty of setting the processing action of the message is reduced on the premise of not influencing the message processing end to process the received message, and the utilization rate of processing resources is improved.

According to the technical scheme provided by the embodiment of the disclosure, the message to be processed is processed according to the target flow table entry in the flow table in response to the determination that the message to be processed is matched with the target flow table entry in the flow table, so that when the attribute information of the data stream to which the message to be processed received by the message processing end belongs meets the corresponding requirement, the message to be processed can be correspondingly processed according to the corresponding processing operation, and the reliability of processing the message received by the message processing end is improved.

According to the technical scheme provided by the embodiment of the disclosure, the success rate of processing the message to be processed according to the target flow table entry can be improved by responding to the situation that the message to be processed is matched with the target flow table entry in the flow table and the state of the target flow table entry is an effective state and processing the message to be processed according to the target flow table entry.

According to the technical scheme provided by the embodiment of the disclosure, by receiving the state update indication information sent by the service decision end, and in response to determining that the state update indication information indicates that the second action group corresponding to the target data flow is in a failure state, deleting the flow table entry generated according to the second action group from the flow table, when the operation action in the second action group is executed for the message belonging to the target data flow, the operation action may not be successfully executed, avoiding executing the operation action that may not be successfully executed based on the flow table entry generated according to the second action group, reducing the probability that the operation action cannot be successfully executed, and improving the utilization rate of processing resources.

According to the technical scheme provided by the embodiment of the disclosure, the state of the deleted flow table entry in the flow table is set to be the failure state, so that the phenomenon that the message is processed by mistake according to the deleted flow table entry when the message is matched with the deleted flow table entry in the flow table can be avoided, and the error probability in message processing is reduced.

According to the technical scheme provided by the embodiment of the disclosure, by sending the state updating request information, the service decision-making terminal can detect the data stream attribute information of at least one data stream, and send the state updating indication information in response to determining that the data stream attribute information of the target data stream is invalid according to the detection result, so that the message processing terminal can obtain the state updating indication information in time, and the state updating indication information is beneficial to updating the stream table entries in the stream table in time.

According to the technical scheme provided by the embodiment of the disclosure, a service decision end receives a message to be processed and acquires attribute information of the data stream to be processed of the data stream to which the message to be processed belongs, wherein the message to be processed is the message received by a message processing end, and the message processing end sends the message to be processed when the message to be processed is determined to be unmatched with a flow table by responding to the message to be processed, namely the flow table on the message processing end does not include a flow table item corresponding to the message to be processed and the message to be processed cannot be processed; the service decision end may determine, according to the attribute information of the data stream to be processed, a first action group corresponding to the data stream to which the packet to be processed belongs, where the first action group includes at least one processing action, and the processing action in the first action group may be understood as a processing action allowed to be performed on the packet processing end on the packet belonging to the data stream to which the packet to be processed belongs. Then, the service decision end sends first action group information used for indicating a first action group, so that the message processing end receives the first action group information, can generate a flow table item corresponding to the message to be processed according to the first action group information, and updates the flow table according to the flow table item corresponding to the message to be processed, thereby ensuring that the updated flow table comprises the flow table item corresponding to the message to be processed, and when the message to be processed is processed according to the flow table item corresponding to the message to be processed, the processing action belongs to the first action group. Because the whole flow table or a part (for example, a part corresponding to a certain interface) of the flow table containing a plurality of flow table entries does not need to be replaced at the service decision end, the flow table entries required when the message to be processed is processed only need to be updated, the load of the service decision end is reduced, and the utilization rate of processing resources is improved. In addition, the action group corresponding to the corresponding data flow, which is determined by the service decision-making end according to the corresponding data flow attribute information, can be set, so that the processing action of the message processing end is matched with the corresponding setting when the message processing end processes the corresponding message according to the corresponding flow table item in the updated flow table, the difficulty of setting the processing action of the message is reduced on the premise of not influencing the message processing end to process the received message, and the utilization rate of processing resources is improved.

According to the technical solution provided by the embodiment of the present disclosure, by detecting data flow attribute information of at least one data flow, and in response to determining that the data flow attribute information of a target data flow has failed according to a detection result, sending status update indication information, a message processing end can receive the status update indication information sent by a service decision end, and in response to determining that the status update indication information indicates that a second action group corresponding to the target data flow is in a failure status, delete a flow entry generated according to the second action group from the flow table, thereby avoiding executing an operation action in the second action group on the basis of the flow entry generated according to the second action group in a situation where the operation action may not be successfully executed with respect to a message belonging to the target data flow, and reducing a probability that the operation action cannot be successfully executed, the utilization rate of processing resources is improved.

According to the technical scheme provided by the embodiment of the disclosure, by receiving the state update request information sent by the message processing terminal, responding to the determined state update request information to indicate to detect the data stream attribute information of at least one data stream, and detecting the data stream attribute information of at least one data stream, the service decision terminal can respond to the data stream attribute information of the target data stream determined to be invalid according to the detection result, and send the state update indication information, so that the message processing terminal can timely acquire the state update indication information, and timely update of the stream table entry in the stream table is facilitated.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.

Drawings

Other features, objects, and advantages of the present disclosure will become more apparent from the following detailed description of non-limiting embodiments when taken in conjunction with the accompanying drawings. In the drawings:

fig. 1 shows a schematic block diagram of a network architecture according to an embodiment of the present disclosure.

Fig. 2 illustrates a flow chart of a flow table processing method according to an embodiment of the present disclosure.

Fig. 3 illustrates a flow chart of a flow table processing method according to an embodiment of the present disclosure.

Fig. 4 shows a schematic block diagram of a flow table processing system according to an embodiment of the present disclosure.

Fig. 5 shows a block diagram of the configuration of a flow table processing device according to an embodiment of the present disclosure.

Fig. 6 shows a block diagram of the configuration of a flow table processing device according to an embodiment of the present disclosure.

Fig. 7 shows a block diagram of an electronic device according to an embodiment of the present disclosure.

FIG. 8 is a block diagram of a computer system suitable for use in implementing a method according to an embodiment of the present disclosure.

Detailed Description

Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. Also, for the sake of clarity, parts not relevant to the description of the exemplary embodiments are omitted in the drawings.

In the present disclosure, it is to be understood that terms such as "including" or "having," etc., are intended to indicate the presence of labels, numbers, steps, actions, components, parts, or combinations thereof disclosed in the present specification, and are not intended to exclude the possibility that one or more other labels, numbers, steps, actions, components, parts, or combinations thereof are present or added.

It should be further noted that the embodiments and labels in the embodiments of the present disclosure may be combined with each other without conflict. The present disclosure will be described in detail below with reference to the accompanying drawings in conjunction with embodiments.

In order to control the message processing, the inventor of the present disclosure considers the following scheme:

in the related art, a corresponding flow table may be maintained on a network node, the flow table may include at least one flow entry, and the flow entry may include a matching field and a corresponding operation action. Illustratively, the action may include forwarding the message, discarding the message, modifying the message, and the like. After receiving a data packet to which a certain data flow belongs, the network node may match each flow entry in its own flow table according to the corresponding attribute information of the data flow, and when matching succeeds, may process the data packet to which the data flow belongs according to an operation behavior in the flow entry that is successfully matched.

The disadvantages of this solution: in recent years, with the increasingly complex network environment and service requirements, new data flows may frequently appear, and new operation actions performed by the network node on data packets belonging to the corresponding data flows may be allowed. In the related art, when a flow table is updated, the whole flow table often needs to be replaced by a new flow table, or all flow entries in the flow table corresponding to corresponding interfaces need to be replaced by new flow entries, and the management mode is not flexible, so that the burden of a network node is increased, and the utilization rate of resources is reduced.

In view of the disadvantages of the above solutions, the inventors of the present disclosure propose a new solution: the method is applied to a message processing end, in the method, the message processing end sends a message to be processed by receiving the message to be processed and responding to the situation that the message to be processed is determined not to be matched with a flow table, namely the flow table on the message processing end does not include a flow table item corresponding to the message to be processed, and the message to be processed cannot be processed, the service decision end can receive the message to be processed sent by the message processing end, acquire attribute information of the data flow to be processed of the data flow to which the message to be processed belongs, and determine a first action group corresponding to the data flow to which the message to be processed belongs according to the attribute information of the data flow to be processed, wherein the first action group comprises at least one processing action, and the processing action in the first action group can be understood as a processing action which is allowed to be performed on the message processing end on the message belonging to the data flow to which the message to be processed belongs. Then, the service decision end sends first action group information used for indicating a first action group, the message processing end receives the first action group information, generates a flow table item corresponding to the message to be processed according to the first action group information, and updates the flow table according to the flow table item corresponding to the message to be processed, so that the updated flow table is ensured to include the flow table item corresponding to the message to be processed, and when the message to be processed is processed according to the flow table item corresponding to the message to be processed, the processing action belongs to the first action group. Because the whole flow table or a part (for example, a part corresponding to a certain interface) of the flow table containing a plurality of flow table entries does not need to be replaced at the service decision end, the flow table entries required when the message to be processed is processed only need to be updated, the load of the service decision end is reduced, and the utilization rate of processing resources is improved. In addition, the action group corresponding to the corresponding data flow, which is determined by the service decision-making end according to the corresponding data flow attribute information, can be set, so that the processing action of the message processing end is matched with the corresponding setting when the message processing end processes the corresponding message according to the corresponding flow table item in the updated flow table, the difficulty of setting the processing action of the message is reduced on the premise of not influencing the message processing end to process the received message, and the utilization rate of processing resources is improved.

In order to solve the above problem, the present disclosure proposes a flow table processing method, an electronic device, a readable storage medium, and a product.

Fig. 1 is a schematic block diagram of a flow table processing system according to an embodiment of the present disclosure, and as shown in fig. 1, the flow table processing system may include at least one Packet Transformation (PT) end 101 and at least one Service Decision (SD) end 102, where the Packet transformation end 101 may be a physical Machine or a Virtual Machine (VM). Similarly, the service decision terminal 102 may be a physical machine or a virtual machine.

Where a physical machine may be understood to be the naming of a physical computer relative to a virtual machine. The physical machine may provide a hardware environment for the virtual machine.

A virtual machine may be understood as a virtualization layer that runs on a virtualization platform. For example, in a cloud computing platform, a virtual machine may be one or more independent hosts (i.e., cloud hosts) or one or more independent servers (i.e., cloud servers) partitioned by the virtualization technology on a cluster server; in other virtualization systems or platforms, a virtual machine may be one or more virtual hosts implemented using the virtualization technology on one or more physical hosts, or may be one or more virtual private servers implemented using the virtualization technology on one or more physical servers.

Fig. 2 shows a flowchart of a flow table processing method according to an embodiment of the present disclosure, which is applied to a message processing side, and as shown in fig. 2, the flow table processing method includes steps S101, S102, S103, and S104.

In step S101, a message to be processed is received.

In step S102, in response to determining that the packet to be processed does not match the flow table, the packet to be processed is transmitted.

In step S103, first action group information sent by the service decision terminal is received.

The first action group information is used for indicating a first action group corresponding to the data flow to which the message to be processed belongs, and the first action group comprises at least one processing action.

In step S104, a flow table entry corresponding to the message to be processed is generated according to the first action group information, and the flow table is updated according to the flow table entry corresponding to the message to be processed.

In an embodiment of the present disclosure, a message to be processed may be understood as a message that needs to be processed by a message processing end, for example, when the message processing end is used to forward a message, the message to be processed is a message that is received by the message processing end and needs to be forwarded by the message processing end.

In one embodiment of the present disclosure, a flow entry may include a matching field and a corresponding operation action. The message to be processed is not matched with the flow table, which can be understood as that any item in the attribute information of the data flow to which the message to be processed belongs is not matched with the content in the matching field of any flow table item in the flow table. The attribute information of the data flow may include any one of quintuple information or heptatuple information, and for example, the attribute information of the data flow may include at least one of a source IP address, a destination IP address, a last hop IP address, a next hop IP address, a source port, a destination port, a last hop port, a next hop port, a transit interface index, a transport tunneling protocol, and a transport tunnel index.

In an embodiment of the present disclosure, sending a to-be-processed packet may be understood as sending the to-be-processed packet to a service decision end, and may also be understood as sending the to-be-processed packet to another device or system, so that the other device or system forwards the to-be-processed packet to the service decision end.

In an embodiment of the present disclosure, the first action group information may be understood as including an operation action in the first action group, and may also be understood as including an action group index corresponding to the first action group, and according to the action group index, the corresponding form or database may be searched for, and the operation action in the first action group is obtained, where the form or database may be located on a message processing end, or may be located on a service decision end or other device or system, and this disclosure does not specifically limit this.

In an embodiment of the present disclosure, the first action group corresponding to the data flow to which the packet to be processed belongs may be understood as at least one action group determined according to at least one item of attribute information of the data flow to which the packet to be processed belongs. The service decision end may store correspondence data for indicating a correspondence between the action group and at least one item of attribute information of the data stream, where the correspondence data may be in a database format, a form format, or another format. By querying on the service decision side according to at least one item of attribute information of the respective data flow, at least one action group corresponding to the respective data flow may be determined. An exemplary service decision-making terminal may store a database for indicating a correspondence between an action group and a destination IP address of a data stream, where the destination IP address of the data stream may be understood to correspond to a Real Server (RS) that responds to a packet belonging to the data stream, and by querying the database according to the destination IP address of the data stream to which the packet to be processed belongs, a first action group corresponding to the data stream to which the packet to be processed belongs may be determined.

In one embodiment of the present disclosure, generating a flow entry corresponding to a packet to be processed according to the first action group information may be understood as taking at least one item of attribute information of the packet to be processed as information in a matching field of the generated flow entry, and taking at least one operation action in the first action group indicated by the first action group information as an operation action of the generated flow entry, so as to generate a flow entry corresponding to the packet to be processed.

In an embodiment of the present disclosure, updating the flow table according to the flow table entry corresponding to the packet to be processed may be understood as adding or inserting the flow table entry corresponding to the packet to be processed in the flow table, and ensuring that the updated flow table includes the flow table entry corresponding to the packet to be processed.

In one implementation of the present disclosure, the method further comprises the steps of:

In an embodiment of the present disclosure, the to-be-processed packet is matched with a target flow entry in the flow table, which may be understood as that at least one item of attribute information of a data flow to which the to-be-processed packet belongs is matched with content in a matching field of the target flow entry in the flow table.

In an embodiment of the present disclosure, processing a to-be-processed packet according to a target flow table entry may be understood as processing the to-be-processed packet according to an operation action in the target flow table entry. For example, when the operation action in the target flow table entry is a forwarding action, the pending warm keeping may be forwarded according to the forwarding action.

According to the technical scheme provided by the embodiment of the disclosure, the message to be processed is processed according to the target flow table entry in the flow table in response to the determination that the message to be processed is matched with the target flow table entry in the flow table, so that when the attribute information of the data flow to which the message to be processed received by the message processing end belongs meets the corresponding requirement, the message to be processed can be correspondingly processed according to the corresponding processing operation, and the reliability of processing the message received by the message processing end is improved.

and in response to the fact that the message to be processed is matched with the target flow table entry in the flow table and the state of the target flow table entry is an effective state, processing the message to be processed according to the target flow table entry.

In one embodiment of the present disclosure, the flow table may include status information corresponding to each flow entry, and the status information corresponding to the target flow entry may be read from the flow table and the status of the target flow entry determined from the status information.

In one embodiment of the present disclosure, the state of the target flow table entry is a valid state, which may be understood as that when an operation action in the target flow table entry is executed for a packet matching the target flow table entry, the operation action can be successfully executed.

receiving state updating indication information sent by a service decision end;

In one embodiment of the present disclosure, the second action group corresponding to the target data flow is in a failure state, which may be understood as that, when an operation action in the second action group is executed for a packet belonging to the target data flow, the operation action may not be successfully executed. For example, the second action group may correspond to the first destination IP address, when the destination IP address of the packet in a certain data flow is the first destination IP address, the data flow may be determined as the target data flow, and if the RS corresponding to the first destination IP address is in a failure state, since the operation action may not be successfully executed when the RS belonging to the target data flow is operated according to the operation action in the second action group, the second action group corresponding to the target data flow may be determined as the failure state.

In one embodiment of the present disclosure, the flow entry generated according to the second action group may be understood as a flow entry generated by taking at least one operation action in the second action group as an operation action of the generated flow entry.

In an embodiment of the present disclosure, the flow entry generated according to the second action group is deleted from the flow table, which may be understood as clearing or deleting contents (such as a matching field and an operation action) in the flow entry generated according to the second action group in the flow table, and further, other contents, such as an index and the like, in the flow table generated according to the second action group may also be deleted.

In one embodiment of the present disclosure, the state of the flow entry is a failure state, and it may be understood that when an operation action in the target flow entry is executed for a packet matching the flow entry, the operation action may not be successfully executed.

In one embodiment of the present disclosure, when the state of the flow entry in the flow table is set to the failure state, even if any packet matches with the flow entry whose state is set to the failure state, the packet processing terminal does not process the any packet according to the flow entry whose state is set to the failure state.

In one implementation manner of the present disclosure, before receiving the status update indication information, the method further includes the following steps:

In an embodiment of the present disclosure, the status update request information may be understood as data flow attribute information used to instruct the service decision terminal to detect at least one data flow specified by the status update request information, or may also be understood as data flow attribute information used to instruct the service decision terminal to detect data flows corresponding to all action groups maintained by the service decision terminal.

In one embodiment of the present disclosure, the detecting of the data stream attribute information may be understood as detecting whether the data stream attribute information is valid. For example, when the data stream attribute information includes a destination IP address, an RS corresponding to the destination IP address may be detected to determine whether the RS is offline, and if the RS is offline, a detection result indicating that the destination IP address is invalid is generated.

In one embodiment of the present disclosure, sending the status update request information may be understood as periodically sending the status update request information at intervals of a time interval threshold; it may also be understood that the status update request information is transmitted when an update instruction transmitted from another device or system is received.

According to the technical scheme provided by the embodiment of the disclosure, by sending the state updating request information, the service decision-making terminal can detect the data flow attribute information of at least one data flow, and in response to determining that the data flow attribute information of the target data flow is invalid according to the detection result, the service decision-making terminal sends the state updating indication information, so that the message processing terminal can obtain the state updating indication information in time, and the message processing terminal is favorable for updating the flow table entry in the flow table in time.

Fig. 3 is a flowchart illustrating a flow table processing method according to an embodiment of the present disclosure, the method being applied to a service decision side, as shown in fig. 3, the flow table processing method includes steps S201 and S202.

In step S201, a to-be-processed packet is received, and attribute information of a to-be-processed data stream of a data stream to which the to-be-processed packet belongs is obtained.

Wherein, the message to be processed is not matched with the flow table of the message processing end.

In step S202, a first action group corresponding to the data flow to which the packet to be processed belongs is determined according to the attribute information of the data flow to be processed, and first action group information indicating the first action group is sent.

Wherein the first action group comprises at least one processing action.

In one embodiment of the present disclosure, a message to be processed may be understood as a message that needs to be processed by a message processing end, but because the message does not match with a flow table of the message processing end, the message is sent by the message processing end to a service decision end.

In one embodiment of the present disclosure, a flow entry may include a matching field and a corresponding operation action. The message to be processed is not matched with the flow table, and can be understood as any item in the attribute information of the data flow to which the message to be processed belongs, and the content in the matching domain of any flow table item in the flow table is not matched. The attribute information of the data flow may include any one of quintuple information or heptatuple information, and for example, the attribute information of the data flow may include at least one of a source IP address, a destination IP address, a previous-hop IP address, a next-hop IP address, a source port, a destination port, a previous-hop port, a next-hop port, a transit interface index, a transport tunneling protocol, and a transport tunnel index.

In an embodiment of the present disclosure, the first action group corresponding to the data flow to which the packet to be processed belongs may be understood as at least one action group determined according to at least one item of attribute information of the data flow to which the packet to be processed belongs. The service decision end may store correspondence data for indicating a correspondence between the action group and at least one item of attribute information of the data stream, where the correspondence data may be in a database format, a form format, or another format. By querying on the service decision side according to at least one item of attribute information of the respective data flow, at least one action group corresponding to the respective data flow may be determined. For example, a database for indicating a correspondence between the action group and a destination IP address of the data stream may be stored in the service decision terminal, where the destination IP address of the data stream may be understood to correspond to a Real Server (RS) that responds to a packet belonging to the data stream, and by querying the database according to the destination IP address of the data stream to which the packet to be processed belongs, the first action group corresponding to the data stream to which the packet to be processed belongs may be determined.

In an embodiment of the present disclosure, the first action group information may be understood as including an operation action in the first action group, or may be understood as including an action group index corresponding to the first action group, and according to the action group index, the first action group information may be searched in a corresponding form or database, and the operation action in the first action group is obtained, where the form or database may be located on a message processing end, or may be located on a service decision end or other device or system, and this disclosure does not specifically limit this.

According to the technical scheme provided by the embodiment of the disclosure, a service decision end receives a message to be processed and acquires attribute information of the data stream to be processed of the data stream to which the message to be processed belongs, wherein the message to be processed is the message received by a message processing end, and the message processing end sends the message to be processed when the message to be processed is determined to be unmatched with a flow table by responding to the message to be processed, namely the flow table on the message processing end does not include a flow table item corresponding to the message to be processed and the message to be processed cannot be processed; the service decision end may determine, according to the attribute information of the data stream to be processed, a first action group corresponding to the data stream to which the packet to be processed belongs, where the first action group includes at least one processing action, and the processing action in the first action group may be understood as a processing action allowed to be performed on a packet belonging to the data stream to which the packet to be processed belongs at the packet processing end. Then, the service decision end sends first action group information used for indicating a first action group, so that the message processing end receives the first action group information, can generate a flow table item corresponding to the message to be processed according to the first action group information, and updates the flow table according to the flow table item corresponding to the message to be processed, thereby ensuring that the updated flow table comprises the flow table item corresponding to the message to be processed, and when the message to be processed is processed according to the flow table item corresponding to the message to be processed, the processing action belongs to the first action group. Because the whole flow table or a part (for example, a part corresponding to a certain interface) of the flow table containing a plurality of flow table entries does not need to be replaced at the service decision end, the flow table entries required when the message to be processed is processed only need to be updated, the load of the service decision end is reduced, and the utilization rate of processing resources is improved. In addition, the action group corresponding to the corresponding data stream, which is determined by the service decision-making end according to the corresponding data stream attribute information, can be set, so that the processing action of the message processing end is matched with the corresponding setting when the message processing end processes the corresponding message according to the corresponding stream table item in the updated stream table, the difficulty of setting the processing action of the message is reduced on the premise of not influencing the message processing end to process the received message, and the utilization rate of processing resources is improved.

detecting data stream attribute information of at least one data stream;

and sending state updating indication information in response to determining that the data stream attribute information of the target data stream is invalid according to the detection result, wherein the state updating indication information is used for indicating that a second action group corresponding to the target data stream is in an invalid state.

In an embodiment of the present disclosure, detecting the data stream attribute information of at least one data stream may be understood as detecting the data stream attribute information of at least one data stream by a service decision end, or may be understood as sending a detection instruction to another system or apparatus by the service decision end, so as to instruct the other system or apparatus to detect the data stream attribute information of at least one data stream, and returning a corresponding detection result.

In an embodiment of the present disclosure, the second action group corresponding to the target data flow is in a failure state, and it may be understood that when an operation action in the second action group is executed for a packet belonging to the target data flow, the operation action may not be successfully executed. For example, the second action group may correspond to the first destination IP address, when a destination IP address of a packet in a certain data flow is the first destination IP address, the data flow may be determined as a target data flow, and if the RS corresponding to the first destination IP address is in a failure state, since the operation action may not be successfully executed when the target data flow is operated according to the operation action in the second action group, the second action group corresponding to the target data flow may be determined as the failure state.

In one implementation of the present disclosure, before detecting data stream attribute information of at least one data stream, the method further includes the following steps:

receiving state updating request information and state updating request information sent by a message processing end;

the detection of the data stream attribute information of at least one data stream can be realized by the following steps:

In an embodiment of the present disclosure, the message processing end sends the state update request information, which may be understood as that the message processing end periodically sends the state update request information with a time interval threshold as an interval; it can also be understood that the message processing end sends the status update request message when receiving an update instruction sent by another device or system.

According to the technical scheme provided by the embodiment of the disclosure, by receiving the state update request information sent by the message processing terminal, responding to the determination that the state update request information indicates to detect the data stream attribute information of at least one data stream, and detecting the data stream attribute information of at least one data stream, the service decision terminal can respond to the determination that the data stream attribute information of the target data stream is invalid according to the detection result, and send the state update indication information, so that the message processing terminal can timely acquire the state update indication information, and timely update of the stream table entry in the stream table is facilitated.

Fig. 4 shows a schematic block diagram of a flow table processing system according to an embodiment of the present disclosure, which may perform the following steps, as shown in fig. 4:

the message processing end receives messages to be processed respectively belonging to data FLOWs (FLOW)1 to FLOW5, wherein the messages to be processed respectively belonging to FLOWs 1-FLOW5 are not matched with the FLOW tables, so that the messages to be processed respectively belonging to FLOWs 1-FLOW5 can be sent to the service decision end. The service decision-making end can receive the messages to be processed respectively belonging to the FLOWs 1-5, and acquire the attribute information of the data streams to be processed of the FLOWs 1-5. And the service decision terminal determines an action group corresponding to the FLOW1-FLOW3 as a first target action group according to the acquired attribute information of the data stream to be processed, sends first target action group information used for indicating the first target action group, determines an action group corresponding to the FLOW4-FLOW5 as a second target action group, and sends second target action group information used for indicating the second target action group. And the message processing terminal generates a first target FLOW table entry corresponding to the FLOW1-FLOW3 according to the first target action group information, and updates the FLOW table according to the first target FLOW table entry so as to forward the messages to be processed respectively belonging to the FLOW1-FLOW3 according to the FLOW table. And the message processing terminal generates a second target FLOW table entry corresponding to the FLOW4-FLOW5 according to the second target action group information, and updates the FLOW table according to the second target FLOW table entry so as to forward the message to be processed belonging to the FLOW4-FLOW5 according to the FLOW table. The message processing end may further send state update request information to the service decision end, where the service decision end may receive the state update request information, detect, in response to determining that the state update request information indicates that data stream attribute information of at least one data stream is detected, detect, in response to determining that the data stream attribute information of a target data stream is invalid according to a detection result, send state update indication information, and the message processing end may receive the state update indication information, and delete, in response to determining that an action group corresponding to a corresponding data stream indicated by the state update indication information is an invalid state, a flow table entry generated according to the action group in the invalid state indicated by the state update indication information from the flow table.

A flow table processing device according to an embodiment of the present disclosure is described below with reference to fig. 5. Fig. 5 shows a block diagram of the configuration of a flow table processing device according to an embodiment of the present disclosure.

As shown in fig. 5, the flow table processing device 200 includes:

a first message receiving module 201 configured to receive a message to be processed;

a message sending module 202 configured to send the message to be processed in response to determining that the message to be processed does not match the flow table;

the action group information receiving module 203 is configured to receive first action group information sent by a service decision end, where the first action group information is used to indicate a first action group corresponding to a data flow to which a to-be-processed packet belongs, and the first action group includes at least one processing action;

and the flow table updating module 204 is configured to generate a flow table entry corresponding to the message to be processed according to the first action group information, and update the flow table according to the flow table entry corresponding to the message to be processed.

It will be appreciated by a person skilled in the art that the solution described with reference to fig. 5 may be combined with any of the embodiments described above to achieve the technical effects achieved by any of the embodiments described above. For details, reference may be made to the description of the foregoing embodiments, and details thereof are not described herein again.

A flow table processing device according to an embodiment of the present disclosure is described below with reference to fig. 6. Fig. 6 shows a block diagram of the configuration of a flow table processing device according to an embodiment of the present disclosure.

As shown in fig. 6, the flow table processing device 300 includes:

the second message receiving module 301 is configured to receive a message to be processed and obtain attribute information of a data stream to be processed of the message to be processed, where the message to be processed is not matched with a stream table of a message processing end;

the action group information sending module 302 is configured to determine, according to the attribute information of the data stream to be processed, a first action group corresponding to the data stream to which the packet to be processed belongs, and send first action group information indicating the first action group, where the first action group includes at least one processing action.

It will be appreciated by a person skilled in the art that the solution described with reference to fig. 6 can be combined with any of the embodiments described above to achieve the technical effects achieved by any of the embodiments described above. For details, reference may be made to the description of the foregoing embodiments, and details thereof are not described herein again.

The disclosed embodiments also provide an electronic device, as shown in fig. 7, including at least one processor 401; and a memory 402 communicatively coupled to the at least one processor 401; wherein the memory 402 stores instructions executable by the at least one processor 401, the instructions being executable by the at least one processor 401 to perform the steps of:

receiving a message to be processed;

and generating a flow table entry corresponding to the message to be processed according to the first action group information, and updating the flow table according to the flow table entry corresponding to the message to be processed.

In one implementation of the present disclosure, the method further comprises:

receiving state updating indication information sent by a service decision end;

In one implementation of the present disclosure, the method further comprises:

detecting data stream attribute information of at least one data stream;

In one implementation manner of the present disclosure, before detecting data stream attribute information of at least one data stream, the method further includes:

receiving state updating request information sent by a message processing end;

As shown in fig. 8, the computer system 500 includes a processing unit 501 that can execute various processes in the embodiments shown in the above-described figures according to a program stored in a Read Only Memory (ROM)502 or a program loaded from a storage section 508 into a Random Access Memory (RAM) 503. In the RAM503, various programs and data necessary for the operation of the system 500 are also stored. The CPU501, ROM502, and RAM503 are connected to each other via a bus 504. An input/output (I/O) interface 505 is also connected to bus 504.

The following components are connected to the I/O interface 505: an input portion 506 including a keyboard, a mouse, and the like; an output portion 507 including a display such as a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, and a speaker; a storage portion 508 including a hard disk and the like; and a communication section 509 including a network interface card such as a LAN card, a modem, or the like. The communication section 509 performs communication processing via a network such as the internet. The driver 510 is also connected to the I/O interface 505 as necessary. A removable medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 510 as necessary, so that a computer program read out therefrom is mounted into the storage section 508 as necessary. The processing unit 501 may be implemented as a CPU, a GPU, a TPU, an FPGA, an NPU, or other processing units.

In particular, according to embodiments of the present disclosure, the methods described above with reference to the figures may be implemented as computer software programs. Illustratively, embodiments of the present disclosure include a computer program product comprising a computer program tangibly embodied on a medium readable thereby, the computer program comprising program code for performing the methods of the figures. In such an embodiment, the computer program may be downloaded and installed from a network through the communication section 509, and/or installed from the removable medium 511. Illustratively, embodiments of the present disclosure include a readable storage medium having stored thereon computer instructions which, when executed by a processor, implement program code for performing the methods of the figures.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowcharts or block diagrams may represent a module, a program segment, or a portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. Two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The units or modules described in the embodiments of the present disclosure may be implemented by software or hardware. The units or modules described may also be provided in a processor, and the names of the units or modules do not in some cases constitute a limitation of the units or modules themselves.

As another aspect, the present disclosure also provides a computer-readable storage medium, which may be the computer-readable storage medium included in the node in the above embodiment; or it may be a separate computer readable storage medium not incorporated into the device. The computer readable storage medium stores one or more programs for use by one or more processors in performing the methods described in the present disclosure.

The foregoing description is only exemplary of the preferred embodiments of the disclosure and is illustrative of the principles of the technology employed. It will be appreciated by those skilled in the art that the scope of the invention in the present disclosure is not limited to the specific combination of the above-mentioned features, but also encompasses other embodiments in which any combination of the above-mentioned features or their equivalents is possible without departing from the inventive concept. Exemplary above features are disclosed in this disclosure (but not limited to) as technical features with similar functions are replaced by each other.

Claims

1. A flow table processing method is applied to a message processing end, and comprises the following steps:

receiving a message to be processed;

in response to determining that the message to be processed does not match the flow table, sending the message to be processed;

receiving first action group information sent by a service decision end, wherein the first action group information is used for indicating a first action group corresponding to a data stream to which the message to be processed belongs, and the first action group comprises at least one processing action;

2. The flow table processing method according to claim 1, wherein the method further comprises:

and responding to the determination that the message to be processed is matched with a target flow table entry in the flow table, and processing the message to be processed according to the target flow table entry.

3. The flow table processing method according to claim 2, wherein the method further comprises:

the responding to the determination that the message to be processed is matched with a target flow table entry in a flow table, and processing the message to be processed according to the target flow table entry comprises the following steps:

and in response to the fact that the message to be processed is matched with a target flow table entry in a flow table and the state of the target flow table entry is an effective state, processing the message to be processed according to the target flow table entry.

4. The flow table processing method according to claim 3, wherein the method further comprises:

receiving state updating indication information sent by the service decision terminal;

and in response to the fact that the second action group corresponding to the target data flow is determined to be in the failure state by the state updating indication information, deleting the flow table entry generated according to the second action group from the flow table.

5. The flow table processing method according to claim 4, wherein the method further comprises:

6. The flow table processing method according to claim 4, wherein, before the receiving the status update indication information, the method further comprises:

and sending state updating request information, wherein the state updating request information is used for indicating the service decision-making terminal to detect the data stream attribute information of at least one data stream, and the service decision-making terminal is also used for responding to the condition that the data stream attribute information of the target data stream is invalid according to the detection result and sending the state updating indication information.

7. A flow table processing method, wherein the method is applied to a service decision side, and the method comprises:

8. The flow table processing method according to claim 7, wherein the method further comprises:

detecting data stream attribute information of at least one data stream;

9. The flow table processing method according to claim 8, wherein before the detecting of the data flow attribute information of the at least one data flow, the method further comprises:

receiving state updating request information sent by a message processing end;

the detecting data stream attribute information of at least one data stream includes:

in response to determining that the status update request information indicates to detect data stream attribute information for at least one data stream, detect data stream attribute information for the at least one data stream.

10. An electronic device, comprising a memory and at least one processor; wherein the memory is to store one or more computer instructions, wherein the one or more computer instructions are to be executed by the at least one processor to implement the method steps of any one of claims 1-9.

11. A computer readable storage medium having computer instructions stored thereon, wherein the computer instructions, when executed by a processor, implement the method steps of any of claims 1-9.

12. A computer program product comprising computer programs/instructions, wherein the computer programs/instructions, when executed by a processor, implement the method steps of any of claims 1-9.