WO2024051321A1 - 网络隔离方法、***及相关设备 - Google Patents
网络隔离方法、***及相关设备 Download PDFInfo
- Publication number
- WO2024051321A1 WO2024051321A1 PCT/CN2023/104840 CN2023104840W WO2024051321A1 WO 2024051321 A1 WO2024051321 A1 WO 2024051321A1 CN 2023104840 W CN2023104840 W CN 2023104840W WO 2024051321 A1 WO2024051321 A1 WO 2024051321A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- network
- partition identifier
- message
- card
- network card
- Prior art date
Links
- 238000002955 isolation Methods 0.000 title claims abstract description 154
- 238000005192 partition Methods 0.000 claims abstract description 551
- 238000012545 processing Methods 0.000 claims abstract description 92
- 239000002356 single layer Substances 0.000 claims abstract description 28
- 239000010410 layer Substances 0.000 claims description 117
- 238000000034 method Methods 0.000 claims description 96
- 230000006854 communication Effects 0.000 claims description 18
- 238000004891 communication Methods 0.000 claims description 17
- 230000006870 function Effects 0.000 claims description 17
- 238000004590 computer program Methods 0.000 claims description 12
- 230000015654 memory Effects 0.000 claims description 12
- 238000010586 diagram Methods 0.000 description 30
- 238000005538 encapsulation Methods 0.000 description 24
- 230000005540 biological transmission Effects 0.000 description 13
- 238000005516 engineering process Methods 0.000 description 10
- 230000002159 abnormal effect Effects 0.000 description 7
- 239000002184 metal Substances 0.000 description 6
- 230000000717 retained effect Effects 0.000 description 4
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 230000001934 delay Effects 0.000 description 3
- 238000007689 inspection Methods 0.000 description 3
- GWWNCLHJCFNTJA-UHFFFAOYSA-N nicandrenone-2 Natural products C12OC2C2(O)CC=CC(=O)C2(C)C(CCC23C)C1C3CCC2(O)C(C)C1OC(O)C2(C)OC2(C)C1 GWWNCLHJCFNTJA-UHFFFAOYSA-N 0.000 description 3
- WYDFSSCXUGNICP-UHFFFAOYSA-N 24-methylenecholesta-5,7-dien-3beta-ol Natural products C1C2(C)OC2(C)C(O)OC1C(C)C1C2(C)CCC3C4(C)C(=O)C=CCC4(O)C4OC4C3C2CC1 WYDFSSCXUGNICP-UHFFFAOYSA-N 0.000 description 2
- WYDFSSCXUGNICP-CDLQDMDJSA-N C[C@@H]([C@H]1CC[C@H]2[C@@H]3[C@@H]4O[C@@H]4[C@@]4(O)CC=CC(=O)[C@]4(C)[C@H]3CC[C@]12C)[C@H]1C[C@]2(C)O[C@]2(C)C(O)O1 Chemical compound C[C@@H]([C@H]1CC[C@H]2[C@@H]3[C@@H]4O[C@@H]4[C@@]4(O)CC=CC(=O)[C@]4(C)[C@H]3CC[C@]12C)[C@H]1C[C@]2(C)O[C@]2(C)C(O)O1 WYDFSSCXUGNICP-CDLQDMDJSA-N 0.000 description 2
- VONSLYSEUXFYLE-UHFFFAOYSA-N Erychrosid Natural products C1C2(C)OC2(C)C(O)OC1C(C)C1C2(C)C(=O)CC3C4(C)C(=O)C=CCC4(O)C4OC4C3C2CC1 VONSLYSEUXFYLE-UHFFFAOYSA-N 0.000 description 2
- 101100073891 Neurospora crassa (strain ATCC 24698 / 74-OR23-1A / CBS 708.71 / DSM 1257 / FGSC 987) nic-3 gene Proteins 0.000 description 2
- 238000013473 artificial intelligence Methods 0.000 description 2
- 238000001914 filtration Methods 0.000 description 2
- 230000002093 peripheral effect Effects 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 1
- 230000000903 blocking effect Effects 0.000 description 1
- 230000003139 buffering effect Effects 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 230000007257 malfunction Effects 0.000 description 1
- 238000013508 migration Methods 0.000 description 1
- 230000005012 migration Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 239000013307 optical fiber Substances 0.000 description 1
- 238000012216 screening Methods 0.000 description 1
- 238000012549 training Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L12/00—Data switching networks
- H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
- H04L12/46—Interconnection of networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/12—Applying verification of the received information
- H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/40—Network security protocols
Definitions
- This application relates to the field of computer network technology, and in particular to a network isolation method, system and related equipment.
- Network isolation refers to a technology that enables data exchange on the basis of disconnecting two or more networks. The main purpose is to isolate harmful network security threats and ensure that data and information are shared in a safe environment.
- Network isolation technology is usually divided into two categories: physical isolation and logical isolation.
- Physical isolation is a network that is completely isolated between physical devices and physical connections. It requires the establishment of at least multiple sets of hardware network systems, which is costly to implement and inflexible in configuration.
- Logical isolation is to statically or dynamically configure isolation rules on the same physical network, so that different organizations/users cannot access each other, with lower costs and more flexible configuration. Logical isolation is currently widely used in scenarios such as data centers, enterprises, and campuses due to its low cost and flexible configuration.
- VXLAN Virtual eXtensible LAN
- VXLAN refers to establishing a logical VXLAN tunnel between the source and destination.
- the VXLAN tunnel end point (VTEP) completely encapsulates the original Ethernet message sent by the source into a UDP message, and then uses it in the outer layer IP header and Ethernet header encapsulation of the physical network.
- VTEP VXLAN tunnel end point
- the feature matching of the original Ethernet packet is used to find the outer tunnel information to achieve isolation control.
- VTEP in VXLAN needs to encapsulate packets into packets with two layers of network headers, or decapsulate packets with two layers of network headers, which is complex to implement and has long processing delays, resulting in poor packet forwarding performance.
- This application provides a network isolation method, system and related equipment. On the premise of ensuring the safety and reliability of network isolation, it can reduce the complexity and processing delay of large-scale IP network isolation and improve network isolation performance.
- the first aspect provides a network isolation system.
- the system includes a source network card connected to the source device, a destination network card connected to the destination device, and network equipment.
- the source network card and the destination network card are connected through the IP network, and the network equipment is a device in the IP network.
- the source network card is used to process the data to be sent and obtain the target message.
- the target message includes a single-layer message header.
- the message header includes the first network partition identifier added by the source network card.
- the first network partition identifier is the source network card.
- the source network card is also used to send target packets to the destination network card through network devices.
- a network device used to forward target packets to the destination network card based on the address information in the packet header.
- the destination network card is used to obtain the first network partition identifier in the message header of the target message after receiving the target message, and when the first network partition identifier is different from the second network partition identifier, discard the target message, and the second network
- the partition ID is the network partition ID configured by the destination network card.
- the source network card adds the message with the first network partition identifier in the message header of the target message.
- the network device retains the first network partition identifier when forwarding the target message, so that the first network partition identifier is carried end-to-end, so that the destination network card After receiving the target message, it can determine whether to discard the target message based on whether the first network partition identifier in the target message is consistent with the second network partition identifier configured on itself, thereby achieving end-to-end network isolation.
- the target packet only includes a single-layer packet header, and the packet format is simple. The operation of the network card to add the first network partition identifier in the packet header is simple and efficient, because there is no need for network equipment to add isolation for network isolation to the target packet.
- the network device can forward the target packet carrying the first network partition identifier as a normal IP packet, thereby improving the forwarding performance of the network device, reducing the processing delay of the target packet, and reducing network isolation. complexity.
- the network card works at the physical layer and data link layer, and the network partition identifier configured for the network card is invisible to tenants. Tenants cannot tamper with the network partition identifier, ensuring that the network partition identifier is safe and trustworthy. Therefore, implementing network isolation based on network partition identification can ensure the security of network isolation.
- the data to be sent is application data that has not been encapsulated.
- the source network card is used to encapsulate the message header including the first network partition identifier for the data to be sent, and obtain the target message.
- the source network card encapsulates the message header for the data to be sent, and the message header includes the first network partition identifier, that is, the network card is encapsulating the message for the data to be sent.
- the addition of the first network partition identifier is completed synchronously at the beginning. The operation is simple and does not require complex tunnel matching and matching due to the need to achieve network isolation. Encapsulation, thereby reducing packet processing delay.
- the data to be sent includes an original message header, and the original message header does not include the first network partition identifier.
- the source network card is used to insert the first network partition identifier into the original message header to obtain the target message.
- the network card adds the first network partition identifier to the original message header to obtain a message header including the first network partition identifier, thereby obtaining the target message.
- the network card does not need to perform complex tunnel matching and encapsulation due to the need to achieve network isolation, and the processing delay is low.
- the message header includes a link layer header and an IP network header
- the first network partition identifier is located in the link layer header or the IP network header. Therefore, the destination network card can obtain the first network partition identifier without decapsulating the target message, which can improve the speed at which the destination network card identifies whether the target message is not allowed to pass through.
- the first network partition identifier is not used for forwarding the target packet. That is to say, the network device can forward the target packet based on the address information in the header of the target packet.
- the network device does not need to establish a forwarding path table entry related to the first network partition identifier, nor does it need to look up the table based on the first network partition identifier.
- the network device only needs to forward the target packet carrying the first network partition identifier in the packet header as a normal IP packet, thereby improving the forwarding performance of the network device.
- the first network partition identifier and the second network partition identifier are invisible to both the source device and the destination device. Therefore, tenants in the remote device and the destination device cannot obtain the first network partition identifier and the second network partition identifier, ensuring the confidentiality and security of the network partition identifier, and ensuring the safety and reliability of network isolation based on the network partition identifier.
- the system further includes a network management device, and the network device includes a first edge network device connected to the source network card, and a second edge network device connected to the destination network card.
- the network management device is specifically configured to send a first network partition identifier to the first edge network device and send a second network partition identifier to the second edge network device.
- the first edge network device is also configured to send a first control message to the source network card, where the first control message includes the first network partition identifier.
- the second edge network device is also configured to send a second control message to the destination network card, where the second control message includes a second network partition identifier.
- the source network card is also used to configure the first network partition identifier according to the first control message.
- the destination network card is also used to configure the second network partition identifier according to the second control message.
- Trustworthy configuration of the network partition identifiers of the source and destination network cards on the network side will not be perceived by tenants, ensuring the confidentiality and security of the network partition identifiers and ensuring the safety and reliability of network isolation based on network partition identifiers.
- the first control message and the second control message do not include the IP address.
- the network card can identify the control message and complete the configuration of its own network partition identifier based on the control message, instead of sending the control message to the end-side device as a normal IP packet, causing the network partition identifier to be exposed and the network card to be unable to complete the network configuration. Configuration of partition ID.
- the destination network card is also configured to strip the first network partition identifier from the target packet when the first network partition identifier and the second network partition identifier are the same.
- the destination network card is also used to send the destination packet with the first network partition identifier stripped to the destination device.
- the first network partition identifier and the second network partition identifier are the same, indicating that the destination network card and the source network card belong to the same network partition, and communication between the source device and the destination device is allowed.
- it is necessary to strip the first network partition identifier from the header of the target packet to prevent the packet carrying the first network partition identifier from being sent to the destination device, causing the destination device to malfunction.
- the end device cannot recognize the message, and the first network partition identifier is exposed, thereby ensuring the confidentiality and security of the network partition identifier, and ensuring the safety and reliability of network isolation based on the network partition identifier.
- the network device includes a second edge network device, and the first port of the second edge network device is connected to the destination network card.
- the second edge network device is used to receive the target message and obtain the first network partition identifier in the message header.
- the second edge network device is also configured to forward the target packet to the destination network card through the first port when the first network partition identifier is the network partition identifier that the first port is allowed to pass through, or when the first network partition identifier is not the first port. Drop the target packet when identified by a network partition that is allowed to pass.
- the second edge network device screens the target packets sent to the destination network card and can assist the destination network card in filtering abnormal traffic to prevent abnormal traffic from attacking the destination network card and occupying the bandwidth of the destination network card and affecting the normal operation of the destination network card.
- the network device includes a first edge network device, and the second port of the first edge network device is connected to the source network card.
- the first edge network device is configured to receive the target message and obtain the first network partition identifier in the message header.
- the first edge network device is also configured to forward the target packet to the destination network card when the first network partition identifier is a network partition identifier that is allowed to pass through the second port, or when the first network partition identifier is not a network that is allowed to pass through the second port.
- the target packet is discarded when the partition is identified.
- the first edge network device screens the packets from the second port, thereby blocking abnormal target packets from the end-side device and preventing abnormal target packets from being forwarded in the IP network, thus improving the security of the IP network.
- the source device is a physical machine and the source network card is a physical network card; or the source device is a virtual device and the source network card It is a virtual function VF network card or a physical function PF network card that is pass-through to a virtual device, and the virtual device is a virtual machine or container; the destination device is a physical machine, and the destination network card is a physical network card; or the destination device is a virtual device, and the destination network card is a virtual device pass-through VF network card or PF network card.
- the source network card only corresponds to one end-side device, which can achieve precise isolation of various forms of end-side devices and can be applied to a variety of network isolation scenarios.
- the source network card is a network card that implements message sending and receiving based on physical resources of the physical network card and the first network card partition identifier adding process
- the destination network card is a network card that implements message sending and receiving based on physical resources of the physical network card and the first network card.
- Partition ID stripping handles the network card.
- the second aspect provides a network card.
- the network card includes a storage module, a transceiver module and a processing module.
- the storage module is used to store the second network partition identifier configured by the network card.
- the transceiver module is used to receive the target message forwarded by the network device in the IP network.
- the target message includes a single-layer message header, and the message header includes the first network partition identifier added by the network card that sends the target message.
- the first network The partition identifier is the network partition identifier configured on the network card that sends the target packet.
- the processing module is configured to obtain the first network partition identifier in the message header, and discard the target message when the first network partition identifier is different from the second network partition identifier.
- the first network partition identifier and the second network partition identifier are invisible to the end-side device connected to the transceiver module.
- the processing module is also configured to strip the first network partition identifier from the message header of the target message when the first network partition identifier and the second network partition identifier are the same.
- the transceiver module is also configured to send the target message with the first network partition identifier stripped to the end-side device connected to the transceiver module.
- the transceiver module is also configured to receive a second control message from a second edge network device among the network devices.
- the second edge network device is a device connected to the transceiver module.
- the second control message includes a second network partition identifier, and the second control message is generated after the second edge network device receives the second network partition identifier from the network management device.
- the processing module is also configured to configure the second network partition identifier according to the second control message.
- the network card is a physical network card, and the end-side device connected to the network card is a physical machine; or the network card is a VF network card or PF network card that passes through the end-side device, and the end-side device is a virtual machine or container.
- the network card is a network card that implements message sending and receiving and the first network partition identifier stripping process based on the physical resources of the physical network card.
- the third aspect provides a network card.
- the network card includes a storage module, a transceiver module and a processing module.
- the storage module is used to store the first network partition identifier configured by the network card.
- the processing module is used to process the data to be sent to obtain a second target message.
- the second target message includes a single-layer message header, and the message header includes a second network partition identifier added by the processing module.
- a transceiver module configured to send a target message through a network device in an IP network, so that the network card receiving the target message discards the target when the second network partition identifier is different from the first network partition identifier in the header of the target message.
- the second network partition identifier is the network partition identifier configured on the network card that receives the target message.
- the second network partition identifier is located in the link layer header.
- the data to be sent is application data that has not been encapsulated.
- the processing module is used to encapsulate the message header including the first network partition identifier for the data to be sent, and obtain the target message.
- the data to be sent includes an original message header, and the original message header does not include the first network partition identifier.
- the processing module is used to insert the first network partition identifier into the original message header to obtain the target message.
- the message header of the target message includes a link layer header and an IP network header, and the first network partition identifier is located in the link layer header or the IP network header.
- the transceiver module is also configured to receive a control message from an edge network device in the network device.
- the edge network device is a network device connected to the transceiver module, and the control message includes a first network partition identifier, The control message is generated after the edge network device receives the first network partition identifier from the network management device.
- the processing module is also configured to configure the first network partition identifier according to the control message.
- the network card is a physical network card, and the end-side device connected to the network card is a physical machine; or the network card is a VF network card or PF network card that passes through the end-side device, and the end-side device is a virtual machine or container.
- the network card is a network card that implements message sending and receiving and the first network card partition identifier adding process based on the physical resources of the physical network card.
- the fourth aspect provides a network isolation method.
- the method includes: the destination network card receives a target message forwarded by a network device in the IP network.
- the target message is obtained by processing the data to be sent by the source network card.
- the target message includes a single-layer message header, and the message header includes the source network card.
- the first network partition identifier is added.
- the first network partition identifier is the network partition identifier configured by the source network card;
- the destination network card obtains the first network partition identifier in the message header of the target message; the destination network card matches the first network partition identifier with the first network partition identifier.
- the target packet is discarded and the second network
- the network partition identifier is the network partition identifier configured by the destination network card.
- the message header includes a link layer header and an IP network header
- the first network partition identifier is located in the link layer header or the IP network header.
- the first network partition identifier and the second network partition identifier pair are invisible to both the source device and the destination device.
- the source device is an end-side device connected to the source network card
- the destination device is The end-side device connected to the destination network card.
- the method further includes: the destination network card receiving a second control message from a second edge network device among the network devices, where the second edge network device is a device connected to the destination network card, and the second control message includes the second network partition identifier, and the second control message is generated by the second network device after receiving the second network partition identifier from the network management device.
- the destination network card completes the configuration of the second network partition identifier according to the control message.
- control message does not include the IP address.
- the method further includes: when the first network partition identifier and the second network partition identifier are the same, the destination network card strips the first network partition identifier from the target packet.
- the destination network card sends the target packet with the first network partition identifier stripped off to the destination device connected to the destination network card.
- the destination network card is a physical network card, and the destination device connected to the destination network card is a physical machine; or the destination network card is a VF network card or PF network card that passes directly to the destination device, and the destination device is a virtual machine or container. .
- the destination network card is a network card that implements packet sending and receiving and the first network partition identifier stripping process based on the physical resources of the physical network card.
- the fifth aspect provides a network isolation method.
- the method includes: the source network card processes the data to be sent to obtain a target message.
- the target message includes a single-layer message header.
- the message header includes a first network partition identifier added by the source network card.
- the first network partition identifier is the source network card.
- the source network card sends the target message to the destination network card through the network device in the IP network, so that after receiving the target message, the destination network card obtains the first network partition identifier in the message header of the target message, and adds the first network partition identifier to the destination network card. If the destination packet is different from the second network partition identifier, the destination packet is discarded.
- the second network partition identifier is the network partition identifier configured for the destination network card.
- the data to be sent is application data that has not been encapsulated.
- the source network card encapsulates the message header including the first network partition identifier for the data to be sent, and obtains the target message.
- the data to be sent includes an original message header, and the original message header does not include the first network partition identifier; the source network card is used to insert the first network partition identifier into the original message header, obtaining target message.
- the message header includes a link layer header and an IP network header
- the first network partition identifier is located in the link layer header or the IP network header.
- the first network partition identifier and the second network partition identifier are invisible to both the source device and the destination device.
- the source device is an end-side device connected to the source network card
- the destination device is an end-side device connected to the source network card.
- the end-side device connected to the destination network card.
- the method further includes: the source network card receiving a first control message from a first edge network device among the network devices, where the first edge network device is a device connected to the source network card, and the first control message includes the first network partition identifier, and the first control message is generated after the first network device receives the first network partition identifier from the network management device.
- the source network card completes the configuration of the first network partition identifier according to the control message.
- control message does not include the IP address.
- the source network card is a physical network card, and the source device connected to the source network card is a physical machine; or the source device is a virtual device, and the source network card is a VF network card or PF network card that is directly connected to the virtual device, and the virtual device for a virtual machine or container.
- the source network card is a network card that implements message sending and receiving based on physical resources of the physical network card and the first network card partition identifier adding process
- the destination network card is a network card that implements message sending and receiving based on physical resources of the physical network card and the first network card.
- Partition ID stripping handles the network card.
- the sixth aspect provides a network isolation method.
- the method includes: the network device receives a target message sent by the source network card.
- the target message is obtained by processing the data to be sent by the source network card.
- the target message includes a single-layer link layer header and a single-layer IP network header.
- the first network partition identifier is the network partition identifier configured by the source network card; the network device forwards the target message to the destination network card according to the destination address information in the message header, and the network device forwards the target message
- the first network partition identifier in the message header is retained so that the destination network card obtains the first network partition identifier from the message header after receiving the target message, and when the first network partition identifier and the second network partition identifier are different, The target packet is discarded, and the second network partition identifier is the network partition identifier configured by the destination network card.
- the first network partition identifier is not used for forwarding the target packet.
- the message header includes a link layer header and an IP network header
- the first network partition identifier is located in the link layer header or the IP network header.
- the network device includes a first edge network device connected to the source network card, and a second edge network device connected to the destination network card.
- the method further includes: the first edge network device obtains data from the network management device. the first network partition identifier; the first edge network device sends a first control message to the source network card, and the first control message includes the first network partition identifier, so that the source network card configures the first network partition identifier according to the first control message; second The edge network device obtains the second network partition identifier from the network management device; the second edge network device sends a second control message to the destination network card, and the second control message includes the second network partition identifier so that the destination network card is configured according to the second control message Second network partition identifier.
- the first control message and the second control message do not include the IP address.
- the network device includes a second edge network device connected to the destination network card, and the first port of the second edge network device is connected to the destination network card.
- the method further includes: the second edge network device receives the target message. , and obtains the first network partition identifier in the message header; when the first network partition identifier is the network partition identifier that the first port is allowed to pass through, the second edge network device forwards the target message to the destination network card through the first port, or The target packet is discarded when the first network partition identifier is not a network partition identifier allowed to pass through the first port.
- the network device includes a first edge network device connected to the source network card, and the second port of the first edge network device is connected to the source network card.
- the method further includes: the first edge network device receives the target message, And obtain the first network partition identifier in the message header; when the first network partition identifier is the network partition identifier that the second port is allowed to pass through, the first edge network device forwards the target message to the destination network card, or in the first network partition If the identifier is not the network partition identifier that the second port is allowed to pass through, the target packet is discarded.
- the source device is a physical machine, and the source network card is a physical network card; or the source device is a virtual device, and the source network card is a virtual function VF network card or a physical function PF network card that is passed through by the virtual device, and the virtual device is Virtual machine or container; the destination device is a physical machine and the destination network card is a physical network card; or the destination device is a virtual device and the destination network card is a VF network card or PF network card that is directly connected to the virtual device.
- the source network card is a network card that implements message sending and receiving based on physical resources of the physical network card and the first network card partition identifier adding process
- the destination network card is a network card that implements message sending and receiving based on physical resources of the physical network card and the first network card.
- Partition ID stripping handles the network card.
- the seventh aspect provides a network isolation method.
- the method includes: the source network card processes the data to be sent to obtain a target message.
- the target message includes a single-layer message header.
- the message header includes a first network partition identifier added by the source network card.
- the first network partition identifier is the source network card.
- the configured network partition identifier; the source network card sends the target message to the destination network card through the network device; the network device forwards the target message to the destination network card; after receiving the target message, the destination network card obtains the first network partition identifier in the message header, and
- the target packet is discarded, and the second network partition identifier is the network partition identifier configured by the destination network card.
- the first network partition identifier is not used for forwarding the target packet.
- the network device includes a first edge network device connected to the source network card, and a second edge network device connected to the destination network card.
- the method further includes: the first edge network device obtains data from the network management device. the first network partition identifier; the first edge network device sends a first control message to the source network card, and the first control message includes the first network partition identifier; the source network card configures the first network partition identifier according to the first control message.
- the second edge network device obtains the second network partition identifier from the network management device; the second edge network device sends a second control message to the destination network card, where the second control message includes the second network partition identifier; the destination network card is configured according to the second control message Second network partition identifier.
- the first control message and the second control message do not include the IP address.
- the network device includes a second edge network device connected to the destination network card, and the first port of the second edge network device is connected to the destination network card.
- the method further includes: the second edge network device receives the target message. , and obtains the first network partition identifier in the message header; when the first network partition identifier is the network partition identifier that the first port is allowed to pass through, the second edge network device forwards the target message to the destination network card through the first port, or The target packet is discarded when the first network partition identifier is not a network partition identifier allowed to pass through the first port.
- the network device includes a first edge network device connected to the source network card, and the second port of the first edge network device is connected to the source network card.
- the method further includes: the first edge network device receives the target message, And obtain the first network partition identifier in the message header; when the first network partition identifier is the network partition identifier that the second port is allowed to pass through, the first edge network device forwards the target message to the destination network card, or in the first network partition If the identifier is not the network partition identifier that the second port is allowed to pass through, the target packet is discarded.
- the data to be sent is application data that has not been encapsulated.
- the source network card is used to encapsulate the message header including the first network partition identifier for the data to be sent, and obtain the target message.
- the data to be sent includes an original message header, and the original message header does not include the first network partition identifier.
- source The network card is used to insert the first network partition identifier into the original message header to obtain the target message.
- the message header includes a link layer header and an IP network header
- the first network partition identifier is located in the link layer header or the IP network header.
- the first network partition identifier and the second network partition identifier are invisible to both the source device and the destination device connected to the destination network card.
- the method further includes: when the first network partition identifier and the second network partition identifier are the same, the destination network card strips the first network partition identifier from the target packet.
- the destination network card sends the target packet with the first network partition identifier stripped off to the destination device connected to the destination network card.
- the source device is a physical machine, and the source network card is a physical network card; or the source device is a virtual device, and the source network card is a virtual function VF network card or a physical function PF network card that is passed through by the virtual device, and the virtual device is Virtual machine or container; the destination device is a physical machine and the destination network card is a physical network card; or the destination device is a virtual device and the destination network card is a VF network card or PF network card that is directly connected to the virtual device.
- the source network card is a network card that implements message sending and receiving based on physical resources of the physical network card and the first network card partition identifier adding process
- the destination network card is a network card that implements message sending and receiving based on physical resources of the physical network card and the first network card.
- Partition ID stripping handles the network card.
- An eighth aspect provides a network device.
- Network equipment includes transceiver modules. Among them, the transceiver module is used to receive the target message sent by the source network card. The target message is obtained by processing the data to be sent by the source network card. The target message includes a single message header, and the message header includes the first message added by the source network card. Network partition identifier. The first network partition identifier is the network partition identifier configured by the source network card. The transceiver module is also used to forward the target message to the destination network card based on the destination address information in the message header. When the network device forwards the target message, it retains the first network partition identifier in the message header so that the destination network card can receive the target message.
- the first network partition identifier is obtained from the message header, and when the first network partition identifier is different from the second network partition identifier, the target message is discarded.
- the second network partition identifier is the network partition identifier configured by the destination network card.
- the first network partition identifier is not used for forwarding the target packet.
- the network device is a first edge network device connected to the source network card, and the first edge network device further includes a processing module; a processing module configured to obtain the first network partition identifier from the network management device; The processing module is configured to generate a first control message according to the first network partition identifier.
- the first control message includes the first network partition identifier.
- the transceiver module is configured to send the first control message to the source network card so that the source network card responds to the first control message. The message configures the first network partition identifier.
- the network device is a second edge network device connected to the destination network card, and the second edge network device further includes a processing module; a processing module configured to obtain the first network partition identifier from the network management device; The processing module is configured to generate a second control message according to the second network partition identifier.
- the second control message includes the second network partition identifier.
- the transceiver module is configured to send the second control message to the source network card so that the destination network card can generate the second control message according to the second control message. The message configures the second network partition identifier.
- the first control message and the second control message do not include the IP address.
- the network device is a first edge network device connected to the source network card, and the first edge network device further includes a processing module; a processing module configured to obtain the first network partition identifier in the message header; A processing module configured to allow the transceiver module to forward the target message to the destination network card when the first network partition identifier is a network partition identifier that is allowed to pass, or to discard the target message when the first network partition identifier is not a network partition identifier that is allowed to pass. arts.
- the network device is a second edge network device connected to the destination network card, and the second edge network device further includes a processing module; a processing module configured to obtain the first network partition identifier in the message header; A processing module configured to allow the transceiver module to forward the target message to the destination network card when the first network partition identifier is a network partition identifier that is allowed to pass, or to discard the target message when the first network partition identifier is not a network partition identifier that is allowed to pass. arts.
- the message header includes a link layer header and an IP network header
- the first network partition identifier is located in the link layer header or the IP network header.
- a ninth aspect is a network device.
- the network device includes a processor and a physical port.
- the processor is connected to the physical port.
- the physical port is used to receive and send target messages.
- the processor is used to execute instructions so that the network device executes the sixth aspect or any one of the sixth aspects. Methods in possible implementations.
- a tenth aspect provides a network card.
- the network card includes a processor and a physical network port.
- the processor is connected to the physical network port.
- the physical network port is used to receive and send target messages.
- the processor is used to perform the fourth aspect or any possible implementation of the fourth aspect. manner, or the method in the fifth aspect or any possible implementation manner of the fifth aspect.
- An eleventh aspect provides a computer device.
- the computer device includes a processor, a memory, a communication bus and, as in the second aspect, third
- the processor, the memory and the network card are connected to each other through a communication bus.
- a twelfth aspect provides a computer-readable storage medium.
- the computer-readable storage medium includes computer program instructions.
- the network card executes the above-mentioned fourth aspect or any possible implementation of the fourth aspect, or the fifth aspect or any of the fifth aspects. method in one possible implementation.
- a thirteenth aspect provides a computer-readable storage medium, which is characterized in that it includes computer program instructions.
- the computer program instructions are executed by a network device, the network device performs any of the above-mentioned sixth aspects or possible methods of the sixth aspect. Methods in the implementation.
- the fourteenth aspect provides a message structure.
- the message structure of the message includes a single-layer message header and payload, and the message header includes a link layer header and an IP network header.
- the message header includes a network partition identifier field.
- the network partition identifier field is used to carry the first network partition identifier configured by the source network card that sends the message.
- the first network partition identifier is used to determine the link layer header at the destination network card that receives the message. Or when the first network partition identifier in the IP network header is different from the second network partition identifier configured by itself, the packet is discarded.
- the first network partition identifier is retained during network transmission and carried end-to-end with the packet, so that it can be used for end-to-end network isolation.
- the first network partition identifier is also used to determine whether the first network partition identifier in the link layer header or IP network header is consistent with the second network partition identifier configured by the destination network card that receives the message. At the same time, the packet is allowed to pass.
- the IP network header is an IPv6 network header
- the network partition identification field is located in the IPv6 extension header of the IPv6 network header.
- the length of the network partition identification field is greater than 12 bits.
- Figure 1 is a schematic diagram of a data center network architecture
- FIG. 2 is a schematic diagram of the format of VXLAN messages
- FIG. 3 is a schematic structural diagram of an embodiment of the network isolation system provided by this application.
- Figure 4 is a schematic structural diagram of another embodiment of the network isolation system provided by this application.
- Figure 5 is a schematic flow chart of an embodiment of the network isolation method provided by this application.
- Figure 6 is a schematic diagram of the message structure of a target message provided by this application.
- Figure 7 is a schematic diagram of the message structure of another target message provided by this application.
- Figure 8 is a schematic flow chart of the second embodiment of the network isolation method provided by this application.
- Figure 9 is a schematic diagram of an application scenario of the network isolation method provided by this application.
- Figure 10 is a schematic diagram of another application scenario of the network isolation method provided by this application.
- Figure 11 is a schematic diagram of another application scenario of the network isolation method provided by this application.
- Figure 12 is a schematic structural diagram of an embodiment of the network card provided by this application.
- Figure 13 is a schematic structural diagram of another embodiment of the network card provided by this application.
- Figure 14 is a schematic structural diagram of an embodiment of the network device provided by this application.
- Figure 15 is a schematic structural diagram of another embodiment of a network device provided by this application.
- Figure 16 is a schematic structural diagram of another embodiment of the network card provided by this application.
- Figure 17 is a schematic structural diagram of an embodiment of the computer equipment provided by this application.
- This application provides a network isolation method, system and related equipment. On the premise of ensuring the safety and reliability of network isolation, it can reduce the complexity and processing delay of large-scale IP network isolation and improve network isolation performance.
- the network connects different computer devices (hosts) through network devices and lines, providing strong support for information transmission and resource sharing between different computer devices.
- computer devices connected to the same physical network can access each other, and broadcast messages sent by one computer device can be received by all computer devices on the same physical network. This results in computer equipment being maliciously accessed or attacked by other computer equipment, leading to information leakage or computer equipment failure.
- a large amount of network bandwidth will be occupied, affecting the normal operation of services on the network. Therefore, the network needs to be isolated to ensure the security and reliable operation of the network.
- Network isolation refers to dividing network resources or computer equipment on a physical network into multiple relatively small logical networks according to certain principles. For example, in a data center network, logical networks are divided according to tenants or functions; in a campus network, logical networks are divided according to enterprises; in enterprise networks, logical networks are divided according to departments, and so on. Computer devices in the same logical network can communicate directly, but computer devices in different logical networks cannot communicate directly. Data flows across logical networks require a three-layer gateway for forwarding, which can reduce the number of computer devices within the logical network. Risks of information leakage caused by attacks and access by computing devices in other logical networks, as well as broadcast storms caused by suppressing the propagation of too many broadcast messages in the network.
- Figure 1 is a schematic diagram of a data center network architecture.
- the data center network architecture in Figure 1 uses a two-layer spine and leaf architecture as an example.
- the data center network architecture can also be a two-layer or three-layer tree/fat tree architecture, or a three-layer or multi-layer spine and leaf architecture, etc. No restrictions anywhere.
- a data center network includes multiple hosts and multiple network devices.
- Network devices are connected through cables to form a network.
- Each host accesses the network through edge network devices among multiple network devices, so that the hosts can communicate with each other through the network.
- the network equipment can be divided into two layers: the first switching layer and the second switching layer.
- the network device in the first switching layer is an access device, which may also be called an edge network device, and is used to connect to at least one host.
- Network devices in the first switching layer are, for example, leaf switches.
- the network device in the second switching layer is a core device connected to multiple network devices in the first switching layer, and is used to implement Layer 3 traffic forwarding within the same data center or with external networks.
- the network equipment in the second switching layer is, for example, a backbone switch.
- the physical network card can be used as a high-speed serial computer expansion bus standard (peripheral component interconnect express, PCIe) terminal device inserted into the PCIe slot of the host's motherboard through the PCIe interface.
- PCIe peripheral component interconnect express
- the motherboard includes hardware such as central processing units and memories, which are used to provide computing resources and storage resources, so that operating systems, applications, etc. can be run based on the hardware on the motherboard.
- the hardware resources on the motherboard can also be provided to virtual instances. Virtual instances Examples are virtual machines, containers, or bare metal servers.
- the physical network card is the physical interface between the host and transmission media such as optical fiber, twisted pair or coaxial cable.
- the physical network card is connected to the port on the edge network device through the transmission medium, thereby realizing the connection between the host and the edge network device through the physical network card.
- Physical network cards can also be called network interface cards (NICs), or network adapters (network adapters).
- NICs network interface cards
- network adapters network adapters
- a host can be virtualized into multiple virtual instances such as virtual machines or containers.
- Computing resources in the data center can be shared with multiple tenants at the granularity of virtual machines, containers or physical machines. Therefore, a host may belong to multiple tenants, and a tenant's virtual machines, containers, bare metal servers, or physical machines may be distributed on different hosts in the data center.
- the data center also deploys multiple services, such as artificial intelligence (artificial intelligence, AI) model training, AI reasoning, search, and big data analysis.
- AI artificial intelligence
- services are usually deployed on different hosts, virtual machines or containers in the data center.
- virtual machines, containers, bare metal servers or physical hosts of the same tenant or business can communicate with each other, while different tenants or businesses require network isolation.
- VXLAN isolation principle is as follows:
- FIG. 2 is a schematic diagram of the format of a VXLAN message.
- VXLAN packets include two layers of packet headers, namely the packet header of the inner packet (original packet) and the encapsulated outer tunnel encapsulation header.
- the VXLAN message encapsulates the inner layer message in the data part (payload) of the UDP message.
- the data part of the UDP message carries the VXLAN header, the inner Ethernet header (inner Ethernet header), and the inner IP header (inner IP header).
- the inner message includes the internal Ethernet header, the internal IP header and the payload of the IP message.
- the internal Ethernet header records the source media access control of the inner message. , MAC) address and destination MAC address.
- the inner IP header records the source IP address and destination IP address of the inner packet.
- the tunnel encapsulation header includes the outer Ethernet header (outer Ethernet header), the outer IP header (outer IP header), the outer user datagram protocol (user datagram protocol, UDP) header (outer UDP header) and the VXLAN header.
- the VXLAN header includes VXLAN Flags. field (8 bits), reserved field (24 bits), VXLAN network identifier (VNI) (24 bits), and reserved field (24 bits).
- the external Ethernet header records the source MAC address and destination MAC address of the VTEP, and the external IP header records the source IP address and destination IP address of the VXLAN tunnel terminal.
- VXLAN tunnel terminals can also be called VTEP devices.
- VTEP devices are the endpoints of VXLAN tunnels and are used to encapsulate inner packets: add external Ethernet headers, external IP headers, and external user datagrams to the inner packets. Protocol header and VXLAN header to generate VXLAN packets and send them to other VTEP devices, and also decapsulate VXLAN packets received from other VTEP devices: convert the external Ethernet header, external IP header, external IP header of the VXLAN packet Strip the user datagram protocol header and VXLAN header to obtain the inner packet. And get the VNI from the VXLAN header. Before encapsulating the inner packet, the VTEP device is also used to perform tunnel matching on the inner packet, that is, which VNI identifier should be added to the inner packet so that the inner packet can be forwarded through the corresponding VXLAN tunnel.
- the VTEP device uses the original packet as the inner packet of the VXLAN packet, and records in the outer Ethernet header of the tunnel encapsulation header of the VXLAN packet that the source MAC address is the MAC address of the VTEP device and the destination MAC address. It is the MAC address of the next hop device.
- the source IP address recorded in the external IP header of the tunnel encapsulation header of the VXLAN message is the IP address of the VTEP device.
- the destination IP address is the IP address of the VTEP device at the opposite end of the tunnel.
- the VNI identifier is recorded in the VNI field of the VXLAN header. That is, when a network device forwards a VXLAN packet, it forwards it through the address information in the tunnel encapsulation header.
- VXLAN header is an additional layer of header added before the original message (inner layer message)
- the frame header of the VXLAN message is long, causing the VXLAN message to occupy a large amount of additional network bandwidth during network transmission. That is, under the limitation of the maximum frame length, the length of the packet header needs to be reduced, and the effective business data carried in the packet becomes less, resulting in a decrease in network bandwidth utilization and throughput.
- this application provides the following embodiments to achieve high-performance network isolation.
- FIG. 3 is a schematic structural diagram of an embodiment of the network isolation system provided by this application.
- Network isolation systems can be applied in data center networks, campus networks, enterprise networks or wide area networks.
- the network isolation system includes multiple network cards and multiple network devices.
- Each network card is connected to an end-side device, which refers to a physical machine, virtual machine, bare metal server or container excluding physical network cards. Virtual machines, bare metal servers or containers can be collectively referred to as virtual appliances.
- the network card connected to the end-side device is used to send and receive packets for the end-side device.
- Multiple end-side devices are connected to an IP network composed of multiple network devices through the network cards connected to them to realize interconnection between end-side devices.
- a network that uses the IP protocol for communication is an IP network.
- the network isolation system of this embodiment uses transmission control protocol/internet protocol (TCP/IP) for communication. That is, the end-side device encapsulates the data to be sent according to the format of the IP datagram to obtain an IP message. When forwarding the IP message, the network device performs addressing and routing based on the destination IP address in the header of the IP message.
- TCP/IP protocol has a wide range of uses and has nothing to do with the lower data link layer and physical layer. Therefore, the TCP/IP protocol can run on various data link layer networks and can connect different data link layer protocols. network.
- the network isolation system uses the TCP/IP protocol and is compatible with a variety of data link layer networks, including currently existing data link layer networks, such as Ethernet, Token Ring, and Token Bus, as well as those launched in the future.
- the data link layer network can present different data link layer networks into a large IP network. Therefore, this application is based on IP network and can achieve large-scale network isolation.
- Each network partition includes at least one end-side device.
- Each network partition is assigned at least one network partition identifier (network partition identifier, NPI).
- NPI network partition identifier
- This embodiment takes an example of allocating an NPI to a network partition. Different network partitions are assigned different NPIs.
- the NPI of end-side devices in the same network partition is the same, and the NPI of the end-side device is the NPI assigned by the network partition to which it belongs.
- End-side devices in the same network partition can communicate with each other because they are configured with the same NPI. End-side devices in different network partitions cannot communicate with each other due to different configured NPIs, thus making different network partitions isolated from each other.
- NPI is configured in the network card connected to the end-side device.
- the network cards configured with NPI are all network cards that implement packet sending and receiving, NPI addition, and NPI stripping based on the physical resources of the physical network card.
- NPI is stored in the hardware resources of the network card, such as registers and other memories, and the network card works at the data link layer and physical layer, making NPI invisible to end-side devices, so that tenants do not perceive NPI to ensure that NPI is not used by the network. Users other than administrators can obtain or modify it, thus ensuring the security of network isolation based on NPI.
- the network card connected to the end-side device in the same network partition configures the NPI corresponding to the network partition. Therefore, the network card configuration NPIs connected to end-side devices in different network partitions are different from each other.
- end-side devices can be physical machines, virtual machines, containers, or bare metal servers.
- the network card can be a physical network card, or a physical function (PF) network card or a virtual function (VF) network card virtualized on the physical network card.
- PF network cards and VF network cards are also network cards that implement packet sending and receiving, NPI addition, and NPI stripping based on the physical resources of the physical network card.
- the physical network card may specifically be a smart network interface card (smart NIC).
- a smart network card is a network card with programmable capabilities.
- smart network cards can also include input/output (I/O) Virtualization, and switching functions, etc.
- I/O virtualization can use single-root I/O virtualization (SR-IOV) or multi-root I/O virtualization (MR-IOV).
- SR-IOV technology is used as an example for explanation.
- SR-IOV technology is a hardware-based virtualization solution that can efficiently share PCIe devices between virtual machines, and because SR-IOV technology is implemented in hardware, it can achieve efficient I/O performance.
- the physical network port of a physical network card that supports SR-IOV uses SR-IOV technology to virtualize at least one PF network card and multiple VF network cards.
- each PF NIC can have up to 64,000 VF NICs associated with it.
- the PF network card or VF network card is presented as an independent network card and has its own exclusive peripheral component interconnect (PCI) configuration area.
- PCI peripheral component interconnect
- PF network cards and VF network cards can be collectively referred to as pass-through network cards.
- a virtual instance can be assigned multiple VF network cards, but the same VF network card can only be assigned to one virtual instance.
- One physical network port of a physical network card corresponds to at least one PF network card and multiple VF network cards. Each VF network card can share the physical resources of the physical network card (share the same physical network port).
- pass-through VF network card When the virtual instance on the host sends a message through the pass-through VF network card, the message sent by the virtual instance will be directly passed to the VF network card of the physical network card through the VF network card driver installed on the virtual instance, and the VF network card will send the message to the physical switch. Or a virtual switch.
- the physical switch or virtual switch forwards the packet to the recipient of the packet, thereby realizing direct communication between the virtual machine and other virtual machines in the host or the external network of the host.
- pass-through means that the virtual machine manager in the host can be skipped and the physical network card can be directly provided to the virtual instance to improve the I/O performance of the virtual instance.
- the physical network card can also contain switching equipment with switching functions.
- the switching device is, for example, a virtual switch (open virtual switch, OVS).
- OVS open virtual switch
- the switching device forwards data packets according to the MAC table and is responsible for forwarding data packets between PF, VF and the physical network port of the physical network card, that is, it can transmit traffic between virtual instances and realize communication between the virtual machine and the external network.
- the network card is the physical network card set in the physical machine.
- the network card is the VF network card or PF network card assigned to the virtual device. That is to say, the network card in this embodiment refers to a network card that performs functions such as packet encapsulation, sending and receiving based on the physical resources of the physical network card.
- the virtual switch in the physical network card, the virtual network card or virtual switch virtualized in the operating system of the host or virtual machine, and the VF network card driver or PF network card driver in the host or virtual machine do not belong to the network cards described in this application.
- the network card connected to the end-side device does not refer to the physical network card where the corresponding PF network card or VF network card is located, but refers to the PF network card or VF network card connected to the end-side device. That is, the network card in this embodiment uniquely corresponds to one end-side device, and one end-side device can be assigned at least one network card, so that end-to-end network isolation can be accurately achieved.
- the trusted path includes, for example, the path of configuring NPI for the network card from the network side.
- Figure 4 is a schematic structural diagram of another embodiment of the network isolation system provided by this application.
- the network isolation system also includes network management equipment.
- Network management equipment is used to manage and control network devices.
- the network management device is connected to some or all network devices, so that it can deliver management messages to the network devices in the network. After obtaining the NPI allocation information of the network partition, the network management device distributes the NPI allocation information to the corresponding edge network device, and the edge network device further configures the NPI for the network card.
- the NPI allocation information includes, for example, configuration information of network cards connected to multiple end-side devices.
- the configuration information of each network card includes, for example, the address information of the network card and the assigned NPI.
- the address information includes, for example, at least one of an IP address, a link layer address, and the like.
- the network management device determines the edge network device connected to each network card based on the network topology and address information, and sends the configuration information of the network card to the corresponding edge network device.
- the edge network device generates a control message for configuring NPI for the network card based on the configuration information of the network card.
- the control message includes the link layer address and NPI of the network card.
- the network card receives and identifies the control message, obtains and saves the NPI in the control message, thereby completing the NPI configuration.
- the control message does not include the IP address, so that after receiving the control message, the network card can recognize that the control message is not a service message, so that the control message will not be sent to the end-side device. Complete NPI configuration under awareness. Since the edge network device sends the control message to the network card, the control message does not need to be forwarded by other network devices. Therefore, even if the control message does not contain the IP address of the network card, the control message can still be sent to the network card, and it can ensure that the control message can be sent safely to network card without being intercepted by a third party.
- network device 1 to network device 4 are edge network devices.
- Network device 1 to network device 4 respectively receive NPI allocation information from the network management device.
- Network device 1 assigns the NPI value 0 to network card 1 based on the configuration information of network card 1. Encapsulate it into a control message used to configure network card 1, and then send the control message to network card 1.
- Network device 1 also encapsulates the NPI value 1 assigned by network card 2 into a control message used to configure network card 2 based on the configuration information of network card 2, and then sends the control message to network card 2. The same goes for other network devices.
- the network management device can send the configuration information to the edge network device through an out-of-band network (the network connected by the dotted line in Figure 4).
- Send the configuration information of the network card, and the edge network device completes the NPI configuration of the network card based on the configuration information.
- the out-of-band network is independent of the business data network that carries business data flows, and the two transmit information through different channels. Therefore, the configuration information of the network card is delivered to the edge network device through the out-of-band network and does not share the same channel with the business data flow. This can avoid configuration information packet loss caused by business data network congestion and improve the transmission efficiency of the network card configuration information. reliability.
- Network devices include, for example, a baseboard management controller (BMC), which can provide independent physical ports (hereinafter referred to as out-of-band ports).
- BMC baseboard management controller
- the out-of-band ports of each network device are connected to the network management device through the transmission medium to form an out-of-band network. This allows network devices to be controlled and managed through the out-of-band network.
- the host includes a BMC
- the network management device can deliver the configuration information of the network card through an out-of-band network connected to the host BMC.
- the BMC in the host receives the configuration information of the network card, it sends the configuration information to the corresponding network card, so that the network card completes the NPI configuration according to the configuration information.
- the network card After completing the configuration of the network card's NPI, when the network card sends a message through the network, it adds its own configured NPI to the message header of the message to obtain the target message.
- the header of the target packet includes the link layer header and the IP network header.
- NPI is located in the link layer header or IP network header.
- the network card receives the target message transmitted through the network device, it obtains the NPI in the message header, compares the NPI in the message header with its own configured NPI, and strips the NPI in the message header if they are consistent. NPI, the NPI-stripped target packet will be sent to the connected end-side device. If it is inconsistent, the target packet will be discarded, thereby achieving traffic isolation between end-side devices in different network partitions.
- the network device retains the NPI in the packet header when forwarding the target packet, so that the NPI in the packet header can follow the target packet and be transmitted from the source network card that sends the target packet.
- the NPI is carried end-to-end in the target packet, and the NPI is transparently transmitted in the IP network.
- the target message sent by the network card only includes a single-layer header, that is, the target message includes a single-layer link layer header and a single-layer IP network header.
- the network card does not need to add an outer header to the message. , just add the self-configured NPI to the message header. The operation is simple and efficient.
- the NPI in the target packet is added by the network card. There is no need for the network device to add NPI to the target packet, which can improve the forwarding performance of the network device.
- the NPI in this embodiment is not used for forwarding, that is, there is no need to perform complex configurations for the network device, and the network device does not need to learn and establish NPI-related forwarding entries.
- a network device forwards a target packet carrying NPI, it does not need to determine the forwarding port and path based on the NPI.
- the network device can forward the target packet based on the destination address information in the header of the target packet.
- the network device forwards the target packet.
- the operation is simple and the forwarding efficiency is high.
- This embodiment implements end-to-end network isolation through the end-side network card.
- the target packet with NPI added in the packet header can be forwarded by the network device like a regular IP packet, without the need for the network device to encapsulate and strip the target packet.
- the tunnel encapsulation header used for network isolation can improve the forwarding performance of target packets in the network.
- the network card that adds NPI to the packet header is the network card connected to the end-side device. The network card works at the link layer and physical layer, so adding NPI to the packet header will not be sensed by the end-side device. NPI is located in the packet header. There is no need to obtain the NPI in the packet through the operating system of the end-side device.
- the network card can directly obtain the NPI from the packet, thereby ensuring that the NPI is invisible to the end-side device and ensuring NPI security. Believable.
- the configuration and usage environment of NPI are safe and reliable. Therefore, the network isolation based on NPI is also safe and reliable. In the scenario of large-scale IP network isolation, the solution provided in this embodiment can achieve safe and reliable network isolation without the need for complex configuration of network devices or the need to add hardware firewalls, which is simple to implement and lower in cost.
- Figure 5 is a flow chart of an embodiment of the network isolation method provided by this application.
- the network isolation method in this embodiment is based on the above-mentioned network isolation system.
- the source device in Figure 5 is the end-side device that sends the target message
- the destination device is the end-side device that receives the target message.
- the source network card is the network card connected to the source end
- the destination network card is the network card connected to the destination end.
- the source network card and the destination network card are connected through network devices.
- the source device and the destination device may be end-side devices of the same type or different types of end-side devices.
- the source device can be a virtual machine, and the destination device can be a physical machine, etc., which can be determined according to the actual situation, and is not limited here in this application.
- the source device and the destination device can be virtual devices located in the same host, and the network device can include a virtual switch in the physical network card where the source network card and the destination network card are located. If the IP addresses of the source network card and the destination network card belong to the same IP network segment , the target packet can be forwarded by the virtual switch; if the IP addresses of the source network card and the destination network card belong to different IP networks segment, the network equipment includes Layer 3 network equipment (Layer 3 switches or routers, etc.), and the Layer 3 network equipment participates in the forwarding of target packets. If the source device and the destination device are located on different hosts, the network device includes at least one physical switch or physical router. The steps of this embodiment are as follows:
- the source network card processes the data to be sent and obtains the target message.
- the header of the target message includes the first NPI added by the source network card.
- the first NPI is the NPI configured on the source network card.
- the target message in this embodiment only includes a single-layer message header, and there is no need to add a tunnel encapsulation header for network isolation to the data to be sent.
- the message header of the target message includes a single-layer link layer header and a single-layer IP network header.
- the source IP address in the IP network header is the IP address of the source network card
- the destination IP address is the IP address of the destination network card.
- the source physical address in the link layer header is the physical address of the source network card
- the destination physical address is the physical address of the gateway (when the source network card and the destination network card are deployed on the same IP network segment and require Layer 3 forwarding), or the physical address of the destination network card. (When Layer 3 forwarding is not required).
- the message header of the target message also includes a network partition identification field, and the network partition identification field is used to carry the first NPI.
- the network partition identification field can be located in the link layer header or the IP network header.
- Figure 6 is a schematic diagram of the message structure of a target message provided by this application
- Figure 7 is a schematic diagram of the message structure of another target message provided by this application.
- the target message also includes the upper layer protocol header and payload.
- the upper layer protocol header includes, for example, a TCP header or a UDP header. Payloads are used to carry application data.
- the network partition identification field is located in the link layer header.
- the network partition identification field is located in the IP network header.
- IPv6 Internet protocol version 6
- the IP network header is an IPv6 network header
- the network partition identification field can be located in the IPv6 extension header in the IPv6 network header.
- the source network card can be a TCP/IP network card or a remote direct memory access (RDMA) network card.
- RDMA remote direct memory access
- the data to be sent is the original packet from the source device that has been encapsulated with a packet header.
- the header of the original packet is called the original packet header below.
- the original message header includes link layer header and IP network header. Since the first NPI is not visible to the source device, the first NPI does not exist in the original packet header.
- the source network card processes the data to be sent. Specifically, the source network card modifies the original message header and adds the first NPI to the link layer header or IP network header of the original message header, thereby obtaining the target message.
- the target packet includes the payload of the original packet and the packet header with the first NPI added.
- the source network card When the source network card is an RDMA network card, the source network card obtains the data to be sent from the storage space of the source device through direct memory access (DMA). The process of the source network card obtaining the data to be sent does not need to go through the source device. Operating system and protocol stack, therefore, the data to be sent is unencapsulated application data from the source device, and the source network card needs to encapsulate the data to be sent according to the TCP/IP protocol.
- the source network card processes the data to be sent. Specifically, the source network card encapsulates the message header including the first NPI for the data to be sent, and obtains the target message. The data to be sent is carried in the payload field in the target message of Figure 6 or Figure 7. When the source network card encapsulates the message header for the data to be sent, it simultaneously adds the first NPI to the message header, resulting in high encapsulation processing efficiency and small delay.
- the length of the network partition identification field can be 14 bits, 16 bits, 18 bits, 20 bits or 24 bits, etc. Therefore, more network partition identifiers can be provided and can be applied to large-scale IP network isolation.
- this embodiment greatly simplifies the packet format, thereby making the NPI encapsulation operation simpler and more controllable. It reduces the length of the message header and does not significantly affect network bandwidth utilization and data transmission efficiency.
- the header of the target packet may also add a field for identifying the target packet.
- the target message of this application still has a shorter length and a simpler encapsulation method.
- S502 The source network card sends the target packet to the network device.
- S503 The network device forwards the target packet to the destination network card.
- the network device forwards the target packet to the destination network card based on the address information in the packet header of the target packet.
- the address information in the packet header includes, for example, the destination physical address in the link layer header and the destination IP address in the IP network header.
- the network device can forward the target packet based on the destination physical address.
- the network device needs to forward the target packet based on the destination IP address. That is to say, when the network device forwards the target packet, it does not encapsulate the target packet with another layer of tunnel encapsulation header for network isolation to forward the target packet based on the address information in the tunnel encapsulation header. Forwarding is performed directly based on the address information in the header of the target packet. Since the target packet is an IP packet, the network device is Devices in the IP network can realize the transmission of the target packet across IP network segments and across link layer networks based on the address information in the header of the target packet.
- the network device does not process the first NPI in the target packet, but forwards the target packet according to the address information in the packet header like a conventional IP packet. That is, the first NPI is in the IP packet. Transparent transmission in the network.
- the NPI in this embodiment can only be used for network isolation and does not participate in forwarding.
- the network device does not need to establish a forwarding path table entry related to the first NPI, nor does it need to forward the report based on the first NPI lookup table.
- the network device only needs to forward the report.
- the target packet carrying the first NPI in the header can be forwarded as a normal IP packet, and the network device does not need to perform operations such as modifying and replacing the NPI for the target packet, which can improve the forwarding performance of the network device.
- the network equipment When the target packet needs to be forwarded at Layer 3, the network equipment includes Layer 3 network equipment. If the first NPI is located in the link layer header, since Layer 3 forwarding requires replacing the original link layer header of the target packet with a new link layer header, the Layer 3 network device inherits the original link layer header when replacing the link layer header. The first NPI in the link layer header is added to the new link layer header, thereby ensuring that the first NPI is retained during forwarding by the network device and realizing end-to-end portability of the first NPI.
- the destination network card obtains the first NPI in the header of the target packet.
- the destination network card After receiving the target message, the destination network card obtains the first NPI from the network partition identification field in the message header.
- the destination network card determines whether the first NPI and the second NPI are the same, and the second NPI is the NPI configured by the destination network card.
- the destination network card After the destination network card obtains the first NPI, it compares the first NPI with the second NPI configured on itself. If the first NPI and the second NPI are the same, it means that the source device and the destination device sending the target message belong to the same network partition, and communication is allowed between the source device and the destination device, and then S506 is executed. If the first NPI and the second NPI are different, it means that the source device and the destination device sending the message do not belong to the same network partition, and communication is not allowed between the source device and the destination device, and then S508 is executed.
- S506 The destination network card strips off the first NPI in the packet header.
- the destination network card In order to prevent the first NPI in the target packet from being sent to the destination device, causing the first NPI to be exposed to the end-side device, and the existence of the first NPI causing the destination device to fail to decode, the destination network card is sending the target packet to the destination device. Before sending the message, strip off the first NPI in the header of the target message.
- the destination network card is a TCP/IP network card
- the destination network card only needs to strip off the first NPI in the target packet.
- the destination network card When the destination network card is an RDMA network card, the destination network card strips the message header of the target packet to realize the stripping of the first NPI.
- the target packet from which the first NPI is stripped is application data excluding the packet header.
- the destination network card sends the target packet with the first NPI stripped to the destination.
- the destination network card After the destination network card performs operations such as NPI stripping on the target packet, it sends the target packet with the first NPI stripped to the destination end to complete the transmission of the target packet.
- the destination network card discards the destination packet.
- the target packet will not be sent to the destination device, so that traffic between end-side devices in different network partitions cannot be communicated, thereby achieving network isolation.
- the source network card adds the first NPI to the data to be sent, obtains the target message including the first NPI in the message header, and sends the target message to the destination device through the network device, and the network device forwards the target message.
- the first NPI in the message header is retained when sending the message, so that the destination network card can obtain the first NPI after receiving the target message, and when the first NPI is the same as the second NPI configured by the destination network card, the target network card is released.
- message send it to the destination device, or discard the destination message when the first NPI is different from the second NPI configured on the destination network card.
- Effective, reliable and secure network isolation is achieved with low data plane overhead and cost. Compared with other current network isolation technologies, it improves the forwarding performance and bandwidth utilization of network equipment while ensuring the safety and effectiveness of network isolation, and can be applied to large-scale IP network isolation.
- network isolation is achieved by only using the network card to determine whether the NPI in the target message is consistent with its own NPI.
- This application also provides a second embodiment of the network isolation method.
- the difference from the first embodiment of the network isolation method is that in the second embodiment of the network isolation method, the edge network device connected to the network card can also check the NPI in the passing target packet. If the NPI is allowed to pass, the corresponding target packet is released. When the NPI in the packet is not an allowed NPI, the corresponding target packet is discarded to assist the network card in filtering attack traffic.
- Figure 8 is a schematic flow chart of the second embodiment of the network isolation method provided by this application. This embodiment includes follow these steps:
- the source network card processes the data to be sent and obtains the target message.
- the header of the target message includes the first NPI added by the source network card.
- S802 The source network card sends the target packet to the first edge network device.
- the first edge network device is a physical network device connected to the source network card.
- S801 to S802 are similar to those of S501 to S502, so they will not be described again here.
- the first edge network device obtains the first NPI in the message header of the target message.
- the first edge network device determines whether the first NPI is an allowed NPI.
- the first port through which the first edge network device is connected to the source network card is configured with at least one allowed NPI.
- the first NPI is among at least one NPI that is allowed to pass, it is confirmed that the first NPI is an NPI that is allowed to pass, otherwise it is an NPI that is not allowed to pass.
- the source device is a physical machine, or the network cards connected to the virtual machine or container on the host where the source device is located are all configured with the same NPI
- the first port can be configured with an NPI that is allowed to pass, that is, the first NPI.
- the first port can be configured with multiple The NPIs allowed to pass, the NPIs allowed to pass through the first port may include the NPIs of all network cards connected to the first port.
- the first NPI does not belong to the NPI that is allowed to pass, which means that the first NPI is not the NPI configured by the network management device or the network administrator for the source network card, and the target packet will not be forwarded to the destination network card by the first edge network device.
- one port of the edge network device is only connected to the physical network port of one physical network card.
- the physical network port of the physical network card is virtualized into at least one PF network card and multiple VF network cards, these PF network cards and VF network cards share the physical network port of the physical network card and the port connection of the first edge network device. Therefore, it appears that one port of the edge network device is connected to at least one PF network card or multiple VF network cards.
- one port of the edge network device can be configured with multiple NPIs that are allowed to pass.
- the first edge network device determines whether the target packet is allowed to pass by checking the NPI in the packet header. This can ensure that even if the NPI is maliciously tampered with, the first edge switch can sense such anomalies and ensure that abnormal target packets will not pass through the network. transmitted to the destination device, thereby improving network security.
- S805 The first edge network device discards the target packet.
- S806 The first edge network device forwards the target packet to the destination network card according to the address information in the packet header of the target packet.
- the second edge network device obtains the first NPI in the message header of the target message.
- the second edge network device is a physical network device connected to the destination network card. Before the target packet reaches the destination network card, it needs to be forwarded by the second edge network device. After receiving the target packet, the second edge network device further obtains the first NPI in the network partition identification field in the packet header of the target packet. According to the first NPI determines whether the target packet needs to be forwarded to the destination network card. If the source device and the destination device are connected to the same edge network device, then the first edge network device and the second edge network device are the same network device. Otherwise, the first edge network device and the second edge network device are different network devices.
- S808 The second edge network device determines whether the first NPI is an allowed NPI.
- the second port through which the second edge network device is connected to the destination network card is configured with at least one NPI that allows passage.
- the first NPI is among at least one NPI that is allowed to pass, it is confirmed that the first NPI is an NPI that is allowed to pass, otherwise it is an NPI that is not allowed to pass.
- the second port can be configured with an NPI that is allowed to pass, and the NPI can be configured for the destination network card.
- the first NPI is an allowed NPI, it means that the first NPI is the same as the NPI configured on the destination network card, and the second edge network device can release the destination packet.
- the first NPI is not an allowed NPI, it means that the first NPI is different from the NPI configured on the destination network card.
- the source device and the destination device do not belong to the same network partition. The traffic between the two should be isolated.
- the second edge network device Do not forward the target packet to the destination network card.
- the second port can be configured with multiple NPIs.
- NPIs allowed to pass the NPIs allowed to pass on the second port may include NPIs of all network cards connected to the second edge network device.
- the first NPI is the NPI allowed to pass through the second port. This means that among the VF network cards and PF network cards corresponding to the physical network port of the physical network card connected to the second port, there is an NPI configured by the network card that is the same as the first NPI. It can be Forward the target packet to the destination network card.
- the network card makes the decision. If the first NPI is not an NPI allowed by the second port, it means that among the VF network cards and PF network cards corresponding to the physical network port of the physical network card connected to the second port, there is no NPI configured by the network card that is the same as the first NPI, that is, Among all end-side devices, including the destination device, connected to the physical network port of the physical network card, there is no end-side device that belongs to the same network partition as the source device, and the second edge network device does not forward the target packet to the destination network card. , thereby achieving traffic isolation between different network partitions.
- S809 The second edge network device discards the target packet.
- the second edge network device discards the target packet to achieve traffic isolation between different network partitions.
- the second edge network device can also perform error statistics based on obtaining relevant information in the packet to obtain error statistics.
- the analysis-related information includes, for example, at least one of the physical address of the destination network card, the IP address of the destination network card, the physical address of the source network card, the IP address of the source network card, the port number, and the message reception time. Error statistics can be used to analyze the causes and frequency of errors, etc., and then perform related processing.
- S810 The second edge network device forwards the target packet to the destination network card according to the address information in the packet header of the target packet.
- the destination network card obtains the first NPI in the message header.
- the destination network card determines whether the first NPI and the second NPI are the same, and the second NPI is the NPI configured by the destination network card.
- the destination network card can also obtain error statistics based on relevant information obtained from the target packet. You can refer to the relevant description of S809 and will not go into details here.
- S814 The destination network card strips off the first NPI in the packet header.
- S815 The destination network card sends the target packet with the first NPI stripped to the destination device.
- S811 to S815 are similar to the contents of S504 to S508 in the second embodiment of the network isolation method, so they will not be described again here.
- S803 to S805 are optional steps, or S807 to S809 are optional steps, and this application does not limit this.
- the edge network device determines whether to forward the target packet to the destination network card by determining whether the first NPI in the header of the target packet is an allowed NPI, and screens the target packet on the network side. , thereby assisting the destination network card in isolating abnormal traffic and reducing the risk of the destination network card being unable to work properly when it is attacked.
- the network isolation solution of this application can be used for network isolation in various scenarios, such as isolation between physical machines, isolation between virtual machines or containers, and isolation between network logical planes.
- network isolation can also be performed between at least two of the physical machines, virtual machines, and containers through the network isolation solution provided by this application.
- IP protocol is used for communication in the following scenarios, and the messages during the communication process are all the above target messages.
- network isolation can be performed at the granularity of the physical machine.
- Figure 9 is a schematic diagram of an application scenario of the network isolation method provided by this application.
- the end-side devices include host 1 to host 4, and the network devices include network device 1 and network device 2.
- Host 1 to host 4 are all independent physical machines.
- Host 1 and host 3 are connected to port 1 and port 2 of network device 1 respectively, and host 2 and host 4 are connected to port 3 and port 4 of network device 2 respectively.
- Network device 1 is the edge network device of host 1 and host 3
- network device 2 is the edge network device of host 2 and host 4.
- Network device 1 and network device 2 are connected directly or through other network devices.
- the NPI configured for physical network card 1 connected to host 1 is 2 (for the convenience of understanding, the NPI is given in decimal as an example here), the NPI configured for physical network card 2 connected to host 2 is 2, and the NPI configured for physical network card 3 connected to host 3 is 3.
- the NPI configured for physical network card 4 connected to host 4 is 3. That is, host 1 and host 2 belong to the same network partition, and host 3 and host 4 belong to the same network partition. Host 1 and host 2 do not belong to the same network partition as host 3 and host 4.
- each physical network card After each physical network card adds its own configured NPI to the NPI field in the packet header, it sends the packet to the destination through the network device.
- the NPI field carried in the packet header of the packet sent by physical network card 1 is 2
- the NPI carried in the NPI field of the packet header of the packet sent by physical network card 2 is 2
- the NPI carried in the NPI field of the packet header sent by physical network card 3 is 2.
- the NPI carried in the NPI field of the packet header is 3.
- the NPI carried in the NPI field of the packet sent by physical network card 4 is 3.
- Physical network card 2 receives the message sent from physical network card 1, and obtains that the value of the network partition identification field in the message header of the message is 2, which is consistent with its own configured NPI. Then physical network card 2 passes the message. , process the message (with NPI removed, the same below) and send it to host 1.
- Physical network card 4 receives the message sent from physical network card 3, and obtains that the value of the network partition identification field in the message header of the message is 3, which is consistent with its own configured NPI. Then physical network card 4 passes the message. , process the message and send it to host 4. If physical NIC 2 receives a packet from physical NIC 3 and obtains that the value of the network partition identification field in the packet header is 3, which is inconsistent with its configured NPI, physical NIC 2 discards the packet.
- the port of the network device can be configured with the same NPI as the connected physical network card as the NPI allowed to pass through the port.
- Port 1 of network device 1 is configured to allow the NPI to be passed to 2, which is the NPI of physical network card 1.
- Port 2 is configured to allow the NPI to be passed to 3, which is the NPI of physical network card 3.
- Port 2 of network device 2 is configured with an allowed NPI of 2, which is the NPI of physical network card 2.
- Port 4 is configured with an allowed NPI of 3, which is the NPI of physical network card 4.
- Network device 1 obtains the NPI from the network partition identification field of the packet header. When the value of the network partition identification field of the packet that needs to pass through port 1 is 2, the packet is allowed to pass; otherwise, the packet is discarded and the port 2Similarly.
- the inspection method of network device 2 is the same and will not be described again here. Therefore, network equipment can assist the network card in screening network traffic, which can reduce the burden on the network card when a traffic attack occurs.
- the network can be divided into multiple logical planes, such as management plane, storage plane and service plane.
- the management plane is used for the management of virtual machines, containers or physical machines
- the storage plane is used for virtual machines, containers or physical machines to access storage resources
- the business plane is used for the exchange of business data.
- the three logical planes need to be isolated from each other.
- Network logical planes can be hosted in physical machines, virtual machines or containers to achieve isolation of computing resources or storage resources between network logical planes.
- the network card connected to the network logical plane can be a physical network card, a VF network card, or a PF network card.
- Figure 10 is a schematic diagram of another application scenario of the network isolation method provided by this application.
- the NPI configured for PF network card 1 connected to the management plane of host 5 is 4, the NPI configured for PF network card 2 connected to the storage plane is 5, and the NPI configured for PF network card 3 connected to the service plane is 6.
- the NPI configured for PF network card 4 connected to the management plane of host 6 is 4, the NPI configured for PF network card 5 connected to the storage plane is 5, and the NPI configured for PF network card 6 connected to the service plane is 6.
- Host 7 is a management server, occupying an entire physical machine and belonging to the management plane.
- the NPI configured for the physical network card 7 connected to Host 7 is 4.
- Host 8 is a storage server, occupies an entire physical machine, and belongs to the storage plane.
- the NPI configured for the physical network card 8 connected to host 8 is 5. That is, the same network logical plane belongs to the same network partition, and different network logical planes belong to different network partitions, thereby achieving isolation between network logical planes.
- PF network cards 1 to 6 and physical network cards 7 to 8 add their own configured NPI to the network partition identification field in the message header of the outgoing message, and check the NPI in the message and their own configured NPI when receiving the message from the network. Whether the NPI is consistent. If the NPI is consistent, it means that the packet comes from the same logical plane, and the packet can be forwarded to the corresponding network logical plane. If it is inconsistent, it means that the packet comes from different logical planes, and the packet is discarded. For example, PF network card 1 receives a packet from physical network card 7, and obtains the value of the network partition identification field in the header of the packet as 4, which is the same as the NPI configured in physical network card 7, indicating that the packet comes from the management plane.
- the packet can be passed, and physical network card 7 processes the packet and sends it to the management plane of host 5.
- Physical NIC 8 receives the packet from PF NIC 2 and obtains the value of the network partition identification field in the header of the packet as 5, which is the same as the NPI configured in physical NIC 8. This indicates that the packet comes from the storage plane and can be passed through This message is processed by physical network card 8 and then sent to host 8.
- Physical NIC 7 receives the packet from PF NIC 3, and obtains the value of the network partition identification field in the header of the packet as 6, which is different from the NPI configured in physical NIC 7, indicating that the packet comes from other network logical planes. , physical network card 7 discards the packet.
- the port of the network device can be configured with an NPI list.
- the NPIs in the NPI list are the NPIs that are allowed to pass through the port.
- the NPIs in the NPI list include the NPIs configured on all PF network cards connected to it, or the NPIs configured on the physical network cards connected to it.
- the NPI list configured on port 5 of network device 3 includes 4, 5, and 6, that is, the NPIs of PF network card 1, PF network card 2, and PF network card 3.
- the NPI list configured on port 6 includes 4, 5, and 6, that is, the NPIs of PF network card 4, PF network card 4, and PF network card 3. NPI of PF NIC 5 and PF NIC 6.
- Port 7 of network device 4 is configured with an allowed NPI of 4, which is the NPI of physical network card 7.
- Port 8 is configured with an allowed NPI of 5, which is the NPI of physical network card 8.
- Network device 3 obtains the NPI from the network partition identification field of the packet header. When the value of the network partition identification field of the packet that needs to pass through port 5 is 4, 5 or 6, the packet is allowed to pass, otherwise it is discarded. For packets, the same applies to port 6.
- the inspection method of network device 4 is the same and will not be described again here.
- Virtual machines in the data center belong to multiple tenants, and virtual machines of different tenants need to be isolated. Therefore, virtual machines belonging to the same tenant can be divided into the same network partition, and virtual machines from different tenants can be divided into different network partitions. This achieves isolation between virtual machines of different tenants. Moreover, regardless of whether the virtual machines are located on the same host, isolation can be achieved through the network isolation solution provided by this application.
- Figure 11 is a schematic diagram of another application scenario of the network isolation method provided by this application.
- host 9 includes virtual machine 1 and virtual machine 2.
- Virtual machine 1 is bound to VF network card 1
- virtual machine 2 is bound to VF network card 2.
- Host 10 includes virtual machine 3 and virtual machine 4.
- Virtual machine 3 is bound to VF network card 3, and virtual machine 4 is bound to VF network card 4.
- Host 10 includes virtual machine 5 and virtual machine 6.
- Virtual machine 5 is bound to VF network card 5
- virtual machine 6 is bound to VF network card 6.
- Virtual machine 1 and virtual machine 3 belong to tenant 1. These two virtual machines are divided into the same network partition and the assigned NPI is 7. Then the NPI of VF network card 1 and VF network card 3 are both configured as 7. Virtual machine 2, virtual machine 4 and virtual machine 6 belong to tenant 2. These three virtual machines are divided into the same network partition and the assigned NPI is 8. Then the NPI of VF network card 2, VF network card 4 and VF network card 6 are all configured as 8. . Virtual machine 5 belongs to tenant 3 and is also divided into a network partition. The assigned NPI is 9, and the NPI configured for VF network card 5 is 9.
- VF network cards 1 to 6 add their own configured NPI in the network partition identification field in the message header of the outgoing packets, and when receiving the packet from the network, check whether the NPI in it is consistent with its own configured NPI. If they are consistent, the If the packet comes from the same network partition, that is, the same tenant, the packet can be forwarded to the corresponding virtual machine. If the packet is inconsistent, it means that it comes from different network partitions, and the packet will be discarded. This achieves network isolation between different tenants. For example, VF network card 1 receives a packet from VF network card 2.
- VF network card 1 obtains the value of the network partition identification field in the header of the packet as 8, which is different from the NPI configured by VF network card 1, indicating that the packet comes from Different tenants, VF network card 1 discards the packet.
- VF network card 6 receives the packet from VF network card 4.
- VF network card 6 obtains the value of the network partition identification field in the header of the packet as 8, which is the same as the NPI configured in VF network card 6, indicating that the packet comes from the same tenant. , through this message, the VF network card 6 processes the message and sends it to the virtual machine 6 .
- the port of the network device can be configured with an NPI list.
- the NPIs in the NPI list are the NPIs that are allowed to pass through the port.
- the NPIs in the NPI list include the NPIs configured for all VF network cards connected to it.
- the NPI list configured on port 9 of network device 5 includes 7 and 8, that is, the NPIs of VF network card 1 and VF network card 2.
- the NPI list configured on port 10 includes 7 and 8, that is, the NPIs of VF network card 1 and VF network card 2.
- the NPI list configured on port 11 of network device 6 includes 8 and 9, that is, the NPIs of VF network card 5 and VF network card 6.
- Network device 6 obtains the NPI from the network partition identification field of the packet header. When the value of the network partition identification field of the packet that needs to pass through port 9 is 7 or 8, the packet is allowed to pass, otherwise the packet is discarded. , the same applies to port 10.
- the inspection method of network device 6 is the same and will
- the source network card that sends the message adds its own configured NPI in the message, and the destination network card that receives the message compares the NPI in the message with its own configured NPI. If they are consistent, the message is passed, and if they are inconsistent, the message is discarded. It ensures traffic intercommunication within the same network partition and traffic isolation between different network partitions.
- the network card can achieve the purpose of network isolation by performing simple operations. There is no need for network equipment to perform tunnel matching, add tunnel encapsulation headers to packets due to network isolation, and Complex isolation operations such as stripping tunnel encapsulation headers do not require network equipment to implement isolation functions such as firewalls, which can reduce the hardware complexity of network equipment and improve the forwarding performance of network equipment.
- FIG. 12 is a schematic structural diagram of an embodiment of a network card provided by this application.
- the network card 1200 described in this embodiment is a network card that implements message sending and receiving and first NPI stripping processing based on the physical resources of the physical network card.
- the network card 1200 includes a storage module 1201, a transceiver module 1202 and a processing module 1203.
- the storage module 1201 is used to store the second network partition identifier configured by the network card.
- the transceiver module 1202 is configured to receive a target message forwarded by a network device in the IP network.
- the target message includes a single-layer message header, and the message header includes the first NPI added by the network card that sends the target message.
- the first NPI is The NPI configured on the network card that sends the target packet.
- the processing module 1203 is configured to obtain the first NPI in the message header, and discard the target message when the first NPI is different from the second NPI.
- the first NPI and the second NPI are invisible to the end-side device connected to the transceiver module 1202 .
- the processing module 1203 is also configured to strip the first NPI from the header of the target packet when the first NPI and the second NPI are the same.
- the transceiver module 1203 is also configured to send the target message stripped of the first NPI to the end-side device connected to the transceiver module 1202.
- the transceiver module 1202 is also configured to receive a second control message from a second edge network device among the network devices.
- the second edge network device is a device connected to the transceiver module 1202.
- the second control message The message includes the second NPI, and the second control message is generated by the second edge network device after receiving the second NPI from the network management device.
- the processing module 1203 is also configured to configure the second NPI according to the second control message.
- the network card is a physical network card, and the end-side device connected to the network card is a physical machine; or the network card is a VF network card or PF network card that passes through the end-side device, and the end-side device is a virtual machine or container.
- the processing module 1203 in this embodiment does not only perform the above processing on target packets from other network cards.
- the processing module 1203 can also process the data to be sent from the end-side device connected to the network card 1200 to obtain a message including the second NPI in the message header, and then send it to the data through the transceiver module 1203 and the network device. The destination of the message is sent.
- FIG. 13 is a schematic structural diagram of an embodiment of a network card provided by this application.
- the network card 1300 described in this embodiment is a network card that implements message sending and receiving and first NPI addition processing based on the physical resources of the physical network card.
- the network card 1300 includes a storage module 1301, a transceiver module 1302 and a processing module 1303.
- the storage module 1301 is used to store the first network partition identifier configured by the network card.
- the processing module 1303 is configured to process the data to be sent to obtain a second target message.
- the second target message includes a single-layer message header, and the message header includes a second network partition identifier added by the processing module.
- the transceiver module 1302 is configured to send the target message through the network device in the IP network, so that the network card receiving the target message discards it when the second network partition identifier is different from the first network partition identifier in the header of the target message.
- the second network partition identifier is the network partition identifier configured on the network card that receives the target message.
- the second network partition identifier is located in the link layer header.
- the data to be sent is application data that has not been encapsulated.
- the processing module 1303 is configured to encapsulate the message header including the first network partition identifier for the data to be sent, and obtain the target message.
- the data to be sent includes an original message header, and the original message header does not include the first network partition identifier.
- the processing module 1303 is used to insert the first network partition identifier into the original message header to obtain the target message.
- the message header of the target message includes a link layer header and an IP network header, and the first network partition identifier is located in the link layer header or the IP network header.
- the transceiver module 1302 is also configured to receive a control message from an edge network device among the network devices.
- the edge network device is a network device connected to the transceiver module 1302.
- the control message includes the first network partition.
- the identification and control message are generated after the edge network device receives the first network partition identification from the network management device.
- the processing module 1303 is also configured to configure the first network partition identifier according to the control message.
- the network card is a physical network card, and the end-side device connected to the network card is a physical machine; or the network card is a VF network card or PF network card that passes through the end-side device, and the end-side device is a virtual machine or container.
- the processing module 1303 in this embodiment does not only perform the above-mentioned processing on the incoming data to be sent.
- the processing module 1303 can also obtain the NPI in the message header of the message, and The NPI is compared with its own second NPI. If they are consistent, the NPI in the message is stripped and sent to the end-side device connected to the network card 1300. If they are inconsistent, the message is discarded.
- FIG. 14 is a schematic structural diagram of an embodiment of a network device provided by this application.
- the network device 1400 includes a transceiver module 1401.
- the transceiver module 1401 is used to receive a target message sent by the source network card.
- the target message is obtained by processing the data to be sent by the source network card.
- the target message includes a single message header, and the message header includes the first network added by the source network card. Partition identifier.
- the first network partition identifier is the network partition identifier configured by the source network card.
- the transceiver module 1401 is also used to forward the target message to the destination network card according to the destination address information in the message header. When the network device forwards the target message, it retains the first network partition identifier in the message header, so that the destination network card receives the target message.
- the first network partition identifier is obtained from the message header, and when the first network partition identifier and the second network partition identifier are different, the target message is discarded.
- the second network partition identifier is the network partition identifier configured by the destination network card.
- the first network partition identifier is not used for forwarding the target packet.
- the network device 1400 is a first edge network device connected to the source network card, and the first edge network device further includes a processing module 1402.
- the processing module 1402 is used to obtain the first network partition identifier from the network management device.
- the processing module 1402 is configured to generate a first control message according to the first network partition identifier, where the first control message includes the first network partition identifier.
- the transceiver module 1401 is configured to send a first control message to the source network card, so that the source network card configures the first network partition identifier according to the first control message.
- the network device 1400 is a second edge network device connected to the destination network card.
- the second edge network device further includes a processing module 1402; the processing module 1402 is used to obtain the first network information from the network management device. Partition identification; a processing module, configured to generate a second control message according to the second network partition identification, where the second control message includes the second network partition identification.
- the transceiver module 1401 is configured to send a second control message to the source network card, so that the destination network card configures the second network partition identifier according to the second control message.
- the first control message and the second control message do not include the IP address.
- the network device 1400 is a first edge network device connected to the source network card, and the first edge network device further includes a processing module 1402.
- the processing module 1402 is used to obtain the first network partition identifier in the message header.
- the network device 1400 is a second edge network device connected to the destination network card, and the second edge network device further includes a processing module 1402 .
- the processing module 1402 is used to obtain the first network partition identifier in the message header.
- the processing module 1402 is configured to allow the transceiver module 1401 to forward the target message to the destination network card when the first network partition identifier is a network partition identifier that is allowed to pass, or to discard the target message when the first network partition identifier is not a network partition identifier that is allowed to pass. target message.
- the message header includes a link layer header and an IP network header
- the first network partition identifier is located in the link layer header or the IP network header.
- FIG 15 is a schematic structural diagram of another embodiment of a network device provided by this application.
- the network device 1500 includes a processor 1501 and a physical port 1502.
- the processor 1501 is connected to the physical port 1502.
- the physical port 1502 is used to receive and send target packets.
- the processor 1501 is used to execute instructions so that the network device performs the above-mentioned network isolation. The operation of the network device in the method.
- FIG 16 is a schematic structural diagram of another embodiment of a network card provided by this application.
- the network card 1600 includes a processor 1601 and a physical network port 1602.
- the processor 1601 is connected to the physical network port 1602.
- the physical network port 1602 is used to receive and send target messages.
- the processor 1601 is used to execute the destination network card in the above network isolation method. Or the operation of the source network card.
- Figure 17 is a schematic structural diagram of an embodiment of a computer device provided by this application.
- the computer device 1700 includes a processor 1701, a memory 1702, a communication bus 1703 and a network card 1704 as shown in Figure 12 or 15.
- the processor 1701, the memory 1702 and the network card 1704 are connected to each other through the communication bus 1703.
- the network card 1704 is a physical network card.
- the network card 1704 is configured with NPI.
- the data to be sent is processed to obtain a target message including the NPI of the network card in the message header.
- the network card sends the target packet to the destination side device of the target packet through the network device in the IP network. Therefore, the destination network card connected to the destination device can discard the destination packet when the NPI in the destination packet is inconsistent with its own configured NPI, thus achieving end-to-end network isolation.
- the network card 1704 when it receives a target packet from other end-side devices, it obtains the NPI from the packet header of the target packet, and compares the NPI in the packet header with its own configured NPI. If there is any inconsistency, Discard the target packet and isolate abnormal traffic to isolate data flows in different network partitions. When the NPI in the packet header is consistent with its own configured NPI, the network card 1704 strips off the NPI and then sends the target packet to the upper layer of the computer device 1700 to avoid exposing the NPI to tenants, causing NPI leakage and affecting network isolation. security.
- the network card 1704 can be virtualized into multiple VF network cards and PF network cards and directly connected to the virtual machine or container.
- VF network card/PF network card is configured with NPI for network isolation of pass-through virtual machines or containers.
- NPI for the network isolation method based on NPI, please refer to the above description, so I will not repeat it here.
- the end-to-end network isolation of this solution can simplify isolation operations, reduce packet processing delays, and network transmission delays while ensuring the safety and reliability of network isolation. It has better forwarding performance compared to encapsulation.
- the tunnel encapsulation header for network isolation achieves network isolation and can also save network bandwidth.
- This application also provides a computer-readable storage medium on which a computer program is stored.
- the computer program When executed by the network card, it implements related operations of the network card in the network isolation method of any of the above method embodiments.
- This application also provides a computer-readable storage medium on which a computer program is stored.
- the computer program When executed by a network device, it implements related operations of the network device in the network isolation method of any of the above method embodiments.
- the disclosed systems, devices and methods can be implemented in other ways.
- the device embodiments described above are only illustrative.
- the division of the units is only a logical function division. In actual implementation, there may be other division methods.
- multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented.
- the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical or other forms.
- the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
- each functional unit in each embodiment of the present application can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit.
- the above integrated units can be implemented in the form of hardware or software functional units.
- the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium.
- the computer software product is stored in a storage medium and includes a number of instructions to enable a computer device (which can be a personal computer, Server, or network device, etc.) executes all or part of the steps of the methods described in various embodiments of this application.
- the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), magnetic disk or optical disk and other media that can store program code. .
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
公开了一种网络隔离方法、***及相关设备,以降低网络隔离的复杂度。该***包括源网卡、目的网卡和网络设备。源网卡用于对待发送数据进行处理,得到目标报文,目标报文包括单层报文头,报文头中包括源网卡添加的第一网络分区标识,第一网络分区标识为源网卡所配置网络分区标识。源网卡还用于通过网络设备向目的网卡发送目标报文。网络设备用于向目的网卡转发目标报文。目的网卡,用于接收目标报文后获取报文头中的第一网络分区标识,并在第一网络分区标识与第二网络分区标识不同时,丢弃目标报文,第二网络分区标识为目的网卡所配置网络分区标识。
Description
本申请要求于2022年09月06日提交中国专利局、申请号为202211084978.1、发明名称为“网络隔离方法、***及相关设备”的中国专利申请的优先权,其全部内容通过引用结合在本申请中。
本申请涉及计算机网络技术领域,特别是涉及一种网络隔离方法、***及相关设备。
网络隔离是指把两个或两个以上的网络断开的基础上,实现数据交换的技术。主要是将有害的网络安全威胁隔离开,保障数据信息在安全的环境下进行资源共享。网络隔离技术通常分为物理隔离和逻辑隔离两类。物理隔离是在物理设备和物理连线上完全隔离的网络,需要至少建立多套硬件网络***,实现成本高,配置不灵活。逻辑隔离是在同一张物理网络上,静态或动态的配置隔离规则,使不同的组织/用户之间无法互访,成本更低,配置更加灵活。逻辑隔离由于其低成本、可灵活配置等特点,目前广泛应用于数据中心、企业和园区等场景中。
虚拟扩展局域网(virtual eXtensible LAN,VXLAN)是目前广泛使用的逻辑隔离技术。VXLAN是指在源端与目的端之间建立一条逻辑VXLAN隧道,VXLAN隧道端点(VXLAN tunnel end point,VTEP)将源端发出的原始以太报文完整地封装在UDP报文中,然后在外层使用物理网络的IP报文头和以太报文头封装。在报文进入VXLAN隧道时,使用原始以太报文的特征匹配找到外层隧道信息,达到隔离控制的目的。
然而,VXLAN中VTEP需要将报文封装为具有两层网络头的报文,或者将具有两层网络头的报文解封装,实现复杂,处理时延大,从而导致报文转发性能差。
发明内容
本申请提供了一种网络隔离方法、***及相关设备。以在保证网络隔离安全可靠的前提下,降低大规模IP网络隔离的复杂度和处理时延,提高网络隔离性能。
第一方面提供一种网络隔离***。该***包括与源端设备连接的源网卡、与目的端设备连接的目的网卡和网络设备,源网卡和目的网卡通过IP网络连接,网络设备为IP网络中的设备。源网卡,用于对待发送数据进行处理,得到目标报文,目标报文包括单层报文头,该报文头中包括源网卡添加的第一网络分区标识,第一网络分区标识为源网卡所配置网络分区标识。源网卡,还用于通过网络设备向目的网卡发送目标报文。网络设备,用于向根据报文头中的地址信息目的网卡转发目标报文。目的网卡,用于接收目标报文后获取目标报文的报文头中的第一网络分区标识,并在第一网络分区标识与第二网络分区标识不同时,丢弃目标报文,第二网络分区标识为目的网卡所配置网络分区标识。
源网卡在目标报文的报文头中添加第一网络分区标识的报文,网络设备在转发目标报文时保留第一网络分区标识,使第一网络分区标识端到端携带,使得目的网卡接收到目标报文后,能够根据目标报文中的第一网络分区标识与自身配置的第二网络分区标识是否一致确定是否丢弃该目标报文,实现端到端的网络隔离。目标报文仅包括单层报文头,报文格式简单,网卡在报文头中添加第一网络分区标识的操作简单,效率高,由于无需网络设备为目标报文添加用于网络隔离的隔离字段或隧道封装头,网络设备可以将携带第一网络分区标识的目标报文当做正常的IP报文进行转发,从而能够提升网络设备的转发性能、降低目标报文的处理时延以及降低网络隔离的复杂度。此外,网卡工作在物理层和数据链路层,为网卡配置的网络分区标识对租户不可见,租户不能篡改网络分区标识,保证网络分区标识安全可信。从而基于网络分区标识实现网络隔离能够保障网络隔离的安全性。
在一种可能实现的方式中,待发送数据为未进行封装处理的应用数据。源网卡,用于为待发送数据封装包括所述第一网络分区标识的报文头,得到目标报文。当待发送数据仅为应用数据而未被封装报文头时,源网卡为待发送数据封装报文头,报文头中包括第一网络分区标识,也即网卡在为待发送数据封装报文头时同步完成了第一网络分区标识的添加,操作简单,不需要因需要实现网络隔离而进行复杂的隧道匹配和
封装,从而降低报文的处理时延。
在一种可能实现的方式中,待发送数据包括原始报文头,原始报文头中不包括第一网络分区标识。源网卡,用于将第一网络分区标识***原始报文头中,得到目标报文。当待发送数据已包括原始报文头时,网卡将第一网络分区标识添加到原始报文头中,得到包括第一网络分区标识的报文头,从而得到了目标报文。网卡不需要因需要实现网络隔离而进行复杂的隧道匹配和封装,处理时延低。
在一种可能实现的方式中报文头包括链路层头和IP网络头,第一网络分区标识位于链路层头或IP网络头中。从而,目的网卡可以在不解封装目标报文的前提下,获得第一网络分区标识,能够提高目的网卡识别目标报文是否未允许通过的报文的速度。
在一种可能实现的方式中,第一网络分区标识不用于目标报文的转发。也就是说,网络设备根据目标报文的报文头中的地址信息转发即可,网络设备无需建立有关第一网络分区标识相关的转发路有表项,也无需根据第一网络分区标识查表转发,网络设备只需将报文头中携带第一网络分区标识的目标报文当做正常的IP报文转发即可,从而能够提高网络设备的转发性能。
在一种可能实现的方式中,第一网络分区标识和第二网络分区标识对源端设备和目的端设备均不可见。从而,远端设备和目的端设备中的租户无法获得第一网络分区标识和第二网络分区标识,保证网络分区标识的保密性和安全性,能够保障基于网络分区标识的网络隔离安全可靠。
在一种可能实现的方式中,***还包括网络管理设备,网络设备包括与源网卡连接的第一边缘网络设备,以及与目的网卡连接的第二边缘网络设备。网络管理设备具体用于向第一边缘网络设备发送第一网络分区标识,以及向第二边缘网络设备发送第二网络分区标识。第一边缘网络设备,还用于向源网卡发送第一控制消息,第一控制消息包括第一网络分区标识。第二边缘网络设备,还用于向目的网卡发送第二控制消息,第二控制消息包括第二网络分区标识。源网卡还用于根据第一控制消息配置第一网络分区标识。目的网卡还用于根据第二控制消息配置第二网络分区标识。通过网络侧对源网卡和目的网卡的网络分区标识进行可信配置,不会被租户感知,能够保证网络分区标识的保密性和安全性,保障基于网络分区标识的网络隔离安全可靠。
在一种可能实现的方式中,第一控制消息和第二控制消息中不包括IP地址。从而,网卡能够识别出控制消息,并基于控制消息完成自身的网络分区标识的配置,而不会将控制消息当做正常的IP报文发送至端侧设备,导致网络分区标识暴露及网卡无法完成网络分区标识的配置。
在一种可能实现的方式中,目的网卡还用于在第一网络分区标识与第二网络分区标识相同时,剥除目标报文中的第一网络分区标识。目的网卡还用于向与目的端设备发送剥除第一网络分区标识后的目标报文。第一网络分区标识与第二网络分区标识相同说明目的网卡和源网卡属于同一个网络分区,源端设备和目的端设备之间允许通信。目的网卡向目的端设备发送目标报文前,需要现将目标报文的报文头中的第一网络分区标识剥除,避免携带第一网络分区标识的报文发送到目的端设备,导致目的端设备无法识别该报文,以及导致第一网络分区标识暴露,从而保证网络分区标识的保密性和安全性,保障基于网络分区标识的网络隔离安全可靠。
在一种可能实现的方式中,网络设备包括第二边缘网络设备,第二边缘网络设备的第一端口连接目的网卡。第二边缘网络设备,用于接收目标报文,并获取报文头中的第一网络分区标识。第二边缘网络设备还用于在第一网络分区标识为第一端口允许通过的网络分区标识时,通过第一端口向目的网卡转发目标报文,或在第一网络分区标识不为第一端口允许通过的网络分区标识时丢弃目标报文。第二边缘网络设备对发送至目的网卡的目标报文进行筛查,能够辅助目的网卡过滤异常流量,避免存在异常流量攻击目的网卡,占用目的网卡带宽导致影响目的网卡的正常工作。
在一种可能实现的方式中,网络设备包括第一边缘网络设备,第一边缘网络设备的第二端口连接源网卡。第一边缘网络设备用于接收目标报文,并获取报文头中的第一网络分区标识。第一边缘网络设备还用于在第一网络分区标识为第二端口允许通过的网络分区标识时,向目的网卡转发目标报文,或在第一网络分区标识不为第二端口允许通过的网络分区标识时丢弃目标报文。第一边缘网络设备对来自第二端口的报文进行筛查,从而能够屏蔽来自端侧设备的异常目标报文,避免异常目标报文在IP网络中转发,从而提高IP网络的安全性。
在一种可能实现的方式中,源端设备为物理机,源网卡为物理网卡;或源端设备为虚拟设备,源网卡
为虚拟设备直通的虚拟功能VF网卡或物理功能PF网卡,虚拟设备为虚拟机或容器;目的端设备为物理机,目的网卡为物理网卡;或目的端设备为虚拟设备,目的网卡为虚拟设备直通的VF网卡或PF网卡。源网卡唯一对应一个端侧设备,能够实现各种形态的端侧设备的精准隔离,能够适用于多种网络隔离场景。
在一种可能实现的方式中,源网卡为基于物理网卡的物理资源实现报文收发和第一网卡分区标识添加处理的网卡,目的网卡为基于物理网卡的物理资源实现报文收发和第一网络分区标识剥除处理的网卡。
第二方面提供一种网卡。网卡包括存储模块、收发模块和处理模块。其中,存储模块,用于存储该网卡配置的第二网络分区标识。收发模块,用于接收IP网络中的网络设备转发的目标报文,目标报文包括单层报文头,报文头中包括发送目标报文的网卡添加的第一网络分区标识,第一网络分区标识为发送目标报文的网卡所配置网络分区标识。处理模块,用于获取报文头中的第一网络分区标识,并在第一网络分区标识与第二网络分区标识不同时,丢弃目标报文。
在一种可能实现的方式中,第一网络分区标识和第二网络分区标识对与收发模块连接的端侧设备不可见。
在一种可能实现的方式中,处理模块,还用于在第一网络分区标识与第二网络分区标识相同时,剥除目标报文的报文头中的第一网络分区标识。收发模块,还用于向与收发模块连接的端侧设备发送剥除第一网络分区标识后的目标报文。
在一种可能实现的方式中,收发模块,还用于接收来自网络设备中的第二边缘网络设备的第二控制消息,第二边缘网络设备为与收发模块连接的设备,第二控制消息中包括第二网络分区标识,第二控制消息为第二边缘网络设备接收到来自网络管理设备的第二网络分区标识后生成的。处理模块,还用于根据第二控制消息配置第二网络分区标识。
在一种可能实现的方式中,网卡为物理网卡,与网卡连接的端侧设备为物理机;或网卡为直通端侧设备的VF网卡或PF网卡,端侧设备为虚拟机或容器。
在一种可能实现的方式中,该网卡为基于物理网卡的物理资源实现报文收发和第一网络分区标识剥除处理的网卡。
第三方面提供一种网卡。网卡包括存储模块、收发模块和处理模块。存储模块,用于存储该网卡配置的第一网络分区标识。处理模块,用于对待发送数据进行处理,得到第二目标报文,第二目标报文包括单层报文头,报文头包括处理模块添加的第二网络分区标识。收发模块,用于通过IP网络中的网络设备发送目标报文,以使接收目标报文的网卡在第二网络分区标识与目标报文的报文头中的第一网络分区标识不同时丢弃目标报文,第二网络分区标识为接收目标报文的网卡所配置的网络分区标识。
在一种可能实现的方式中,第二网络分区标识位于链路层头。待发送数据为未进行封装处理的应用数据。处理模块,用于为待发送数据封装包括第一网络分区标识的报文头,得到目标报文。
在一种可能实现的方式中,待发送数据包括原始报文头,原始报文头中不包括第一网络分区标识。处理模块,用于将第一网络分区标识***原始报文头中,得到目标报文。
在一种可能实现的方式中,目标报文的报文头包括链路层头和IP网络头,第一网络分区标识位于链路层头或IP网络头中。
在一种可能实现的方式中,收发模块,还用于接收来自网络设备中的边缘网络设备的控制消息,边缘网络设备为与收发模块连接的网络设备,控制消息中包括第一网络分区标识,控制消息为边缘网络设备接收到来自网络管理设备的第一网络分区标识后生成的。处理模块,还用于根据控制消息配置第一网络分区标识。
在一种可能实现的方式中,网卡为物理网卡,与网卡连接的端侧设备为物理机;或网卡为直通端侧设备的VF网卡或PF网卡,端侧设备为虚拟机或容器。
在一种可能实现的方式中,该网卡为基于物理网卡的物理资源实现报文收发和第一网卡分区标识添加处理的网卡。
第四方面提供一种网络隔离方法。该方法包括:目的网卡接收IP网络中的网络设备转发的目标报文,目标报文为源网卡对待发送数据进行处理得到的,目标报文包括单层报文头,报文头中包括源网卡添加的第一网络分区标识,第一网络分区标识为源网卡所配置网络分区标识;目的网卡获取目标报文的报文头中的第一网络分区标识;目的网卡在第一网络分区标识与第二网络分区标识不同时,丢弃目标报文,第二网
络分区标识为目的网卡所配置网络分区标识。
在一种可能实现的方式中,报文头包括链路层头和IP网络头,第一网络分区标识位于链路层头或IP网络头中。
在一种可能实现的方式中,第一网络分区标识和第二网络分区标识对与源端设备和目的端设备均不可见,源端设备为与源网卡连接的端侧设备,目的端设备为与目的网卡连接的端侧设备。
在一种可能实现的方式中,该方法还包括:目的网卡接收来自网络设备中的第二边缘网络设备的第二控制消息,第二边缘网络设备为与目的网卡连接的设备,第二控制消息中包括第二网络分区标识,第二控制消息为第二网络设备接收到来自网络管理设备的第二网络分区标识后生成的。目的网卡根据控制消息完成第二网络分区标识的配置。
在一种可能实现的方式中,控制消息不包括IP地址。
在一种可能实现的方式中,该方法还包括:目的网卡在第一网络分区标识与第二网络分区标识相同时,剥除目标报文中的第一网络分区标识。目的网卡向与目的网卡连接的目的端设备发送剥除第一网络分区标识后的目标报文。
在一种可能实现的方式中,目的网卡为物理网卡,与目的网卡连接的目的端设备为物理机;或目的网卡为直通目的端设备的VF网卡或PF网卡,目的端设备为虚拟机或容器。
在一种可能实现的方式中,目的网卡为基于物理网卡的物理资源实现报文收发和第一网络分区标识剥除处理的网卡。
第五方面提供一种网络隔离方法。该方法包括:源网卡对待发送数据进行处理,得到目标报文,目标报文包括单层报文头,报文头中包括源网卡添加的第一网络分区标识,第一网络分区标识为源网卡所配置网络分区标识。源网卡通过IP网络中的网络设备向目的网卡发送目标报文,以使目的网卡接收到目标报文后获取目标报文的报文头中的第一网络分区标识,并在第一网络分区标识与第二网络分区标识不同时,丢弃目标报文,第二网络分区标识为目的网卡所配置网络分区标识。
在一种可能实现的方式中,待发送数据为未进行封装处理的应用数据。源网卡为待发送数据封装包括第一网络分区标识的报文头,得到目标报文。
在一种可能实现的方式中,待发送数据包括原始报文头,原始报文头中不包括第一网络分区标识;源网卡,用于将第一网络分区标识***原始报文头中,得到目标报文。
在一种可能实现的方式中,报文头包括链路层头和IP网络头,第一网络分区标识位于链路层头或IP网络头中。
在一种可能实现的方式中,第一网络分区标识和第二网络分区标识对源端设备和目的端设备均不可见,源端设备为与源网卡连接的端侧设备,目的端设备为与目的网卡连接的端侧设备。
在一种可能实现的方式中,该方法还包括:源网卡接收来自网络设备中的第一边缘网络设备的第一控制消息,第一边缘网络设备为与源网卡连接的设备,第一控制消息中包括第一网络分区标识,第一控制消息为第一网络设备接收到来自网络管理设备的第一网络分区标识后生成的。源网卡根据控制消息完成第一网络分区标识的配置。
在一种可能实现的方式中,控制消息不包括IP地址。
在一种可能实现的方式中,源网卡为物理网卡,与源网卡连接的源端设备为物理机;或源端设备为虚拟设备,源网卡为虚拟设备直通的VF网卡或PF网卡,虚拟设备为虚拟机或容器。
在一种可能实现的方式中,源网卡为基于物理网卡的物理资源实现报文收发和第一网卡分区标识添加处理的网卡,目的网卡为基于物理网卡的物理资源实现报文收发和第一网络分区标识剥除处理的网卡。
第六方面提供一种网络隔离方法。该方法包括:网络设备接收源网卡发送的目标报文,目标报文为源网卡对待发送数据进行处理得到的,目标报文包括单层链路层头和单层IP网络头,报文头中包括源网卡添加的第一网络分区标识,第一网络分区标识为源网卡所配置网络分区标识;网络设备根据报文头中的目的地址信息向目的网卡转发目标报文,网络设备转发目标报文时保留报文头中的第一网络分区标识,以使目的网卡接收目标报文后从报文头中获取第一网络分区标识,并在第一网络分区标识与第二网络分区标识不同时,丢弃目标报文,第二网络分区标识为目的网卡所配置网络分区标识。
在一种可能实现的方式中,第一网络分区标识不用于目标报文的转发。
在一种可能实现的方式中,报文头包括链路层头和IP网络头,第一网络分区标识位于链路层头或IP网络头中。
在一种可能实现的方式中,网络设备包括与源网卡连接的第一边缘网络设备,以及与目的网卡连接的第二边缘网络设备,该方法还包括:第一边缘网络设备获取来自网络管理设备的第一网络分区标识;第一边缘网络设备向源网卡发送第一控制消息,第一控制消息包括第一网络分区标识,以使源网卡根据第一控制消息配置第一网络分区标识;第二边缘网络设备获取来自网络管理设备的第二网络分区标识;第二边缘网络设备向目的网卡发送第二控制消息,第二控制消息包括第二网络分区标识,以使目的网卡根据第二控制消息配置第二网络分区标识。
在一种可能实现的方式中,第一控制消息和第二控制消息中不包括IP地址。
在一种可能实现的方式中,网络设备包括与目的网卡连接的第二边缘网络设备,第二边缘网络设备的第一端口连接目的网卡,该方法还包括:第二边缘网络设备接收目标报文,并获取报文头中的第一网络分区标识;第二边缘网络设备在第一网络分区标识为第一端口允许通过的网络分区标识时,通过第一端口向目的网卡转发目标报文,或在第一网络分区标识不为第一端口允许通过的网络分区标识时丢弃目标报文。
在一种可能实现的方式中,网络设备包括与源网卡连接的第一边缘网络设备,第一边缘网络设备的第二端口连接源网卡,方法还包括:第一边缘网络设备接收目标报文,并获取报文头中的第一网络分区标识;第一边缘网络设备在第一网络分区标识为第二端口允许通过的网络分区标识时,向目的网卡转发目标报文,或在第一网络分区标识不为第二端口允许通过的网络分区标识时丢弃目标报文。
在一种可能实现的方式中,源端设备为物理机,源网卡为物理网卡;或源端设备为虚拟设备,源网卡为虚拟设备直通的虚拟功能VF网卡或物理功能PF网卡,虚拟设备为虚拟机或容器;目的端设备为物理机,目的网卡为物理网卡;或目的端设备为虚拟设备,目的网卡为虚拟设备直通的VF网卡或PF网卡。
在一种可能实现的方式中,源网卡为基于物理网卡的物理资源实现报文收发和第一网卡分区标识添加处理的网卡,目的网卡为基于物理网卡的物理资源实现报文收发和第一网络分区标识剥除处理的网卡。
第七方面提供一种网络隔离方法。该方法包括:源网卡对待发送数据进行处理,得到目标报文,目标报文包括单层报文头,报文头中包括源网卡添加的第一网络分区标识,第一网络分区标识为源网卡所配置网络分区标识;源网卡通过网络设备向目的网卡发送目标报文;网络设备向目的网卡转发目标报文;目的网卡接收目标报文后获取报文头中的第一网络分区标识,并在第一网络分区标识与第二网络分区标识不同时,丢弃目标报文,第二网络分区标识为目的网卡所配置网络分区标识。
在一种可能实现的方式中,第一网络分区标识不用于目标报文的转发。
在一种可能实现的方式中,网络设备包括与源网卡连接的第一边缘网络设备,以及与目的网卡连接的第二边缘网络设备,该方法还包括:第一边缘网络设备获取来自网络管理设备的第一网络分区标识;第一边缘网络设备向源网卡发送第一控制消息,第一控制消息包括第一网络分区标识;源网卡根据第一控制消息配置第一网络分区标识。第二边缘网络设备获取来自网络管理设备的第二网络分区标识;第二边缘网络设备向目的网卡发送第二控制消息,第二控制消息包括第二网络分区标识;目的网卡根据第二控制消息配置第二网络分区标识。
在一种可能实现的方式中,第一控制消息和第二控制消息中不包括IP地址。
在一种可能实现的方式中,网络设备包括与目的网卡连接的第二边缘网络设备,第二边缘网络设备的第一端口连接目的网卡,该方法还包括:第二边缘网络设备接收目标报文,并获取报文头中的第一网络分区标识;第二边缘网络设备在第一网络分区标识为第一端口允许通过的网络分区标识时,通过第一端口向目的网卡转发目标报文,或在第一网络分区标识不为第一端口允许通过的网络分区标识时丢弃目标报文。
在一种可能实现的方式中,网络设备包括与源网卡连接的第一边缘网络设备,第一边缘网络设备的第二端口连接源网卡,方法还包括:第一边缘网络设备接收目标报文,并获取报文头中的第一网络分区标识;第一边缘网络设备在第一网络分区标识为第二端口允许通过的网络分区标识时,向目的网卡转发目标报文,或在第一网络分区标识不为第二端口允许通过的网络分区标识时丢弃目标报文。
在一种可能实现的方式中,待发送数据为未进行封装处理的应用数据。源网卡,用于为待发送数据封装包括所述第一网络分区标识的报文头,得到目标报文。
在一种可能实现的方式中,待发送数据包括原始报文头,原始报文头中不包括第一网络分区标识。源
网卡,用于将第一网络分区标识***原始报文头中,得到目标报文。
在一种可能实现的方式中报文头包括链路层头和IP网络头,第一网络分区标识位于链路层头或IP网络头中。
在一种可能实现的方式中,第一网络分区标识和第二网络分区标识对与源端设备和与目的网卡连接的目的端设备均不可见。
在一种可能实现的方式中,该方法还包括:目的网卡在第一网络分区标识与第二网络分区标识相同时,剥除目标报文中的第一网络分区标识。目的网卡向与目的网卡连接的目的端设备发送剥除第一网络分区标识后的目标报文。
在一种可能实现的方式中,源端设备为物理机,源网卡为物理网卡;或源端设备为虚拟设备,源网卡为虚拟设备直通的虚拟功能VF网卡或物理功能PF网卡,虚拟设备为虚拟机或容器;目的端设备为物理机,目的网卡为物理网卡;或目的端设备为虚拟设备,目的网卡为虚拟设备直通的VF网卡或PF网卡。
在一种可能实现的方式中,源网卡为基于物理网卡的物理资源实现报文收发和第一网卡分区标识添加处理的网卡,目的网卡为基于物理网卡的物理资源实现报文收发和第一网络分区标识剥除处理的网卡。
第八方面提供一种网络设备。网络设备包括收发模块。其中,收发模块,用于接收源网卡发送的目标报文,目标报文为源网卡对待发送数据进行处理得到的,目标报文包括单报文头,报文头中包括源网卡添加的第一网络分区标识,第一网络分区标识为源网卡所配置网络分区标识。收发模块,还用于根据报文头中的目的地址信息向目的网卡转发目标报文,网络设备转发目标报文时保留报文头中的第一网络分区标识,以使目的网卡接收目标报文后从报文头中获取第一网络分区标识,并在第一网络分区标识与第二网络分区标识不同时,丢弃目标报文,第二网络分区标识为目的网卡所配置网络分区标识。
在一种可能实现的方式中,第一网络分区标识不用于目标报文的转发。
在一种可能实现的方式中,网络设备为与源网卡连接的第一边缘网络设备,第一边缘网络设备还包括处理模块;处理模块,用于获取来自网络管理设备的第一网络分区标识;处理模块,用于根据第一网络分区标识生成第一控制消息,第一控制消息包括第一网络分区标识,收发模块,用于向源网卡发送第一控制消息,以使源网卡根据第一控制消息配置第一网络分区标识。
在一种可能实现的方式中,网络设备为与目的网卡连接的第二边缘网络设备,第二边缘网络设备还包括处理模块;处理模块,用于获取来自网络管理设备的第一网络分区标识;处理模块,用于根据第二网络分区标识生成第二控制消息,第二控制消息包括第二网络分区标识,收发模块,用于向源网卡发送第二控制消息,以使目的网卡根据第二控制消息配置第二网络分区标识。
在一种可能实现的方式中,第一控制消息和第二控制消息中不包括IP地址。
在一种可能实现的方式中,网络设备为与源网卡连接的第一边缘网络设备,第一边缘网络设备还包括处理模块;处理模块,用于获取报文头中的第一网络分区标识;处理模块,用于在第一网络分区标识为允许通过的网络分区标识时,允许收发模块向目的网卡转发目标报文,或在第一网络分区标识不为允许通过的网络分区标识时丢弃目标报文。
在一种可能实现的方式中,网络设备为与目的网卡连接的第二边缘网络设备,第二边缘网络设备还包括处理模块;处理模块,用于获取报文头中的第一网络分区标识;处理模块,用于在第一网络分区标识为允许通过的网络分区标识时,允许收发模块向目的网卡转发目标报文,或在第一网络分区标识不为允许通过的网络分区标识时丢弃目标报文。
在一种可能实现的方式中,报文头包括链路层头和IP网络头,第一网络分区标识位于链路层头或IP网络头中。
第九方面一种网络设备。该网络设备包括处理器和物理端口,处理器与物理端口连接,物理端口用于接收和发送目标报文,处理器用于执行指令,使得网络设备执行上述第六方面或第六方面的任一种可能的实现方式中的方法。
第十方面提供一种网卡。该网卡包括处理器和物理网口,处理器与物理网口连接,物理网口用于接收和发送目标报文,处理器用于执行上述的第四方面或第四方面的任一种可能的实现方式,或第五方面或第五方面的任一种可能的实现方式中的方法。
第十一方面提供一种计算机设备。该计算机设备包括处理器、存储器、通信总线和如第二方面、第三
方面或第九方面的任一种可能的实现方式中的网卡,处理器、存储器和网卡通过通信总线互相连接。
第十二方面提供一种计算机可读存储介质。计算机可读存储介质包括计算机程序指令,当计算机程序指令由网卡执行时,网卡执行如上述的第四方面或第四方面的任一种可能的实现方式,或第五方面或第五方面的任一种可能的实现方式中的方法。
第十三方面提供一种计算机可读存储介质,其特征在于,包括计算机程序指令,当计算机程序指令由网络设备执行时,网络设备执行如上述第六方面或第六方面的任一种可能的实现方式中的方法。
第十四方面提供一种报文结构。报文的报文结构包括单层报文头和载荷,报文头包括链路层头和IP网络头。报文头中包括网络分区标识字段,网络分区标识字段用于承载发送报文的源网卡配置的第一网络分区标识,第一网络分区标识用于在接收报文的目的网卡确定链路层头或IP网络头中的第一网络分区标识与自身配置的第二网络分区标识不同时,丢弃该报文。第一网络分区标识在网络传输中被保留,随报文端到端携带,从而能够用于端到端地网络隔离。
在一种可能实现的方式中,第一网络分区标识还用于在接收报文的目的网卡确定链路层头或IP网络头中的第一网络分区标识与自身配置的第二网络分区标识相同时,允许该报文通过。
在一种可能实现的方式中,IP网络头为IPv6网络头,网络分区标识字段位于IPv6网络头的IPv6扩展头。
在一种可能实现的方式中,网络分区标识字段的长度大于12比特。从而,可以有足够的网络分区标识用于大型IP网络隔离。
图1为一种数据中心网络架构的示意图;
图2为VXLAN报文的格式的示意图;
图3为本申请提供的网络隔离***一实施例的结构示意图;
图4为本申请提供的网络隔离***另一实施例的结构示意图;
图5为本申请提供的网络隔离方法一实施例的流程示意图;
图6为本申请提供的一种目标报文的报文结构的示意图;
图7为本申请提供的另一种目标报文的报文结构的示意图;
图8为本申请提供的网络隔离方法的第二实施例的流程示意图;
图9为本申请提供的网络隔离方法的一种应用场景的示意图;
图10为本申请提供的网络隔离方法的另一种应用场景的示意图;
图11为本申请提供的网络隔离方法的另一种应用场景的示意图;
图12为本申请提供的网卡一实施例的结构示意图;
图13为本申请提供的网卡另一实施例的结构示意图;
图14为本申请提供的网络设备一实施例的结构示意图;
图15为本申请提供的网络设备另一实施例的结构示意图;
图16为本申请提供的网卡另一实施例的结构示意图;
图17为本申请提供的计算机设备一实施例的结构示意图。
本申请提供了一种网络隔离方法、***及相关设备。以在保证网络隔离安全可靠的前提下,降低大规模IP网络隔离的复杂度和处理时延,提高网络隔离性能。
网络将不同的计算机设备(主机)通过网络设备和线路连接起来,为不同的计算机设备之间的信息传递以及资源共享提供了有力的支撑。在共享式网络中,同一张物理网络连接的计算机设备之间可以互相访问,一个计算机设备发送的广播报文能够被同一物理网络上的所有计算机设备接收。这就造成了计算机设备能够被其他计算机设备恶意访问或攻击,导致信息泄露或计算机设备故障。并且,网络中传输的广播报文过多时,会占用大量网络带宽,影响网络中的正常业务的运行。因此,需要对网络进行网络隔离,以保证网络的安全及可靠运行。
网络隔离是指按照一定的原则,将一个物理网络上的网络资源或计算机设备划分为多个相对小的逻辑网络。例如,数据中心网络中,按照租户或功能划分逻辑网络;在园区网络中,按照企业划分逻辑网络;在企业网络中,按照部门划分逻辑网络,等等。同一个逻辑网络中的计算机设备之间可以直接通信,不同的逻辑网络的计算机设备之间不能够直接通信,跨逻辑网络的数据流需要三层网关进行转发,从而能够降低逻辑网络内的计算机设备被其他逻辑网络中的计算设备攻击、访问带来的信息泄露风险,以及抑制过多广播报文在网络中传播造成的广播风暴。
以数据中心的网络隔离为例进行说明,如图1所示,图1为一种数据中心网络架构的示意图。图1中的数据中心网络架构以两层脊叶架构作为示例,数据中心网络的架构还可以是两层或三层树形/胖树形架构,或者三层或多层脊叶架构等,此处不做限制。
数据中心网络中,包括多个主机以及多个网络设备。网络设备之间通过线缆连接构成网络,每一主机通过多个网络设备中的边缘网络设备接入网络,从而主机之间能够通过网络互相通信。图1中,按照网络设备的功能,可以将网络设备划分为第一交换层和第二交换层两个层次。第一交换层中的网络设备为接入设备,也可以称为边缘网络设备,用于与至少一个主机连接。第一交换层中的网络设备例如为叶子交换机。第二交换层中的网络设备为核心设备与第一交换层中的多个网络设备连接,用于实现同数据中心内或与外部网络之间的三层流量转发。第二交换层中的网络设备例如为骨干交换机。
主机中设置有至少一个物理网卡。物理网卡例如可以作为一个高速串行计算机扩展总线标准(peripheral component interconnect express,PCIe)终端设备通过PCIe接口***主机的主板的PCIe插槽。主板上包括中央处理器、存储器等硬件,用于提供计算资源和存储资源等,从而基于主板上的硬件能够运行操作***、应用程序等,主板上的硬件资源还可以提供给虚拟实例使用,虚拟实例例如为虚拟机、容器或裸金属服务器等。物理网卡为主机与光纤、双绞线或同轴电缆等传输介质之间的物理接口。物理网卡通过传输介质与边缘网络设备上的端口连接,从而通过物理网卡,实现主机与边缘网络设备的连接。物理网卡也可称为网络接口卡(network interface card,NIC),或网络适配器(network adapters)。物理网卡的基本功能包括数据帧的封装与拆装、介质访问控制和数据缓冲等。
主机可以虚拟化为多个虚拟机或容器等虚拟实例。数据中心中的计算资源可以以虚拟机、容器或物理机等粒度共享给多个租户使用。从而,一台主机可能属于多个租户,一个租户的虚拟机、容器、裸金属服务器或物理机可能分布在数据中心的不同主机上。数据中心例如还部署有多个业务,例如人工智能(artificial intelligence,AI)模型训练、AI推理、搜索和大数据分析等。为了提高业务性能,业务通常分散部署在数据中心的不同主机、虚拟机或容器上。基于同一张数据中心网络,同一租户或业务的虚拟机、容器、裸金属服务器或物理主机之间能够互相通信,不同的租户或业务之间则需要网络隔离。
目前,数据中心一般通过VXLAN进行网络隔离。VXLAN隔离原理如下:
如图2所示,图2为VXLAN报文的格式的示意图。为了实现网络隔离和虚拟机动态迁移,VXLAN报文包括两层报文头,即内层报文(原始报文)的报文头和封装的外层的隧道封装头。VXLAN报文将内层报文封装在UDP报文的数据部分(payload)中,UDP报文的数据部分携带有VXLAN头、内部以太网头(inner Ethernet header)、内部IP头(inner IP header)以及IP报文的数据部分,内层报文包括内部以太网头、内部IP头以及IP报文的载荷(payload),内部以太网头记录有内层报文的源介质访问控制(media access control,MAC)地址和目的MAC地址,内部IP头记录有内层报文的源IP地址和目的IP地址。
隧道封装头包括外部以太网头(outer Ethernet header)、外部IP头(outer IP header)、外部用户数据报协议(user datagram protocol,UDP)头(outer UDP header)以及VXLAN头,VXLAN头包括VXLAN Flags字段(8比特)、保留(reserved)字段(24比特)、VXLAN网络标识符(VXLAN network identifier,VNI)(24比特)以及保留字段(24比特)。
外部以太网头记录有VTEP的源MAC地址和目的MAC地址,外部IP头记录VXLAN隧道终端的源IP地址和目的IP地址。
VXLAN隧道终端又可称为VTEP设备,VTEP设备是VXLAN隧道的端点,用于对内层报文进行封装:在内层报文的基础上打上外部以太网头、外部IP头、外部用户数据报协议头以及VXLAN头,以产生VXLAN报文并发送至其他VTEP设备,又可对从其他VTEP设备接收到的VXLAN报文进行解封装:将VXLAN报文的外部以太网头、外部IP头、外部用户数据报协议头以及VXLAN头剥除,以获取内层报文,
并从VXLAN头中获取VNI。VTEP设备在对内层报文进行封装前,还用于对内层报文进行隧道匹配,即为内层报文该添加哪个VNI标识,使得内层报文通过对应的VXLAN隧道转发。
VTEP设备在VXLAN封装过程中将原始报文作为VXLAN报文的内层报文,并在VXLAN报文的隧道封装头的外部以太网头中记录源MAC地址是VTEP设备的MAC地址,目的MAC地址是下一跳设备的MAC地址,在VXLAN报文的隧道封装头的外部IP头中记录源IP地址是VTEP设备的IP地址,目的IP地址是隧道对端的VTEP设备的IP地址,在VXLAN报文的VXLAN头的VNI字段中记录VNI标识。也即,在网络设备转发VXLAN报文时,通过隧道封装头中的地址信息进行转发。
可以看出,通过VXLAN实现网络隔离需要复杂的VXLAN隧道匹配、VXLAN头的封装和剥除操作,处理时延大,从而导致报文转发性能差。并且,由于VXLAN头是在原始报文(内层报文)前多添加的一层报文头,VXLAN报文的帧头长,使得VXLAN报文在网络传输的过程中额外占用大量网络带宽,即在最大帧长的限制下,报文头边长则需降低载荷的长度,报文中承载的有效业务数据变少,导致网络带宽利用率和吞吐率下降。
为解决相关技术中网络隔离转发性能差和带宽利用率低的缺陷,本申请提供如下实施例,以实现高性能的网络隔离。
如图3所示,图3为本申请提供的网络隔离***一实施例的结构示意图。网络隔离***可以应用于数据中心网络,园区网络、企业网络或广域网中。本实施例中,网络隔离***包括多个网卡和多个网络设备。每一网卡连接一个端侧设备,端侧设备是指不包括物理网卡在内的物理机、虚拟机、裸金属服务器或容器。虚拟机、裸金属服务器或容器可以统称为虚拟设备。与端侧设备连接的网卡用于为该端侧设备收发报文。多个端侧设备通过与之连接的网卡与多个网络设备构成的IP网络连接,实现端侧设备之间的互连。使用IP协议进行通信的网络即为IP网络。
本实施例的网络隔离***,采用传输控制协议/网际协议(transmission control protocol/internet protocol,TCP/IP)进行通信。即端侧设备将要发送的数据按照IP数据报的格式进行封装得到IP报文,网络设备在转发IP报文时基于IP报文的报文头中的目的IP地址进行寻址和路由选择等。TCP/IP协议使用范围广泛,其与低层的数据链路层和物理层无关,因此TCP/IP协议可以运行在各种数据链路层网络上,并且可以连接不同的数据链路层协议构成的网络。因而,网络隔离***采用TCP/IP协议,能够兼容多种数据链路层网络,包括目前已有的数据链路层网络,例如以太网、令牌环网和令牌总线等,和未来推出的数据链路层网络,能够将不同的数据链路层网络呈现出一个大的IP网络。因此,本申请基于IP网络,能够实现大规模网络隔离。
多个端侧设备根据业务、网络逻辑平面、所属的租户、部门等原则划分为多个网络分区,每一网络分区中包括至少一个端侧设备。每一网络分区分配至少一个网络分区标识(network partition identifier,NPI)。本实施例以一个网络分区分配一个NPI为例。不同的网络分区分配的NPI互不相同。同一网络分区中的端侧设备的NPI相同,端侧设备的NPI即为所属的网络分区所分配的NPI。同一网络分区中的端侧设备之间由于配置有相同的NPI,能够互相通信。不同的网络分区中的端侧设备之间由于配置的NPI不同,不能够互相通信,从而使不同的网络分区互相隔离。
具体地,NPI配置在端侧设备连接的网卡中,配置NPI的网卡均为基于物理网卡的物理资源实现报文收发、NPI添加和NPI剥除处理的网卡。NPI存储于网卡的硬件资源,例如寄存器等存储器中,并且网卡工作在数据链路层和物理层,能够做到NPI对端侧设备均不可见,从而租户不感知NPI,以保证NPI不被网络管理员以外的用户获取或修改,进而保证基于NPI实现的网络隔离的安全性。同一网络分区中的端侧设备连接的网卡配置该网络分区对应的NPI。因而,不同网络分区的端侧设备连接的网卡配置NPI互不相同。
根据网络隔离的对象和粒度,端侧设备可以为物理机、虚拟机、容器或裸金属服务器等。网卡可以是物理网卡,或物理网卡上虚拟出来的物理功能(physical function,PF)网卡或虚拟功能(virtual function,VF)网卡。PF网卡和VF网卡同样为基于物理网卡的物理资源实现报文收发、NPI添加和NPI剥除处理的网卡。
其中,物理网卡具体可以是智能网卡(smart network interface card,smart NIC)。智能网卡是具有可编程的能力的网卡。智能网卡除了具备报文的接收和发送的基本功能,还可以包括输入输出(input/output,I/O)
虚拟化,及交换功能等。
当主机上运行有多个虚拟机或容器等虚拟实例时,可以通过I/O虚拟化的方式将物理网卡分配给虚拟机使用。其中,I/O虚拟化可以采用单根输入输出虚拟化(single-root I/O virtualization,SR-IOV)或多根输入输出虚拟化(multi root I/O virtualization,MR-IOV)。具体地,以SR-IOV技术为例进行说明。SR-IOV技术是一种基于硬件的虚拟化解决方案,可以在虚拟机之间高效共享PCIe设备,并且由于SR-IOV技术是在硬件中实现的,因此可以能够获得高效的I/O性能。支持SR-IOV的物理网卡的物理网口通过SR-IOV技术虚拟出至少一个PF网卡以及多个VF网卡。根据现有的SR-IOV规范,每个PF网卡最多可有64000个与其关联的VF网卡。PF网卡或VF网卡以一个独立网卡的形式呈现出来,有它自己独享的外设组件互连标准(peripheral component interconnect,PCI)配置区域。PF网卡和VF网卡可以统称为直通网卡。
创建直通网卡后,可以直接将至少一个直通网卡指定给主机上的虚拟机或容器等虚拟实例使用,从而使得多个虚拟实例通过与其相连的至少一个直通网卡共享PCIe设备。一个虚拟实例可以分配多个VF网卡,但同一个VF网卡只能分配给一个虚拟实例。物理网卡的一个物理网口对应于至少一个PF网卡以及多个VF网卡,各VF网卡能共享物理网卡的物理资源(共用同一个物理网口)。当主机上的虚拟实例通过直通VF网卡发送报文时,虚拟实例发出的报文将会通过虚拟实例上安装的VF网卡驱动直接传递给物理网卡的VF网卡,VF网卡将报文发送至物理交换机或虚拟交换机,由物理交换机或虚拟交换机将报文转发至报文的接受方,从而实现虚拟机与主机中的其他虚拟机或主机外部网络直接的通信。其中,直通的意思是可跳过主机中的虚拟机管理器将物理网卡直接提供给虚拟实例使用,以提高虚拟实例的I/O性能。
物理网卡内部还可以包含具备交换功能的交换设备。交换设备例如为虚拟交换机(open virtual switch,OVS)。该交换设备按照MAC表转发数据包,负责PF、VF和物理网卡的物理网口之间的数据包转发,即能够传递虚拟实例之间的流量,以及实现虚拟机和外界网络的通信。
本实施例中,端侧设备与网卡之间具有绑定关系。具体而言,当端侧设备为物理机时,网卡则为物理机中设置的物理网卡。当端侧设备为虚拟机或容器等虚拟设备(虚拟实例)时,网卡则为虚拟设备分配的VF网卡或PF网卡。也就是说,本实施例中的网卡是指基于物理网卡的物理资源进行报文的封装和收发等功能的网卡。而物理网卡中的虚拟交换机,主机或虚拟机的操作***中虚拟出的虚拟网卡或虚拟交换机,以及主机或虚拟机中的VF网卡驱动或PF网卡驱动等不属于本申请所述的网卡。并且,当端侧设备为虚拟机或容器时,端侧设备连接的网卡也并非指对应的PF网卡或VF网卡所在的物理网卡,而是指端侧设备连接的PF网卡或VF网卡。也即,本实施例中的网卡唯一对应一个端侧设备,一个端侧设备可以分配有至少一个网卡,从而能够精确地实现端到端的网络隔离。
为了保证NPI不被租户感知、获取和修改,可以通过可信途径为网卡配置NPI。可信途径例如包括从网络侧为网卡配置NPI的途径。
如图4所示,图4为本申请提供的网络隔离***另一实施例的结构示意图。图4中,网络隔离***还包括网络管理设备。网络管理设备用于管理和控制网络设备。网络管理设备与部分或全部网络设备连接,从而可以向网络中的网络设备下发管理报文等。网络管理设备在获得网络分区的NPI分配信息后,将NPI分配信息分发给对应的边缘网络设备,由边缘网络设备进一步为网卡配置NPI。
具体地,NPI分配信息例如包括多个端侧设备连接的网卡的配置信息。每一网卡的配置信息例如包括该网卡的地址信息和所分配的NPI等。地址信息例如包括IP地址和链路层地址等中的至少一者。网络管理设备根据网络拓扑和地址信息,确定每一网卡所连接的边缘网络设备,并将该网卡的配置信息发送给对应的边缘网络设备。
边缘网络设备根据网卡的配置信息,生成用于为网卡配置NPI的控制消息。控制消息中包括网卡的链路层地址和NPI。网卡接收和识别控制消息,获取控制消息中的NPI并进行保存,从而完成NPI配置。需要说明的是,控制消息中不包括IP地址,以使网卡在接收到控制消息后能够识别出控制消息不为业务报文,从而不会将控制消息发送至端侧设备,在端侧设备不感知的情况下完成NPI配置。由于是边缘网络设备向网卡发送控制消息,控制消息不需要经过其他网络设备转发,所以即使控制消息中没有网卡的IP地址,控制消息也能够发送到网卡,而且能够保证控制消息能够安全地发送到网卡而不会被第三方截获。
示例性地,如图4所示,网络设备1至网络设备4为边缘网络设备。网络设备1至网络设备4分别接收到来自网络管理设备的NPI分配信息。网络设备1根据网卡1的配置信息,将网卡1分配的NPI的值0
封装到用于配置网卡1的控制消息中,然后将该控制消息发送给网卡1。网络设备1还根据网卡2的配置信息,将网卡2分配的NPI的值1封装到用于配置网卡2的控制消息中,然后将该控制消息发送到网卡2。其他网络设备以此类推。
可选地,为了进一步提高配置信息从网络管理设备发送到边缘网络设备过程中的安全性和可靠性,网络管理设备可以通过带外网络(如图4中的虚线连接的网络)向边缘网络设备发送网卡的配置信息,边缘网络设备再根据配置信息完成网卡的NPI配置。带外网络独立于承载业务数据流的业务数据网络,二者通过不同的信道传输信息。因此,通过带外网络向边缘网络设备下发网卡的配置信息,不与业务数据流共用相同的信道,能够避免发生业务数据网络拥塞等导致配置信息丢包的情况,提高网卡的配置信息传输的可靠性。网络设备例如包括基板管理控制器(baseboard management controller,BMC),可以提供独立的物理端口(以下简称带外端口)。各网络设备的带外端口通过传输介质与网络管理设备连接,组成带外网络。从而可以通过带外网络对网络设备进行控制和管理。
在另一些实施方式中,主机中包括BMC,网络管理设备可以通过与主机BMC连接的带外网络下发网卡的配置信息。主机中的BMC接收到网卡的配置信息后,将配置信息发送给对应的网卡,使网卡根据配置信息完成NPI的配置。
在完成网卡的NPI的配置后,网卡在通过网络发送报文时,将自身配置的NPI添加到报文的报文头中,得到目标报文。目标报文的报文头包括链路层头和IP网络头。NPI位于链路层头或者IP网络头中。并且网卡在接收到通过网络设备传输过来的目标报文时,获取报文头中的NPI,并将报文头中的NPI与自身配置的NPI进行比对,若一致就剥除报文头中的NPI,将剥除NPI的目标报文发送至连接的端侧设备,不一致则丢弃该目标报文,从而实现不同网络分区的端侧设备间的流量隔离。并且,无论是二层转发还是三层转发,网络设备在转发目标报文时均保留报文头中的NPI,使报文头中的NPI能够跟随目标报文从发送目标报文的源网卡传输到接收该目标报文的目的网卡,即NPI在目标报文中端到端携带,NPI在IP网络中透明传输。
本实施例中,网卡发出的目标报文仅包括单层报文头,即该目标报文包括单层链路层头和单层IP网络头,网卡不需要为报文添加外层报文头,将自身配置的NPI添加到报文头中即可,操作简单,效率高。并且,目标报文中的NPI是网卡添加的,无需网络设备再为目标报文添加NPI,能够提高网络设备的转发性能。
本实施例中的NPI不用于转发,即无需为网络设备进行复杂的配置,网络设备无需学习和建立关于NPI相关的转发表项。网络设备转发携带NPI的目标报文时,也不需要根据NPI确定转发端口和路径,网络设备根据目标报文的报文头中的目的地址信息转发目标报文即可,网络设备转发目标报文的操作简单,转发效率高。
本实施例通过端侧网卡实现端到端的网络隔离,在报文头中添加了NPI的目标报文能够如常规的IP报文一样被网络设备转发,无需网络设备为目标报文封装和剥除用于网络隔离的隧道封装头,能够提高目标报文在网络中的转发性能。并且,在报文头中添加NPI的是端侧设备连接的网卡,网卡工作在链路层和物理层,因而网卡在报文头中添加NPI不会被端侧设备感知。NPI位于报文头中,无需通过端侧设备的操作***解析获取报文中的NPI,而是可以直接由网卡从报文中获取NPI,从而保证NPI对端侧设备不可见,以确保NPI安全可信。NPI的配置和使用环境都是安全可靠的,从而,基于NPI实现的网络隔离也是安全可靠的。在大规模IP网络隔离的场景下,本实施例提供的方案无需为网络设备进行复杂的配置,也无需增加硬件防火墙等就能够实现安全可靠的网络隔离,实现简单,成本更低。
具体地,基于NPI实现端到端的网络隔离的方法如图5所示,图5为本申请提供的网络隔离方法一实施例的流程示意图。本实施例的网络隔离方法基于上述的网络隔离***,图5中的源端设备为发送目标报文的端侧设备,目的端设备为接收目标报文的端侧设备。源网卡为与源端连接的网卡,目的网卡为与目的端连接的网卡。源网卡和目的网卡之间通过网络设备连接。源端设备和目的端设备可以是相同类型的端侧设备,也可以是不同类型的端侧设备。例如源端设备可以是虚拟机,而目的端设备可以是物理机等等,可依据实际情况而定,本申请此处不做限制。源端设备和目的端设备可以是位于同一主机中的虚拟设备,网络设备则可以包括源网卡和目的网卡所在的物理网卡中的虚拟交换机,若源网卡和目的网卡的IP地址属于同一IP网段,则可以由虚拟交换机进行目标报文的转发;若源网卡和目的网卡的IP地址属于不同的IP网
段,则网络设备包括三层网络设备(三层交换机或路由器等),由三层网络设备参与目标报文的转发。若源端设备和目的端设备位于不同的主机,网络设备则包括至少一个物理交换机或物理路由器等。本实施例步骤如下:
S501:源网卡对待发送数据进行处理,得到目标报文,目标报文的报文头中包括源网卡添加的第一NPI。
第一NPI为源网卡配置的NPI。
本实施例的目标报文仅包括单层的报文头,无需为待发送数据添加用于网络隔离的隧道封装头等。具体而言,目标报文的报文头包括单层的链路层头和单层的IP网络头。IP网络头中的源IP地址为源网卡的IP地址,目的IP地址为目的网卡的IP地址。链路层头中的源物理地址为源网卡的物理地址,目的物理地址为网关的物理地址(源网卡与目的网卡部署于同一IP网段需要进行三层转发时),或目的网卡的物理地址(无需进行三层转发时)。目标报文的报文头还包括网络分区标识字段,网络分区标识字段用于承载第一NPI。网络分区标识字段可以位于链路层头,也可以位于IP网络头。
如图6和图7所示,图6为本申请提供的一种目标报文的报文结构的示意图;图7为本申请提供的另一种目标报文的报文结构的示意图。目标报文除了包括链路层头和IP网络头,还包括上层协议头和载荷(payload)。其中,上层协议头例如包括TCP头或UDP头等。载荷用于承载应用数据。图6中,网络分区标识字段位于链路层头。图7中,网络分区标识字段位于IP网络头。当目标报文为互联网协议第六版(Internet protocol version 6,IPv6)报文时,IP网络头为IPv6网络头,网络分区标识字段可以位于IPv6网络头中的IPv6扩展头。
源网卡可以为TCP/IP网卡,或远程直接数据存取(remote direct memory access,RDMA)网卡,不同类型的源网卡添加第一NPI的方式不同,待发送数据也不相同以下分别进行描述。
当源网卡为TCP/IP网卡时,待发送数据为来自源端设备的已封装有报文头的原始报文。为了与目标报文的报文头区分,以下将原始报文的报文头称为原始报文头。原始报文头包括链路层头和IP网络头。由于第一NPI对源端设备不可见,因此原始报文头中不存在第一NPI。源网卡对待发送数据进行处理,具体为源网卡修改原始报文头,将第一NPI添加到原始报文头的链路层头或者IP网络头中,从而得到目标报文。目标报文包括原始报文的载荷,以及添加有第一NPI的报文头。
当源网卡为RDMA网卡时,源网卡通过直接数据存储(direct memory access,DMA)的方式从源端设备的存储空间获取待发送数据,源网卡获取待发送数据的过程不需要经过源端设备的操作***及协议栈,因此,待发送数据为来自源端设备的未进行封装处理的应用数据,需要由源网卡根据TCP/IP协议为待发送数据进行封装。源网卡对待发送数据进行处理,具体为源网卡为待发送数据封装包括第一NPI的报文头,得到目标报文。待发送数据即承载于图6或图7的目标报文中的载荷字段。在源网卡为待发送数据封装报文头时,同步在报文头中添加了第一NPI,封装处理效率高、时延小。
网络分区标识字段的长度可以为14比特、16比特、18比特、20比特或24比特等。从而,可以提供较多的网络分区标识,能够应用于大规模的IP网络隔离。
相比于在内层报文前添加外层以太头、外层IP头、外层UDP头和VXLAN头,本实施例极大地简化了报文格式,从而使得NPI的封装操作更加简单,并且控制了报文头的长度,不会大幅影响网络带宽利用率和数据传输效率。
可选地,为使网络设备和目的网卡能够识别包括网络分区标识字段的目标报文,目标报文的报文头中除了网络分区标识字段,还可以增加用于标识目标报文的字段等。但相比于具有双层报文头的报文而言,本申请的目标报文仍然具有更短的长度和更简单的封装方式。
S502:源网卡向网络设备发送目标报文。
S503:网络设备向目的网卡转发目标报文。
网络设备根据目标报文的报文头中的地址信息向目的网卡转发目标报文。报文头中的地址信息例如包括链路层头中的目的物理地址和IP网络头中的目的IP地址。二层转发时网络设备可以根据目的物理地址转发目标报文,三层转发时则需要根据目的IP地址转发目标报文。也即,网络设备在转发目标报文的过程中,并不为目标报文再封装一层用于网络隔离的隧道封装头以根据隧道封装头中的地址信息进行目标报文的转发,而是直接基于目标报文的报文头中的地址信息进行转发。由于目标报文为IP报文,网络设备为
IP网络中的设备,根据目标报文的报文头中的地址信息能够实现目标报文的跨IP网段和跨链路层网络的传输。
本实施例中,网络设备不对目标报文中的第一NPI进行处理,而是像常规IP报文一样根据报文头中的地址信息转发目标报文即可,也即,第一NPI在IP网络中透明传输。本实施例中的NPI可以仅用于网络隔离,而不参与转发,网络设备无需建立有关第一NPI相关的转发路有表项,也无需根据第一NPI查表转发,网络设备只需将报文头中携带第一NPI的目标报文当做正常的IP报文转发即可,并且,网络设备无需为目标报文执行修改替换NPI等操作,能够提高网络设备的转发性能。
当需要对目标报文进行三层转发时,网络设备包括三层网络设备。若第一NPI位于链路层头中,由于三层转发需要将目标报文的原链路层头替换为新的链路层头,三层网络设备在替换链路层头时,继承原链路层头中的第一NPI,将第一NPI添加到新的链路层头中,从而保证第一NPI在网络设备转发过程中被保留下来,实现第一NPI的端到端携带。
S504:目的网卡获取目标报文的报文头中的第一NPI。
目的网卡接收到目标报文后,从报文头中的网络分区标识字段获取第一NPI。
S505:目的网卡判断第一NPI和第二NPI是否相同,第二NPI为目的网卡配置的NPI。
目的网卡获取第一NPI后,将第一NPI与自身配置的第二NPI进行比对。若第一NPI与第二NPI相同,说明发送目标报文的源端设备与目的端设备属于同一网络分区,源端设备与目的端设备之间允许通信,则执行S506。若第一NPI与第二NPI不同,说明发送报文的源端设备与目的端设备不属于同一网络分区,源端设备与目的端设备之间不允许通信,则执行S508。
S506:目的网卡剥除报文头中的第一NPI。
为了避免目标报文中的第一NPI被发送到目的端设备,导致第一NPI暴露于端侧设备,以及第一NPI的存在导致目的端设备解码失败,目的网卡在向目的端设备发送目标报文前,将目标报文的报文头中的第一NPI剥除。
当目的网卡为TCP/IP网卡时,目的网卡将目标报文中的第一NPI剥除即可。
当目的网卡为RDMA网卡时,目的网卡将目标报文的报文头剥除,实现第一NPI的剥除。该情况下,剥除第一NPI的目标报文为不包括报文头的应用数据。
S507:目的网卡向目的端发送剥除第一NPI后的目标报文。
目的网卡在对目标报文进行NPI剥除等操作后,将剥除第一NPI后的目标报文发送至目的端,完成目标报文的传输。
S508:目的网卡丢弃目标报文。
在第一NPI与第二NPI不同时,目的网卡丢弃该目标报文。目标报文不会被发送到目的端设备,使得不同网络分区的端侧设备之间流量不互通,从而达到网络隔离的目的。
本实施例中,源网卡对待发送数据进行添加第一NPI的处理,得到报文头中包括第一NPI的目标报文,并通过网络设备向目的端设备发送该目标报文,网络设备转发目标报文时保留报文头中的第一NPI,从而目的网卡在接收到目标报文后能够获取其中的第一NPI,并在第一NPI与目的网卡配置的第二NPI相同时,放行目标报文,将其发送至目的端设备,或在在第一NPI与目的网卡配置的第二NPI不同时,丢弃该目标报文。从而,能够实现同一网络分区内的端侧设备之间的通信,而不同网络分区的端侧设备之间不能通信,以较低的数据面开销和成本实现了有效、可靠和安全的网络隔离。相比目前其他的网络隔离技术,在保证网络隔离安全有效的前提下,提升了网络设备的转发性能以及带宽利用率,并且能够应用于大规模IP网络隔离。
网络隔离方法的第一实施例中,仅通过网卡判断目标报文中的NPI与自身的NPI是否一致实现网络隔离,当存在网络攻击时,为了降低网络攻击流量过大占用网卡过多带宽带来的影响,本申请还提供网络隔离方法的第二实施例。与网络隔离方法的第一实施例的区别在于,网络隔离方法的第二实施例中,与网卡连接的边缘网络设备也可以对经过的目标报文中的NPI进行检查,在报文中的NPI为允许通过的NPI时放行对应的目标报文,在报文中的NPI不为允许通过的NPI时丢弃对应的目标报文,以辅助网卡过滤攻击流量。
具体地,如图8所示,图8为本申请提供的网络隔离方法的第二实施例的流程示意图。本实施例包括
如下步骤:
S801:源网卡对待发送数据进行处理,得到目标报文,目标报文的报文头中包括源网卡添加的第一NPI。
S802:源网卡向第一边缘网络设备发送目标报文。
第一边缘网络设备为与源网卡连接的物理网络设备。
S801至S802与S501至S502的内容类似,故此处不再赘述。
S803:第一边缘网络设备获取目标报文的报文头中的第一NPI。
S804:第一边缘网络设备判断第一NPI是否属于允许通过的NPI。
若否,则执行S805,若是,则执行S806。
第一边缘网络设备与源网卡连接的第一端口例如配置有至少一个允许通过的NPI。当第一NPI在允许通过的至少一个NPI中时,确认第一NPI为允许通过的NPI,否则为不允许通过的NPI。若源端设备为物理机,或源端设备所在的主机上的虚拟机或容器连接的网卡均配置为相同的NPI,则第一端口可以配置一个允许通过的NPI,即第一NPI。若源端为虚拟机或容器,源端设备所在的主机包括多个虚拟机或容器,且这些虚拟机或容器连接的网卡中存在网卡配置了不相同的NPI,那么第一端口可以配置多个允许通过的NPI,第一端口允许通过的NPI可以包括与第一端口连接的所有网卡的NPI。第一NPI不属于允许通过的NPI,则说明第一NPI并非网络管理设备或网络管理员为源网卡配置的NPI,目标报文则不会被第一边缘网络设备转发到目的网卡。
可以理解,边缘网络设备的一个端口仅连接一个物理网卡的物理网口。当物理网卡的物理网口虚拟化出至少一个PF网卡和多个VF网卡时,这些PF网卡和VF网卡共享物理网卡的物理网口与第一边缘网络设备的端口连接。因此,呈现出边缘网络设备的一个端口与至少一个PF网卡或多个VF网卡连接,此时边缘网络设备的一个端口可以配置多个允许通过的NPI。
第一边缘网络设备通过检查报文头中的NPI判断目标报文是否允许通过,可以保证即使NPI被恶意篡改,第一边缘交换机能够感知这样的异常情况,保证异常的目标报文不会通过网络传输到目的端设备,从而提高网络的安全性。
S805:第一边缘网络设备丢弃目标报文。
S806:第一边缘网络设备根据目标报文的报文头中的地址信息向目的网卡转发目标报文。
S807:第二边缘网络设备获取目标报文的报文头中的第一NPI。
第二边缘网络设备为与目的网卡连接的物理网络设备。目标报文到达目的网卡前需要经过第二边缘网络设备转发,第二边缘网络设备接收到目标报文后,进一步获取目标报文的报文头中网络分区标识字段中第一NPI,根据第一NPI判断是否需要将目标报文转发到目的网卡。若源端设备和目的端设备连接的是同一个边缘网络设备,那么第一边缘网络设备和第二边缘网络设备为同一网络设备。否则,第一边缘网络设备和第二边缘网络设备为不同的网络设备。
S808:第二边缘网络设备判断第一NPI是否属于允许通过的NPI。
若否,则执行S809,若是,则执行S810。
第二边缘网络设备与目的网卡连接的第二端口例如配置有至少一个允许通过的NPI。当第一NPI在允许通过的至少一个NPI中时,确认第一NPI为允许通过的NPI,否则为不允许通过的NPI。
若目的端设备为物理机,或目的端设备所在的主机上的虚拟机或容器连接的网卡均配置为相同的NPI,则第二端口可以配置一个允许通过的NPI,可以为目的网卡配置的NPI。该情况下,若第一NPI为允许通过的NPI,说明第一NPI与目的网卡配置的NPI相同,第二边缘网络设备可以放行目标报文。若第一NPI不为允许通过的NPI,说明第一NPI与目的网卡配置的NPI不同,源端设备与目的端设备不属于同一个网络分区,二者间的流量应当隔离,第二边缘网络设备不向目的网卡转发目标报文。
若目的端设备为虚拟机或容器,目的端设备所在的主机包括多个虚拟机或容器,且这些虚拟机或容器连接的网卡中存在网卡配置了不相同的NPI,那么第二端口可以配置多个允许通过的NPI,第二端口允许通过的NPI可以包括与第二边缘网络设备连接的所有网卡的NPI。该情况下,第一NPI为第二端口允许通过的NPI,说明与第二端口连接的物理网卡的物理网口对应的VF网卡和PF网卡中,存在网卡配置的NPI与第一NPI相同,可以向目的网卡转发目标报文,目第一NPI与的网卡配置的第二NPI是否一致则由目的
网卡进行判断。若第一NPI不为第二端口允许通过的NPI,说明与第二端口连接的物理网卡的物理网口对应的VF网卡和PF网卡中,不存在网卡配置的NPI与第一NPI相同,也即与该物理网卡的物理网口连接的包括目的端设备在内的所有端侧设备中,不存在端侧设备与源端设备属于同一网络分区,第二边缘网络设备不向目的网卡转发目标报文,从而实现不同网络分区之间的流量隔离。
S809:第二边缘网络设备丢弃目标报文。
第二边缘网络设备丢弃目标报文,从而实现不同网络分区之间的流量隔离。
可选地,第二边缘网络设备除了丢弃目标报文,还可以根据报文中获取相关信息进行错误统计,得到错误统计信息。分析相关信息例如包括目的网卡的物理地址、目的网卡的IP地址、源网卡的物理地址、源网卡的IP地址和、端口号和报文接收时间等中的至少一者。错误统计信息可以用于分析发生错误的原因和频率等,进而进行相关的处理。
S810:第二边缘网络设备根据目标报文的报文头中的地址信息向目的网卡转发目标报文。
S811:目的网卡获取报文头中的第一NPI。
S812:目的网卡判断第一NPI和第二NPI是否相同,第二NPI为目的网卡配置的NPI。
若否,则执行S813;若是,则执行S815。
S813:目的网卡丢弃目标报文。
可选地,目的网卡除了丢弃目标报文,也可以根据目标报文中获取相关信息进行错误统计。可以参考S809的相关描述,此处不再赘述。
S814:目的网卡剥除报文头中的第一NPI。
S815:目的网卡向目的端设备发送剥除第一NPI后的目标报文。
S811至S815与网络隔离方法的第二实施例中的S504至S508的内容类似,故此处不再赘述。
本实施例中,S803至S805为可选步骤,或者,S807至S809为可选步骤,本申请对此不做限制。
本实施例中,边缘网络设备通过判断目标报文的报文头中的第一NPI是否为允许通过的NPI,来决定是否向目的网卡转发目标报文,在网络侧对目标报文进行筛查,从而辅助目的网卡进行异常流量的隔离,降低目的网卡被攻击时导致无法正常工作的风险。
本申请的网络隔离方案可以用于多种场景下的网络隔离,例如物理机之间的隔离,虚拟机或容器之间的隔离,和网络逻辑平面之间的隔离等。当然,物理机、虚拟机和容器中的至少二者之间也可以通过本申请提供的网络隔离方案进行网络隔离。
为了使本申请的网络隔离方案更易于理解,以下分别对物理机之间的网络隔离、虚拟机之间的网络隔离和网络逻辑平面之间的隔离这三个场景进行举例说明。以下场景中均采用IP协议进行通信,通信过程中的报文均为上述的目标报文。
场景一,物理机之间的网络隔离
当物理机完整地属于某一租户或业务,并且不需要对物理机中的计算资源或存储资源进行网络隔离时,可以以物理机的粒度进行网络隔离。
示例性地,如图9所示,图9为本申请提供的网络隔离方法的一种应用场景的示意图。图9中,以端侧设备包括主机1至主机4,网络设备包括网络设备1和网络设备2为例,主机1至主机4均为独立的物理机。主机1和主机3分别连接网络设备1的端口1和端口2,主机2和主机4分别连接网络设备2的端口3和端口4。网络设备1为主机1和主机3的边缘网络设备,网络设备2为主机2和主机4的边缘网络设备。网络设备1和网络设备2直接连接或通过其他网络设备连接。主机1连接的物理网卡1配置的NPI为2(为了方便理解,此处NPI以十进制进行举例),主机2连接的物理网卡2配置的NPI为2,主机3连接的物理网卡3配置的NPI为3,主机4连接的物理网卡4配置的NPI为3。即主机1和主机2属于同一个网络分区,主机3和主机4属于同一个网络分区。主机1和主机2二者与主机3和主机4二者之间不属于同一个网络分区。
每一物理网卡在报文的报文头中的NPI字段添加自身配置的NPI后,通过网络设备向目的端发出报文。物理网卡1发出的报文的报文头的NPI字段中携带的NPI为2,物理网卡2发出的报文的报文头的NPI字段中携带的NPI为2,物理网卡3发出的报文的报文头的NPI字段中携带的NPI为3,物理网卡4发出的报文的报文头的NPI字段中携带的NPI为3。
物理网卡2接收到来自物理网卡1发送的报文,获取到报文的报文头中的网络分区标识字段的值为2,与自身配置的NPI是一致的,则物理网卡2通过该报文,将该报文处理后(剥除NPI,下同)发送至主机1。物理网卡4接收到来自物理网卡3发送的报文,获取到报文的报文头中的网络分区标识字段的值为3,与自身配置的NPI是一致的,则物理网卡4通过该报文,将该报文处理后发送至主机4。如果物理网卡2接收到来自物理网卡3的报文,获取到报文的报文头中的网络分区标识字段的值为3,与自身配置的NPI不一致,则物理网卡2丢弃该报文。
可选地,网络设备的端口可以配置与连接的物理网卡相同的NPI,作为允许从该端口通过的NPI。网络设备1的端口1配置允许通过的NPI为2,即物理网卡1的NPI,端口2配置允许通过的NPI为3,即物理网卡3的NPI。网络设备2的端口2配置允许通过的NPI为2,即物理网卡2的NPI,端口4配置的允许通过的NPI为3,即物理网卡4的NPI。网络设备1从报文的报文头的网络分区标识字段获取NPI,当需要从端口1经过的报文的网络分区标识字段的值为2时,则允许报文通过,否则丢弃报文,端口2同理。网络设备2的检查方式同理,此处不再赘述。从而,网络设备可以辅助网卡进行网络流量的筛查,在发生流量攻击时,能够降低网卡的负担。
场景二,网络逻辑平面之间的隔离
网络可以划分成多个逻辑平面,例如管理平面、存储平面和业务平面等。管理平面用于虚拟机、容器或物理机的管理,存储平面用于虚拟机、容器或物理机对存储资源的访问,业务平面用于业务数据之间的交换。三个逻辑平面之间需要互相隔离。网络逻辑平面可以承载于物理机、虚拟机或容器中,实现网络逻辑平面之间的计算资源或存储资源隔离。根据承载网络逻辑平面的基础设施(物理机、虚拟机或容器),网络逻辑平面连接的网卡可以是物理网卡、VF网卡或PF网卡。
示例性地,如图10所示,图10为本申请提供的网络隔离方法的另一种应用场景的示意图。图10中,主机5的管理平面连接的PF网卡1配置的NPI为4,存储平面连接的PF网卡2配置的NPI为5,业务平面连接的PF网卡3配置的NPI为6。主机6的管理平面连接的PF网卡4配置的NPI为4,存储平面连接的PF网卡5配置的NPI为5,业务平面连接的PF网卡6配置的NPI为6。主机7为管理服务器,占用一整个物理机,属于管理平面,主机7连接的物理网卡7配置的NPI为4。主机8为存储服务器,占用一整个物理机,属于存储平面,主机8连接的物理网卡8配置的NPI为5。也即,同一网络逻辑平面属于同一网络分区,不同网络逻辑平面属于不同的网络分区,从而实现网络逻辑平面之间的隔离。
PF网卡1至6和物理网卡7至8在发出的报文的报文头中的网络分区标识字段添加自身配置的NPI,并在接收到来自网络的报文时检查其中的NPI与自身配置的NPI是否一致,一致说明报文来自同一逻辑平面,可以将报文转发到对应的网络逻辑平面,不一致说明来自不同的逻辑平面,则丢弃报文。例如,PF网卡1接收到来自物理网卡7的报文,获取到报文的报文头中的网络分区标识字段的值为4,与物理网卡7配置的NPI相同,说明报文来自管理平面,可以通过该报文,物理网卡7则将报文处理后发送到主机5的管理平面。物理网卡8接收到来自PF网卡2的报文,获取到报文的报文头中的网络分区标识字段的值为5,与物理网卡8配置的NPI相同,说明报文来自存储平面,可以通过该报文,物理网卡8对报文进行处理后发送至主机8。物理网卡7接收到来自PF网卡3的报文,获取到报文的报文头中的网络分区标识字段的值为6,与物理网卡7配置的NPI不同,说明报文来自其他的网络逻辑平面,物理网卡7丢弃该报文。
可选地,网络设备的端口可以配置NPI列表,NPI列表中的NPI为允许从该端口通过的NPI。NPI列表中的NPI包括与之连接的所有PF网卡所配置的NPI,或与之连接的物理网卡所配置的NPI。网络设备3的端口5配置的NPI列表包括4、5和6,即PF网卡1、PF网卡2和PF网卡3的NPI,端口6配置的NPI列表包括4、5和6,即PF网卡4、PF网卡5和PF网卡6的NPI。网络设备4的端口7配置允许通过的NPI为4,即物理网卡7的NPI,端口8配置允许通过的NPI为5,即物理网卡8的NPI。网络设备3从报文的报文头的网络分区标识字段获取NPI,当需要从端口5经过的报文的网络分区标识字段的值为4、5或6时,则允许报文通过,否则丢弃报文,端口6同理。网络设备4的检查方式同理,此处不再赘述。
场景三,虚拟机之间的隔离
数据中心中的虚拟机属于多个租户,不同租户的虚拟机之间需要隔离。因此,可以将属于同一租户的虚拟机划分到同一网络分区中,不同租户的虚拟机划分到不同的网络分区中。从而实现不同租户的虚拟机之间的隔离。并且,无论虚拟机是否位于同一主机,都可以通过本申请提供的网络隔离方案实现隔离。
示例性地,如图11所示,图11为本申请提供的网络隔离方法的另一种应用场景的示意图。图11中,主机9中包括虚拟机1和虚拟机2,虚拟机1绑定VF网卡1,虚拟机2绑定VF网卡2。主机10包括虚拟机3和虚拟机4,虚拟机3绑定VF网卡3,虚拟机4绑定VF网卡4。主机10包括虚拟机5和虚拟机6,虚拟机5绑定VF网卡5,虚拟机6绑定VF网卡6。
虚拟机1和虚拟机3属于租户1,这两个虚拟机划分到同一网络分区,分配的NPI为7,那么VF网卡1和VF网卡3的NPI均配置为7。虚拟机2、虚拟机4和虚拟机6属于租户2,这三个虚拟机划分到同一网络分区,分配的NPI为8,那么VF网卡2、VF网卡4和VF网卡6的NPI均配置为8。虚拟机5属于租户3,同样划分到一个网络分区中,分配的NPI为9,VF网卡5配置的NPI为9。
VF网卡1至6在发出的报文的报文头中的网络分区标识字段添加自身配置的NPI,并在接收到来自网络的报文时检查其中的NPI与自身配置的NPI是否一致,一致说明报文来自同一网络分区,即同一租户,可以将报文转发到对应的虚拟机,不一致说明来自不同的网络分区,则丢弃报文。从而实现不同租户之间的网络隔离。例如,VF网卡1接收到来自VF网卡2的报文,VF网卡1获取到报文的报文头中的网络分区标识字段的值为8,与VF网卡1配置的NPI不同,说明报文来自不同租户,VF网卡1丢弃该报文。VF网卡6接收到来自VF网卡4的报文,VF网卡6获取到报文的报文头中的网络分区标识字段的值为8,与VF网卡6配置的NPI相同,说明报文来自同一租户,可以通过该报文,VF网卡6将该报文处理后发送至虚拟机6。
可选地,网络设备的端口可以配置NPI列表,NPI列表中的NPI为允许从该端口通过的NPI。NPI列表中的NPI包括与之连接的所有VF网卡所配置的NPI。网络设备5的端口9配置的NPI列表包括7和8,即VF网卡1和VF网卡2的NPI,端口10配置的NPI列表包括7和8,即VF网卡1和VF网卡2的NPI。网络设备6的端口11配置的NPI列表包括8和9,即VF网卡5和VF网卡6的NPI。网络设备6从报文的报文头的网络分区标识字段获取NPI,当需要从端口9经过的报文的网络分区标识字段的值为7或8时,则允许报文通过,否则丢弃报文,端口10同理。网络设备6的检查方式同理,此处不再赘述。
发送报文的源网卡在报文中添加自身配置的NPI,接收报文的目的网卡比对报文中的NPI与自身配置的NPI是否一致,一致时通过报文,不一致时丢弃报文,实现了相同网络分区内的流量互通,不同网络分区之间的流量隔离,网卡执行简单的操作即可达到网络隔离的目的,无需网络设备因网络隔离而执行隧道匹配、为报文添加隧道封装头和剥除隧道封装头等复杂的隔离操作,也无需网络设备实现防火墙等隔离功能,能够降低网络设备的硬件复杂度,以及提升网络设备的转发性能。
本申请还提供一种网卡,用于实现上述的网络隔离***和网络隔离方法中的目的网卡的功能。如图12所示,图12为本申请提供的网卡一实施例的结构示意图。本实施例所述的网卡1200为基于物理网卡的物理资源实现报文收发及第一NPI剥除处理的网卡。网卡1200包括存储模块1201,收发模块1202和处理模块1203。
其中,存储模块1201,用于存储该网卡配置的第二网络分区标识。
收发模块1202,用于接收IP网络中的网络设备转发的目标报文,目标报文包括单层报文头,报文头中包括发送目标报文的网卡添加的第一NPI,第一NPI为发送目标报文的网卡所配置NPI。
处理模块1203,用于获取报文头中的第一NPI,并在第一NPI与第二NPI不同时,丢弃目标报文。
在一种可能实现的方式中,第一NPI和第二NPI对与收发模块1202连接的端侧设备不可见。
在一种可能实现的方式中,处理模块1203,还用于在第一NPI与第二NPI相同时,剥除目标报文的报文头中的第一NPI。收发模块1203,还用于向与收发模块1202连接的端侧设备发送剥除第一NPI后的目标报文。
在一种可能实现的方式中,收发模块1202,还用于接收来自网络设备中的第二边缘网络设备的第二控制消息,第二边缘网络设备为与收发模块1202连接的设备,第二控制消息中包括第二NPI,第二控制消息为第二边缘网络设备接收到来自网络管理设备的第二NPI后生成的。处理模块1203,还用于根据第二控制消息配置第二NPI。
在一种可能实现的方式中,网卡为物理网卡,与网卡连接的端侧设备为物理机;或网卡为直通端侧设备的VF网卡或PF网卡,端侧设备为虚拟机或容器。
可以理解,本实施例中的处理模块1203并非仅仅对来自其他网卡的目标报文执行上述的处理,对于
来自与网卡1200连接的端侧设备的待发送数据,处理模块1203也可以对该待发送数据进行处理,得到报文头中包括第二NPI的报文,再通过收发模块1203和网络设备向该报文的目的地发送。
本申请还提供一种网卡,用于实现上述的网络隔离***和网络隔离方法中的源网卡的功能。如图13所示,图13为本申请提供的网卡一实施例的结构示意图。本实施例所述的网卡1300为基于物理网卡的物理资源实现报文收发及第一NPI添加处理的网卡。网卡1300包括存储模块1301,收发模块1302和处理模块1303。
存储模块1301,用于存储该网卡配置的第一网络分区标识。处理模块1303,用于对待发送数据进行处理,得到第二目标报文,第二目标报文包括单层报文头,报文头包括处理模块添加的第二网络分区标识。
收发模块1302,用于通过IP网络中的网络设备发送目标报文,以使接收目标报文的网卡在第二网络分区标识与目标报文的报文头中的第一网络分区标识不同时丢弃目标报文,第二网络分区标识为接收目标报文的网卡所配置的网络分区标识。
在一种可能实现的方式中,第二网络分区标识位于链路层头。待发送数据为未进行封装处理的应用数据。处理模块1303,用于为待发送数据封装包括第一网络分区标识的报文头,得到目标报文。
在一种可能实现的方式中,待发送数据包括原始报文头,原始报文头中不包括第一网络分区标识。处理模块1303,用于将第一网络分区标识***原始报文头中,得到目标报文。
在一种可能实现的方式中,目标报文的报文头包括链路层头和IP网络头,第一网络分区标识位于链路层头或IP网络头中。
在一种可能实现的方式中,收发模块1302,还用于接收来自网络设备中的边缘网络设备的控制消息,边缘网络设备为与收发模块1302连接的网络设备,控制消息中包括第一网络分区标识,控制消息为边缘网络设备接收到来自网络管理设备的第一网络分区标识后生成的。处理模块1303,还用于根据控制消息配置第一网络分区标识。
在一种可能实现的方式中,网卡为物理网卡,与网卡连接的端侧设备为物理机;或网卡为直通端侧设备的VF网卡或PF网卡,端侧设备为虚拟机或容器。
可以理解,本实施例中的处理模块1303并非仅仅对来待发送数据执行上述的处理,对于来自网络设备转发的报文,处理模块1303也可以获取该报文的报文头中的NPI,并将该NPI与自身的第二NPI进行比对,一致时剥除该报文中的NPI后发送至与网卡1300连接的端侧设备,不一致时则丢弃该报文。
本申请还提供一种网络设备,用于实现上述的网络隔离***和网络隔离方法中的网络设备的功能。如图14所示,图14为本申请提供的网络设备一实施例的结构示意图。网络设备1400包括收发模块1401。
收发模块1401,用于接收源网卡发送的目标报文,目标报文为源网卡对待发送数据进行处理得到的,目标报文包括单报文头,报文头中包括源网卡添加的第一网络分区标识,第一网络分区标识为源网卡所配置网络分区标识。收发模块1401,还用于根据报文头中的目的地址信息向目的网卡转发目标报文,网络设备转发目标报文时保留报文头中的第一网络分区标识,以使目的网卡接收目标报文后从报文头中获取第一网络分区标识,并在第一网络分区标识与第二网络分区标识不同时,丢弃目标报文,第二网络分区标识为目的网卡所配置网络分区标识。
在一种可能实现的方式中,第一网络分区标识不用于目标报文的转发。
在一种可能实现的方式中,网络设备1400为与源网卡连接的第一边缘网络设备,第一边缘网络设备还包括处理模块1402。处理模块1402,用于获取来自网络管理设备的第一网络分区标识。处理模块1402,用于根据第一网络分区标识生成第一控制消息,第一控制消息包括第一网络分区标识。收发模块1401,用于向源网卡发送第一控制消息,以使源网卡根据第一控制消息配置第一网络分区标识。
在一种可能实现的方式中,网络设备1400为与目的网卡连接的第二边缘网络设备,第二边缘网络设备还包括处理模块1402;处理模块1402,用于获取来自网络管理设备的第一网络分区标识;处理模块,用于根据第二网络分区标识生成第二控制消息,第二控制消息包括第二网络分区标识。收发模块1401,用于向源网卡发送第二控制消息,以使目的网卡根据第二控制消息配置第二网络分区标识。
在一种可能实现的方式中,第一控制消息和第二控制消息中不包括IP地址。
在一种可能实现的方式中,网络设备1400为与源网卡连接的第一边缘网络设备,第一边缘网络设备还包括处理模块1402。处理模块1402,用于获取报文头中的第一网络分区标识。处理模块1402,用于在
第一网络分区标识为允许通过的网络分区标识时,允许收发模块1401向目的网卡转发目标报文,或在第一网络分区标识不为允许通过的网络分区标识时丢弃目标报文。
在一种可能实现的方式中,网络设备1400为与目的网卡连接的第二边缘网络设备,第二边缘网络设备还包括处理模块1402。处理模块1402,用于获取报文头中的第一网络分区标识。处理模块1402,用于在第一网络分区标识为允许通过的网络分区标识时,允许收发模块1401向目的网卡转发目标报文,或在第一网络分区标识不为允许通过的网络分区标识时丢弃目标报文。
在一种可能实现的方式中,报文头包括链路层头和IP网络头,第一网络分区标识位于链路层头或IP网络头中。
如图15所示,图15为本申请提供的网络设备另一实施例的结构示意图。该网络设备1500包括处理器1501和物理端口1502,处理器1501与物理端口1502连接,物理端口1502用于接收和发送目标报文,处理器1501用于执行指令,使得网络设备执行上述的网络隔离方法中网络设备的操作。
如图16所示,图16为本申请提供的网卡另一实施例的结构示意图。该网卡1600包括处理器1601和物理网口1602,处理器1601与物理网口1602连接,物理网口1602用于接收和发送目标报文,处理器1601用于执行上述的网络隔离方法中目的网卡或源网卡的操作。
如图17所示,图17为本申请提供的计算机设备一实施例的结构示意图。该计算机设备1700包括处理器1701、存储器1702、通信总线1703和如图12或图15中的网卡1704,处理器1701、存储器1702和网卡1704通过通信总线1703互相连接。
当网络隔离对象为计算机设备1700,即物理机时,网卡1704为物理网卡。网卡1704配置有NPI,在获取来自计算机设备1700的待发送数据后,对待发送数据进行处理,得到报文头中包括该网卡的NPI的目标报文。网卡通过IP网络中的网络设备向目标报文的目的端侧设备发送该目标报文。从而,目的端设备连接的目的网卡能够在目标报文中的NPI与自身配置的NPI不一致时,丢弃该目标报文,从而实现端到端的网络隔离。同样地,网卡1704在接收到来自其他端侧设备的目标报文时,从目标报文的报文头中获取NPI,并将报文头中的NPI与自身配置的NPI进行比对,不一致则丢弃该目标报文,隔绝异常流量,实现非同一网络分区的数据流的隔离。在报文头中的NPI与自身配置的NPI一致时,网卡1704将其中的NPI剥除后再将目标报文发送给计算机设备1700的上层,以避免NPI暴露给租户,造成NPI泄露影响网络隔离的安全性。
当网络隔离对象为计算机设备1700中虚拟出的虚拟机或容器时,网卡1704可以虚拟为多个VF网卡和PF网卡,并直通给虚拟机或容器。VF网卡/PF网卡配置NPI,用于直通的虚拟机或容器的网络隔离。基于NPI实现的网络隔离方法参阅以上描述,故此处不再赘述。
从而,本方案端到端的网络隔离,能够再保证网络隔离安全可靠的前提下,简化隔离操作,降低报文处理时延,以及网络传输时延,具有更好的转发性能,相比于封装用于网络隔离的隧道封装头实现网络隔离,还能够节约网络带宽。
本申请还提供了一种计算机可读存储介质,其上存储有计算机程序,该计算机程序被网卡执行时实现上述任一方法实施例的网络隔离方法中网卡的相关操作。
本申请还提供了一种计算机可读存储介质,其上存储有计算机程序,该计算机程序被网络设备执行时实现上述任一方法实施例的网络隔离方法中网络设备的相关操作。
所属领域的技术人员可以清楚地了解到,为描述的方便和简洁,上述描述的***,装置和单元的具体工作过程,可以参考前述方法实施例中的对应过程,在此不再赘述。
在本申请所提供的几个实施例中,应该理解到,所揭露的***,装置和方法,可以通过其它的方式实现。例如,以上所描述的装置实施例仅仅是示意性的,例如,所述单元的划分,仅仅为一种逻辑功能划分,实际实现时可以有另外的划分方式,例如多个单元或组件可以结合或者可以集成到另一个***,或一些特征可以忽略,或不执行。另一点,所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口,装置或单元的间接耦合或通信连接,可以是电性或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的,作为单元显示的部件可以是或者也可以不是物理单元,即可以位于一个地方,或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外,在本申请各个实施例中的各功能单元可以集成在一个处理单元中,也可以是各个单元单独物理存在,也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现,也可以采用软件功能单元的形式实现。
所述集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时,可以存储在一个计算机可读取存储介质中。基于这样的理解,本申请的技术方案的全部或部分可以以软件产品的形式体现出来,该计算机软件产品存储在一个存储介质中,包括若干指令用以使得一台计算机设备(可以是个人计算机,服务器,或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括:U盘、移动硬盘、只读存储器(ROM,read-only memory)、随机存取存储器(RAM,random access memory)、磁碟或者光盘等各种可以存储程序代码的介质。
Claims (62)
- 一种网络隔离***,其特征在于,所述***包括与源端设备连接的源网卡、与目的端设备连接的目的网卡和网络设备,所述源网卡和所述目的网卡通过互联网协议IP网络连接,所述网络设备为所述IP网络中的设备;所述源网卡,用于对待发送数据进行处理,得到目标报文,所述目标报文包括单层报文头,所述报文头中包括所述源网卡添加的第一网络分区标识,所述第一网络分区标识为所述源网卡所配置网络分区标识;所述源网卡,还用于通过所述网络设备向所述目的网卡发送目标报文;所述网络设备,用于根据所述报文头中的地址信息向所述目的网卡转发所述目标报文;所述目的网卡,用于接收所述目标报文后获取所述报文头中的所述第一网络分区标识,并在所述第一网络分区标识与第二网络分区标识不同时,丢弃所述目标报文,所述第二网络分区标识为所述目的网卡所配置网络分区标识。
- 根据权利要求1所述的***,其特征在于,所述待发送数据为未进行封装处理的应用数据;所述源网卡,用于为所述待发送数据封装包括所述第一网络分区标识的所述报文头,得到所述目标报文。
- 根据权利要求1所述的***,其特征在于,所述待发送数据包括原始报文头,所述原始报文头中不包括所述第一网络分区标识;所述源网卡,用于将所述第一网络分区标识***所述原始报文头中,得到所述目标报文。
- 根据权利要求1至3中任一项所述的***,其特征在于,所述报文头包括链路层头和IP网络头,所述第一网络分区标识位于所述链路层头或所述IP网络头中。
- 根据权利要求1至4中任一项所述的***,其特征在于,所述第一网络分区标识不用于所述目标报文的转发。
- 根据权利要求1至5中任一项所述的***,其特征在于,所述第一网络分区标识和所述第二网络分区标识对所述源端设备和所述目的端设备均不可见。
- 根据权利要求1至6中任一项所述的***,其特征在于,所述***还包括网络管理设备,所述网络设备包括与所述源网卡连接的第一边缘网络设备,以及与所述目的网卡连接的第二边缘网络设备;所述网络管理设备,具体用于向所述第一边缘网络设备发送所述第一网络分区标识,以及向所述第二边缘网络设备发送所述第二网络分区标识;所述第一边缘网络设备,还用于向所述源网卡发送第一控制消息,所述第一控制消息包括所述第一网络分区标识;所述第二边缘网络设备,还用于向所述目的网卡发送第二控制消息,所述第二控制消息包括所述第二网络分区标识;所述源网卡,还用于根据所述第一控制消息配置所述第一网络分区标识;所述目的网卡,还用于根据所述第二控制消息配置所述第二网络分区标识。
- 根据权利要求7所述的***,其特征在于,所述第一控制消息和所述第二控制消息中不包括IP地址。
- 根据权利要求1至7中任一项所述的***,其特征在于,所述目的网卡,还用于在所述第一网络分区标识与所述第二网络分区标识相同时,剥除所述目标报文中的所述第一网络分区标识;所述目的网卡,还用于向与所述目的端设备发送剥除所述第一网络分区标识后的所述目标报文。
- 根据权利要求1至8中任一项所述的***,其特征在于,所述网络设备包括第二边缘网络设备,所述第二边缘网络设备的第一端口连接所述目的网卡;所述第二边缘网络设备,用于接收所述目标报文,并获取所述报文头中的所述第一网络分区标识;所述第二边缘网络设备,还用于在所述第一网络分区标识为所述第一端口允许通过的网络分区标识时,通过所述第一端口向所述目的网卡转发所述目标报文,或在所述第一网络分区标识不为所述第一端口允许通过的网络分区标识时丢弃所述目标报文。
- 根据权利要求1至9中任一项所述的***,其特征在于,所述网络设备包括第一边缘网络设备,所述第一边缘网络设备的第二端口连接所述源网卡;所述第一边缘网络设备,用于接收所述目标报文,并获取所述报文头中的所述第一网络分区标识;所述第一边缘网络设备,还用于在所述第一网络分区标识为所述第二端口允许通过的网络分区标识时,向所述目的网卡转发所述目标报文,或在所述第一网络分区标识不为所述第二端口允许通过的网络分区标识时丢弃所述目标报文。
- 根据权利要求1至10中任一项所述的***,其特征在于,所述源端设备为物理机,所述源网卡为物理网卡;或所述源端设备为虚拟设备,所述源网卡为所述虚拟设备直通的虚拟功能VF网卡或物理功能PF网卡,所述虚拟设备为虚拟机或容器;所述目的端设备为所述物理机,所述目的网卡为物理网卡;或所述目的端设备为所述虚拟设备,所述目的网卡为所述虚拟设备直通的VF网卡或PF网卡。
- 一种网卡,其特征在于,所述网卡包括:存储模块,用于存储所述网卡配置的第二网络分区标识;收发模块,用于接收IP网络中的网络设备转发的目标报文,所述目标报文包括单层报文头,所述报文头中包括发送所述目标报文的网卡添加的第一网络分区标识,所述第一网络分区标识为所述发送所述目标报文的网卡所配置的网络分区标识;处理模块,用于获取所述报文头中的所述第一网络分区标识,并在所述第一网络分区标识与所述第二网络分区标识不同时,丢弃所述目标报文。
- 根据权利要求13所述的网卡,其特征在于,所述第一网络分区标识和所述第二网络分区标识对与所述收发模块连接的端侧设备不可见。
- 根据权利要求13或14所述的网卡,其特征在于,所述处理模块,还用于在所述第一网络分区标识与第二网络分区标识相同时,剥除所述目标报文的报文头中的所述第一网络分区标识;所述收发模块,还用于向与所述收发模块连接的端侧设备发送剥除所述第一网络分区标识后的所述目标报文。
- 根据权利要求13至15中任一项所述的网卡,其特征在于,所述收发模块,还用于接收来自所述网络设备中的第二边缘网络设备的第二控制消息,所述第二边缘网络设备为与所述收发模块连接的网络设备,所述第二控制消息中包括所述第二网络分区标识,所述第二控制消息为所述第二边缘网络设备接收到来自网络管理设备的所述第二网络分区标识后生成的;所述处理模块,还用于根据所述第二控制消息配置所述第二网络分区标识。
- 根据权利要求13至16中任一项所述的网卡,其特征在于,所述网卡为物理网卡,与所述网卡连接的端侧设备为物理机;或所述网卡为直通所述端侧设备的VF网卡或PF网卡,所述端侧设备为虚拟机或容器。
- 根据权利要求13至17中任一项所述的网卡,其特征在于,所述目标报文的报文头包括链路层头和IP网络头,所述第一网络分区标识位于所述链路层头或所述IP网络头中。
- 一种网卡,其特征在于,所述网卡包括:存储模块,用于存储所述网卡配置的第一网络分区标识;处理模块,用于对待发送数据进行处理,得到目标报文,所述目标报文包括单层报文头,所述报文头中包括所述处理模块添加的所述第一网络分区标识;收发模块,用于通过IP网络中的网络设备发送所述目标报文,以使接收所述目标报文的网卡在第二网络分区标识与所述报文头中的所述第一网络分区标识不同时丢弃所述目标报文,所述第二网络分区标识为所述接收所述目标报文的网卡所配置的网络分区标识。
- 根据权利要求19所述的网卡,其特征在于,待发送数据为未进行封装处理的应用数据;所述处理模块,用于为所述待发送数据封装包括所述第一网络分区标识的所述报文头,得到所述目标报文。
- 根据权利要求19所述的网卡,其特征在于,所述待发送数据包括原始报文头,所述原始报文头中不包括所述第一网络分区标识;所述处理模块,用于将所述第一网络分区标识***所述原始报文头中,得到所述目标报文。
- 根据权利要求19至21中任一项所述的网卡,其特征在于,所述目标报文的报文头包括链路层头和IP网络头,所述第一网络分区标识位于所述链路层头或所述IP网络头中。
- 根据权利要求19至22中任一项所述的网卡,其特征在于,所述收发模块,还用于接收来自所述网络设备中的边缘网络设备的控制消息,所述边缘网络设备为与所述收发模块连接的网络设备,所述控制消息中包括所述第一网络分区标识,所述控制消息为所述边缘网络设备接收到来自网络管理设备的所述第一网络分区标识后生成的;所述处理模块,还用于根据所述控制消息配置所述第一网络分区标识。
- 一种网络隔离方法,其特征在于,所述方法包括:目的网卡接收IP网络中的网络设备转发的目标报文,所述目标报文为源网卡对待发送数据进行处理得到的,所述目标报文包括单层报文头,所述报文头中包括所述源网卡添加的第一网络分区标识,所述第一网络分区标识为所述源网卡所配置网络分区标识;所述目的网卡获取所述报文头中的所述第一网络分区标识;所述目的网卡在所述第一网络分区标识与第二网络分区标识不同时,丢弃所述目标报文,所述第二网络分区标识为所述目的网卡所配置网络分区标识。
- 根据权利要求24所述的方法,其特征在于,所述报文头包括链路层头和IP网络头,所述第一网络分区标识位于所述链路层头或所述IP网络头中。
- 根据权利要求24或25所述的方法,其特征在于,所述第一网络分区标识和所述第二网络分区标识对与源端设备和目的端设备均不可见,所述源端设备为与所述源网卡连接的端侧设备,所述目的端设备为与所述目的网卡连接的端侧设备。
- 根据权利要求24至26中任一项所述的方法,其特征在于,所述目的网卡接收来自所述网络设备中的第二边缘网络设备的第二控制消息,所述第二边缘网络设备为与所述目的网卡连接的设备,所述第二控制消息中包括所述第二网络分区标识,所述第二控制消息为所述第二网络设备接收到来自网络管理设备的所述第二网络分区标识后生成的;所述目的网卡根据所述控制消息完成所述第二网络分区标识的配置。
- 根据权利要求27所述的方法,其特征在于,所述控制消息不包括IP地址。
- 根据权利要求24至28中任一项所述的方法,其特征在于,所述目的网卡在所述第一网络分区标识与所述第二网络分区标识相同时,剥除所述目标报文中的所述第一网络分区标识;所述目的网卡向与所述目的网卡连接的目的端设备发送剥除所述第一网络分区标识后的所述目标报文。
- 根据权利要求24至29中任一项所述的方法,其特征在于,所述目的网卡为物理网卡,与所述目的网卡连接的目的端设备为物理机;或所述目的网卡为直通所述目的端设备的VF网卡或PF网卡,所述目的端设备为虚拟机或容器。
- 一种网络隔离方法,其特征在于,所述方法包括:源网卡对待发送数据进行处理,得到目标报文,所述目标报文包括单层报文头,所述报文头中包括所述源网卡添加的第一网络分区标识,所述第一网络分区标识为所述源网卡所配置网络分区标识;所述源网卡通过IP网络中的网络设备向目的网卡发送目标报文,以使所述目的网卡接收到所述目标报文后获取所述报文头中的所述第一网络分区标识,并在所述第一网络分区标识与第二网络分区标识不同时,丢弃所述目标报文,所述第二网络分区标识为所述目的网卡所配置网络分区标识。
- 根据权利要求31所述的方法,其特征在于,所述待发送数据为未进行封装处理的应用数据;所述源网卡为所述待发送数据封装包括所述第一网络分区标识的所述报文头,得到所述目标报文。
- 根据权利要求31所述的方法,其特征在于,所述待发送数据包括原始报文头,所述原始报文头中不包括所述第一网络分区标识;所述源网卡,用于将所述第一网络分区标识***所述原始报文头中,得到所述目标报文。
- 根据权利要求31至33中任一项所述的方法,其特征在于,所述报文头包括链路层头和IP网络头,所述第一网络分区标识位于所述链路层头或所述IP网络头中。
- 根据权利要求31至34中任一项所述的方法,其特征在于,所述第一网络分区标识和所述第二网络 分区标识对源端设备和目的端设备均不可见,所述源端设备为与所述源网卡连接的端侧设备,所述目的端设备为与所述目的网卡连接的端侧设备。
- 根据权利要求31至35中任一项所述的方法,其特征在于,所述源网卡接收来自所述网络设备中的第一边缘网络设备的第一控制消息,所述第一边缘网络设备为与所述源网卡连接的设备,所述第一控制消息中包括所述第一网络分区标识,所述第一控制消息为所述第一网络设备接收到来自网络管理设备的所述第一网络分区标识后生成的;所述源网卡根据所述控制消息完成所述第一网络分区标识的配置。
- 根据权利要求36所述的方法,其特征在于,所述控制消息不包括IP地址。
- 根据权利要求31至37中任一项所述的方法,其特征在于,所述源网卡为物理网卡,与所述源网卡连接的源端设备为物理机;或所述源端设备为虚拟设备,所述源网卡为所述虚拟设备直通的VF网卡或PF网卡,所述虚拟设备为虚拟机或容器。
- 一种网络隔离方法,其特征在于,所述方法包括:网络设备接收源网卡发送的目标报文,所述目标报文为所述源网卡对待发送数据进行处理得到的,所述目标报文包括单层报文头,所述报文头中包括所述源网卡添加的第一网络分区标识,所述第一网络分区标识为所述源网卡所配置网络分区标识,所述网络设备为IP网络中的设备;所述网络设备根据所述报文头中的目的地址信息向目的网卡转发所述目标报文,所述网络设备转发所述目标报文时保留所述报文头中的所述第一网络分区标识,以使所述目的网卡接收所述目标报文后从所述报文头中获取所述第一网络分区标识,并在所述第一网络分区标识与第二网络分区标识不同时,丢弃所述目标报文,所述第二网络分区标识为所述目的网卡所配置网络分区标识。
- 根据权利要求39所述的方法,其特征在于,所述第一网络分区标识不用于所述目标报文的转发。
- 根据权利要求39或40所述的方法,其特征在于,所述报文头包括链路层头和IP网络头,所述第一网络分区标识位于所述链路层头或所述IP网络头中。
- 根据权利要求39至41所述的方法,其特征在于,所述网络设备包括与所述源网卡连接的第一边缘网络设备,以及与所述目的网卡连接的第二边缘网络设备,所述方法还包括:所述第一边缘网络设备获取来自网络管理设备的第一网络分区标识;所述第一边缘网络设备向所述源网卡发送第一控制消息,所述第一控制消息包括所述第一网络分区标识,以使所述源网卡根据所述第一控制消息配置所述第一网络分区标识;所述第二边缘网络设备获取来自所述网络管理设备的第二网络分区标识;所述第二边缘网络设备向所述目的网卡发送第二控制消息,所述第二控制消息包括所述第二网络分区标识,以使所述目的网卡根据所述第二控制消息配置所述第二网络分区标识。
- 根据权利要求42所述的方法,其特征在于,所述第一控制消息和所述第二控制消息中不包括IP地址。
- 根据权利要求39至43中任一项所述的方法,其特征在于,所述网络设备包括与所述目的网卡连接的第二边缘网络设备,所述第二边缘网络设备的第一端口连接所述目的网卡,所述方法还包括:所述第二边缘网络设备接收所述目标报文,并获取所述报文头中的所述第一网络分区标识;所述第二边缘网络设备在所述第一网络分区标识为所述第一端口允许通过的网络分区标识时,通过所述第一端口向所述目的网卡转发所述目标报文,或在所述第一网络分区标识不为所述第一端口允许通过的网络分区标识时丢弃所述目标报文。
- 根据权利要求39至44中任一项所述的方法,其特征在于,所述网络设备包括与所述源网卡连接的第一边缘网络设备,所述第一边缘网络设备的第二端口连接所述源网卡,所述方法还包括:所述第一边缘网络设备接收所述目标报文,并获取所述报文头中的所述第一网络分区标识;所述第一边缘网络设备在所述第一网络分区标识为所述第二端口允许通过的网络分区标识时,向所述目的网卡转发所述目标报文,或在所述第一网络分区标识不为所述第二端口允许通过的网络分区标识时丢弃所述目标报文。
- 一种网络隔离方法,其特征在于,所述方法包括:所述源网卡对待发送数据进行处理,得到目标报文,所述目标报文包括单层报文头,所述报文头中包 括所述源网卡添加的第一网络分区标识,所述第一网络分区标识为所述源网卡所配置网络分区标识;所述源网卡通过IP网络中的网络设备向所述目的网卡发送目标报文;所述网络设备向所述目的网卡转发所述目标报文;所述目的网卡接收所述目标报文后获取所述报文头中的所述第一网络分区标识,并在所述第一网络分区标识与第二网络分区标识不同时,丢弃所述目标报文,所述第二网络分区标识为所述目的网卡所配置网络分区标识。
- 一种网络设备,其特征在于,所述网络设备为IP网络中的设备,所述网络设备包括:收发模块,用于接收源网卡发送的目标报文,所述目标报文为所述源网卡对待发送数据进行处理得到的,所述目标报文包括单层报文头,所述报文头中包括所述源网卡添加的第一网络分区标识,所述第一网络分区标识为所述源网卡所配置网络分区标识;所述收发模块,还用于根据所述报文头中的目的地址信息向目的网卡转发所述目标报文,所述网络设备转发所述目标报文时保留所述报文头中的所述第一网络分区标识,以使所述目的网卡接收所述目标报文后从所述报文头中获取所述第一网络分区标识,并在所述第一网络分区标识与第二网络分区标识不同时,丢弃所述目标报文,所述第二网络分区标识为所述目的网卡所配置网络分区标识。
- 根据权利要求47所述的网络设备,其特征在于,所述第一网络分区标识不用于所述目标报文的转发。
- 根据权利要求47或48所述的网络设备,其特征在于,所述报文头包括链路层头和IP网络头,所述第一网络分区标识位于所述链路层头或所述IP网络头中。
- 根据权利要求47至49所述的网络设备,其特征在于,所述网络设备为与所述源网卡连接的第一边缘网络设备,所述第一边缘网络设备还包括处理模块;所述处理模块,用于获取来自网络管理设备的第一网络分区标识;所述处理模块,用于根据所述第一网络分区标识生成第一控制消息,所述第一控制消息包括所述第一网络分区标识;所述收发模块,用于向所述源网卡发送第一控制消息,以使所述源网卡根据所述第一控制消息配置所述第一网络分区标识。
- 根据权利要求47至49所述的网络设备,其特征在于,所述网络设备为与所述目的网卡连接的第二边缘网络设备,所述第二边缘网络设备还包括处理模块;所述处理模块,用于获取来自网络管理设备的第一网络分区标识;所述处理模块,用于根据所述第二网络分区标识生成第二控制消息,所述第二控制消息包括所述第二网络分区标识;所述收发模块,用于向所述源网卡发送所述第二控制消息,以使所述目的网卡根据所述第二控制消息配置所述第二网络分区标识。
- 根据权利要求50或51所述的网络设备,其特征在于,所述第一控制消息和所述第二控制消息中不包括IP地址。
- 根据权利要求47至50中任一项所述的网络设备,其特征在于,所述网络设备为与所述源网卡连接的第一边缘网络设备,所述第一边缘网络设备还包括处理模块;所述处理模块,用于获取所述报文头中的所述第一网络分区标识;所述处理模块,用于在所述第一网络分区标识为允许通过的网络分区标识时,允许所述收发模块向所述目的网卡转发所述目标报文,或在所述第一网络分区标识不为允许通过的网络分区标识时丢弃所述目标报文。
- 根据权利要求47至49、51中任一项所述的网络设备,其特征在于,所述网络设备为与所述目的网卡连接的第二边缘网络设备,所述第二边缘网络设备还包括处理模块;所述处理模块,用于获取所述报文头中的所述第一网络分区标识;所述处理模块,用于在所述第一网络分区标识为允许通过的网络分区标识时,允许所述收发模块向所述目的网卡转发所述目标报文,或在所述第一网络分区标识不为允许通过的网络分区标识时丢弃所述目标报文。
- 一种网络设备,其特征在于,所述网络设备为IP网络中的设备,所述网络设备包括处理器和物理端口,所述处理器与所述物理端口连接,所述物理端口用于接收和发送目标报文,所述处理器用于执行指令,使得所述网络设备执行如权利要求39至45中任一项所述的方法。
- 一种网卡,其特征在于,所述网卡包括处理器和物理网口,所述处理器与所述物理网口连接,所述物理网口用于接收和发送目标报文,所述处理器用于执行如权利要求24至38中任一项所述的方法。
- 一种计算机设备,其特征在于,所述计算机设备包括处理器、存储器、通信总线和如权利要求13至23、56中任一项所述的网卡,所述处理器、存储器和网卡通过所述通信总线互相连接。
- 一种报文结构,其特征在于,报文的报文结构包括单层报文头和载荷,所述报文头包括链路层头和IP网络头;其中,所述链路层头或所述IP网络头中包括网络分区标识字段,所述网络分区标识字段用于承载发送所述报文的源网卡配置的第一网络分区标识,所述第一网络分区标识用于在接收所述报文的目的网卡确定所述链路层头或所述IP网络头中的所述第一网络分区标识与自身配置的第二网络分区标识不同时,丢弃所述报文。
- 根据权利要求58所述的报文结构,其特征在于,所述第一网络分区标识还用于在所述目的网卡确定所述链路层头或所述IP网络头中的所述第一网络分区标识与所述第二网络分区标识不同时,允许所述报文通过。
- 根据权利要求58或59所述的报文结构,其特征在于,所述IP网络头为IPv6网络头,所述网络分区标识字段位于所述IPv6网络头的IPv6扩展头。
- 一种计算机可读存储介质,其特征在于,包括计算机程序指令,当所述计算机程序指令由网卡执行时,所述网卡执行如权利要求24至38中任一项所述的方法。
- 一种计算机可读存储介质,其特征在于,包括计算机程序指令,当所述计算机程序指令由网络设备执行时,所述网络设备执行如权利要求39至45中任一项所述的方法。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202211084978.1 | 2022-09-06 | ||
CN202211084978.1A CN117675258A (zh) | 2022-09-06 | 2022-09-06 | 网络隔离方法、***及相关设备 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2024051321A1 true WO2024051321A1 (zh) | 2024-03-14 |
Family
ID=90070155
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2023/104840 WO2024051321A1 (zh) | 2022-09-06 | 2023-06-30 | 网络隔离方法、***及相关设备 |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN117675258A (zh) |
WO (1) | WO2024051321A1 (zh) |
Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN105791304A (zh) * | 2016-03-31 | 2016-07-20 | 联想(北京)有限公司 | 一种报文处理方法及设备 |
CN105915427A (zh) * | 2016-03-31 | 2016-08-31 | 华为技术有限公司 | 一种报文发送、接收方法及设备 |
CN108011824A (zh) * | 2016-11-02 | 2018-05-08 | 华为技术有限公司 | 一种报文处理方法以及网络设备 |
CN110650075A (zh) * | 2018-06-26 | 2020-01-03 | 华为技术有限公司 | 基于vxlan的组策略实现方法、网络设备和组策略实现*** |
CN112243046A (zh) * | 2019-07-19 | 2021-01-19 | 华为技术有限公司 | 通信方法和网卡 |
WO2022055614A1 (en) * | 2020-09-14 | 2022-03-17 | Microsoft Technology Licensing, Llc | Software defined networking operations for programmable connected devices |
-
2022
- 2022-09-06 CN CN202211084978.1A patent/CN117675258A/zh active Pending
-
2023
- 2023-06-30 WO PCT/CN2023/104840 patent/WO2024051321A1/zh unknown
Patent Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN105791304A (zh) * | 2016-03-31 | 2016-07-20 | 联想(北京)有限公司 | 一种报文处理方法及设备 |
CN105915427A (zh) * | 2016-03-31 | 2016-08-31 | 华为技术有限公司 | 一种报文发送、接收方法及设备 |
CN108011824A (zh) * | 2016-11-02 | 2018-05-08 | 华为技术有限公司 | 一种报文处理方法以及网络设备 |
CN110650075A (zh) * | 2018-06-26 | 2020-01-03 | 华为技术有限公司 | 基于vxlan的组策略实现方法、网络设备和组策略实现*** |
CN112243046A (zh) * | 2019-07-19 | 2021-01-19 | 华为技术有限公司 | 通信方法和网卡 |
WO2022055614A1 (en) * | 2020-09-14 | 2022-03-17 | Microsoft Technology Licensing, Llc | Software defined networking operations for programmable connected devices |
Also Published As
Publication number | Publication date |
---|---|
CN117675258A (zh) | 2024-03-08 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10862732B2 (en) | Enhanced network virtualization using metadata in encapsulation header | |
US8908704B2 (en) | Switch with dual-function management port | |
US10341263B2 (en) | System and method for routing network frames between virtual machines | |
US10237230B2 (en) | Method and system for inspecting network traffic between end points of a zone | |
US9331936B2 (en) | Switch fabric support for overlay network features | |
JP6445015B2 (ja) | ミドルウェアおよびアプリケーションの実行のためにエンジニアド・システムにおいてデータサービスを提供するためのシステムおよび方法 | |
US8989187B2 (en) | Method and system of scaling a cloud computing network | |
CN113326228B (zh) | 基于远程直接数据存储的报文转发方法、装置及设备 | |
CN111800326B (zh) | 报文传输方法及装置、处理节点及存储介质 | |
EP2615782A1 (en) | Computer system and communication method in computer system | |
WO2018082592A1 (zh) | 一种报文处理方法以及网络设备 | |
JP2008535342A (ja) | オペレーティング・システム・パーティションのためのネットワーク通信 | |
WO2013164707A1 (en) | Providing services to virtual overlay network traffic | |
EP3300322A1 (en) | Method and related apparatus for probing packet forwarding path | |
WO2015149253A1 (zh) | 数据中心的虚拟网络管理方法及数据中心*** | |
US9716688B1 (en) | VPN for containers and virtual machines in local area networks | |
WO2021077995A1 (zh) | 网络切片共享上联口的方法、装置及存储介质 | |
CN114144995B (zh) | 一种用于配置物理服务器的虚拟端口的方法和*** | |
CN107733930B (zh) | 用于在多个wan网络网关处转发互联网协议(ip)数据包的方法和*** | |
US11108594B2 (en) | Implementing three-layer communication | |
WO2024001701A1 (zh) | 数据处理方法、装置及*** | |
WO2024051321A1 (zh) | 网络隔离方法、***及相关设备 | |
KR101867883B1 (ko) | 가상 네트워크를 운용하는 방법, 장치 및 컴퓨터 프로그램 | |
WO2022063065A1 (zh) | 一种路由信息传输方法及装置 | |
WO2022218095A1 (zh) | 一种报文处理方法及相关设备 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 23862022 Country of ref document: EP Kind code of ref document: A1 |