DATA PROCESSING METHOD, NETWORK INTERFACE CARD, AND SERVER

• US 20200136998A1
• Filed: 12/27/2019
• Published: 04/30/2020
• Est. Priority Date: 06/30/2017
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Lu, Shengwen
• Granted Patent: US 11,223,579 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: H04L 45/38 Flow based routing
• CPC Class Codes: H04L 49/30 Peripheral units, e.g. input or output ports
• CPC Class Codes: H04L 49/355 Application aware switches, e.g. for HTTP
• CPC Class Codes: H04L 49/70 Virtual switches
• CPC Class Codes: H04L 49/9068 in the network interface card
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload

Abstract

In a data center, a network interface card is utilized to assist processing of data packets. The server comprising a host and the network interface card connected to the host. The host is configured to generate processing information when receiving data packet from the network interface card, and send the processing information to the network interface card. The network interface card is configured to generate an action field and a match field of a session entry to process the data packet, based on the processing information sent by the host and the matching information of the data packet.

Claims

1. A server for data processing, comprising:

a host; and

a network interface card having a host interface for connecting to the host,

wherein the host is configured to;

receive a first data packet sent by the network interface card,

obtain multiple flow entries associated with the first data packet, wherein the multiple flow entries are maintained by a virtual switch operating on the host,

generate processing information according to the multiple flow entries, wherein the processing information indicates a processing operation performed by the host on the first data packet according to the multiple flow entries, and

send the processing information to the network interface card;

the network interface card is configured to;

generate an action field of a first entry according to the processing information; and

generate a match field of the first entry according to matching information of the first data packet, wherein the matching information matches the multiple flow entries, and

the first entry records a rule used by the network interface card to process succeeding data packets that match the first entry.

2. The server according to claim 1, wherein the network interface card is further configured to:

receive a succeeding data packet, wherein the succeeding data packet comprises same matching information as the first data packet; and

obtain, according to the matching information, the first entry that matches the succeeding data packet; and

process the succeeding data packet according to the action field of the first entry.

3. The server according to claim 1, wherein before the host receives the first data packet sent by the network interface card, the network interface card is further configured to:

receive the first data packet, wherein the first data packet is transmitting between a virtual machine running on the host and an external network via the network interface card;

obtain a recorded entry according to the matching information, and

send the first data packet to the host when finding no entry that matches the first data packet.

4. The server according to claim 1, wherein the host is further configured to:

obtain a security group rule that matches the first data packet; and

send, to the network interface card, the security group rule that matches the first data packet;

wherein the network interface card is further configured to;

obtain the security group rule that matches the first data packet, and write the security group rule into the action field of the first entry.

5. The server according to claim 4, wherein when the security group rule comprises a firewall rule that allows a forward data packet and a reverse data packet to pass, and the forward data packet is sent from a virtual machine running on the host to an external network via the network interface card;

wherein the network interface card is further configured to;

create a second entry, and

generate a match field of the second entry according to the matching information of the first data packet, wherein the second entry matches a reverse data flow of the first data packet.

6. The server according to claim 1, wherein the host is further configured to:

modify one of the multiple flow entries;

send a modification instruction to the network interface card, the modification instruction indicating a modification operation performed by the host on one of the multiple flow entries; and

wherein the network interface card is further configured to modify the first entry according to the modification instruction.

7. A data processing method performed by a network interface card in a data center, comprising:

sending, a first data packet to a host of the data center;

receiving processing information from the host, wherein the processing information indicates a processing operation performed by the host on the first data packet according to multiple flow entries that match the first data packet;

generating an action field of a first entry according to the processing information; and

generating, a match field of the first entry according to matching information of the first data packet, wherein the matching information matches the multiple flow entries, and the first entry records a rule used by the network interface card to process succeeding data packets that match the first entry.

8. The method according to claim 7, wherein the method further comprises:

receiving a succeeding data packet, wherein the succeeding data packet comprises same matching information as the first data packet; and

obtaining the first entry that matches the succeeding data packet according to the matching information, and

processing the succeeding data packet according to the action field of the first entry.

9. The method according to claim 7, wherein before sending a first data packet to a host, the method further comprises:

receiving the first data packet, wherein the first data packet is transmitting between a virtual machine running on the host and an external network via the network interface card;

obtaining a recorded entry according to the matching information; and

sending the first data packet to the host when finding no entry that matches the first data packet.

10. The method according to claim 7, wherein the method further comprises:

obtaining a security group rule that matches the first data packet; and

writing the security group rule into the action field of the first entry.

11. The method according to claim 10, wherein when the security group rule comprises a firewall rule that allows a forward data packet and a reverse data packet to pass, and the forward data packet is sent from a VM running on the host to an external network via the network interface card;

wherein the method further comprises;

creating a second entry; and

generating a match field of the second entry according to the matching information of the first data packet, wherein the second entry matches a reverse data flow of the first data packet.

12. The method according to claim 7, wherein the method further comprises:

receiving a modification instruction from the host, wherein the modification instruction is used to indicate a modification operation performed by the host on one of the multiple flow entries; and

modifying the first entry according to the modification instruction.

13. The method according to claim 7, wherein the method further comprises:

deleting the first entry when the first entry is not accessed within a preset time period;

sending a deletion instruction to the host, wherein the deletion instruction is used to instruct the host to delete the multiple flow entries.

14. A network interface card for data processing, comprising:

a host interface for connecting to a host of a server;

a processor, and

a memory,

wherein the processor is configured to;

send a first data packet to the host by using the host interface;

receive processing information from the host via the host interface, wherein the processing information indicates a processing operation performed by the host on the first data packet according to multiple flow entries that match the first data packet maintained by a virtual switch operating on the host;

generate an action field of a first entry according to the processing information, and generate a match field of the first entry according to matching information of the first data packet, wherein the matching information matches the multiple flow entries, and the first entry records a rule used by the network interface card to process succeeding data packets that match the first entry; and

store the first entry into the memory.

15. The network interface card according to claim 14, wherein the network interface card further comprises a network interface, and the network interface is configured to connect to an external network;

the processor is further configured to receive a succeeding data packet by using the host interface or the network interface, wherein the succeeding data packet comprises same matching information as the first data packet; and

the processor is further configured to;

query, according to the matching information, the first entry that matches the succeeding data packet; and

process the succeeding data packet according to the action field of the first entry.

16. The network interface card according to claim 14, wherein the network interface card further comprises the network interface, and the network interface is configured to connect to the external network;

and

before sending the first data packet to the host by using the host interface, the processor is further configured to;

receive the first data packet by using the host interface or the network interface, obtain a recorded entry according to the matching information, and send the first data packet to the host when finding no entry that matches the first data packet.

17. The network interface card according to claim 14, wherein the processor is further configured to:

obtain a security group rule that matches the first data packet, and write the security group rule into the action field of the first entry.

18. The network interface card according to claim 17, wherein when the security group rule comprises a firewall rule that allows a forward data packet and a reverse data packet to pass, and the forward data packet is sent from a virtual machine running on the host to an external network via the network interface card;

wherein the processor is further configured to;

create an entry, and generate a match field of the second entry according to the matching information of the first data packet, wherein the second entry matches a reverse data flow of the first data packet.