Data transfer method and virtual switch
AssigneeHuawei Cloud Computing Technologies Co., Ltd.
InventorsJing Huang, Cong Xu, Shuai Chen, Yuefei Xu
Life of this patent
Estimating the term…
Abstract
A data transfer method and a virtual switch, where when receiving a data packet, the virtual switch extracts characteristic information of the data packet, and determines, based on the extracted characteristic information of the data packet, whether an expedited forwarding rule is configured for a data stream to which the data packet belongs. If the expedited forwarding rule is configured for the data stream to which the data packet belongs, the virtual switch bypasses a LINUX bridge to directly send the data packet to a receive end, thereby reducing times of data packet switching between a kernel mode and a user mode, and improving data packet forwarding efficiency.
Claims20
A data transfer method implemented by a virtual switch, wherein the data transfer method comprises:
- receiving a first data packet;
- determining, based on characteristic information, whether the first data packet is an Internet Protocol (IP) data packet or a non-IP data packet, wherein the virtual switch determines that the first data packet is the IP data packet when the first data packet has the characteristic information, and wherein the first data packet is the non-IP data packet when the first data packet does not have the characteristic information;
- forwarding, in response to determining that the first data packet is the non-IP data packet, the first data packet to a security verification system;
- extracting, in response to determining that the first data packet is the IP data packet, the characteristic information of the first data packet;
- determining, based on the characteristic information, whether an expedited forwarding rule is configured for a data stream to which the first data packet belongs, wherein the expedited forwarding rule indicates that a second data packet in the data stream has previously been verified by the security verification system with a secure verification result;
- and
- bypassing the security verification system to send the first data packet to a receive end when the expedited forwarding rule is configured for the data stream.
A virtual switch comprising:
- a memory configured to store execution instructions;
- and
- a processor coupled to the memory, wherein the execution instructions cause the processor to be configured to:
- receive a first data packet;
- determine, based on characteristic information, whether the first data packet is an Internet Protocol (IP) data packet or a non-IP data packet, wherein the virtual switch determines that the first data packet is the IP data packet when the first data packet has the characteristic information, and wherein the first data packet is the non-IP data packet when the first data packet does not have the characteristic information;
- forward, in response to determining that the first data packet is the non-IP data packet, the first data packet to a security verification system;
- extract, in response to determining that the first data packet is the IP data packet, the extract characteristic information of the first data packet, wherein the characteristic information comprises IP quintuplet information, and wherein the IP quintuplet information comprises an IP address of a transmit end that sends the first data packet to the virtual switch, an IP address of a receive end, a port number of the transmit end, a port number of the receive end, and a transport layer protocol of the first data packet;
- determine, based on the characteristic information, whether an expedited forwarding rule is configured for a data stream to which the first data packet belongs, wherein the expedited forwarding rule indicates that a second data packet in the data stream has previously been verified by the security verification system with a secure verification result, and wherein the expedited forwarding rule comprises the IP quintuplet information;
- and
- bypass the security verification system to send the first data packet to the receive end when the expedited forwarding rule is configured for the data stream.
A computer program product comprising computer-executable instructions for storage on a non-transitory computer-readable storage medium that, when executed by a processor, cause a virtual switch to:
- receive a first data packet;
- determine, based on characteristic information, whether the first data packet is an Internet Protocol (IP) data packet or a non-IP data packet, wherein the virtual switch determines that the first data packet is the IP data packet when the first data packet has the characteristic information, and wherein the first data packet is the non-IP data packet when the first data packet does not have the characteristic information;
- forward, in response to determining that the first data packet is the non-IP data packet, the first data packet to a security verification system;
- extract, in response to determining that the first data packet is the IP data packet, the extract characteristic information of the first data packet;
- determine, based on the characteristic information, whether an expedited forwarding rule is configured for a data stream to which the first data packet belongs, wherein the expedited forwarding rule indicates that a second data packet in the data stream has previously been verified by the security verification system with a secure verification result;
- and
- bypass the security verification system to send the first data packet to a receive end when the expedited forwarding rule is configured for the data stream.
Dependencies are inferred from the claim text.