Message processing method, gateway, storage medium and program product

Abstract

The invention provides a message processing method, a gateway, a storage medium and a program product, and relates to the field of computers. The message processing method is executed by a gateway, and comprises the following steps: identifying whether a first message sent by public network core equipment is a first path message or not by using a first module; when the first message is not the first path message, identifying whether the first message is a load balancing message; and under the condition that the first message is a load balancing message, performing second path processing on the first message by using a second module, selecting a destination address and a destination port for the first message, and injecting the destination address and the destination port into the first module, so that the first module performs first path processing on the first message, and sending the first message meeting the specified condition to the private network core equipment.

Description

Technical Field

[0001] The present disclosure relates to the computer field, and in particular to a message processing method, a gateway, a storage medium and a program product. Background Art

[0002] In the core computer room of a public cloud, facing massive servers, extremely high bandwidth requirements, and complex and diverse network function requirements, although commercial network equipment can be used to implement these functions, its high cost, dependence on the function development of manufacturers, and long development cycle make this solution not ideal. Therefore, the industry usually uses self-developed gateway clusters based on high-performance x86 servers to implement key network functions.

[0003] In the edge computer room, if the gateway cluster in the core computer room is directly copied to the edge computer room, although the functional requirements can be met, the maintenance cost of the edge computer room will be very high. Although high-configuration servers can be replaced with low-configuration servers and the number of servers can be reduced to reduce costs, this method will lead to a significant decrease in bandwidth and functional specifications, and cannot meet the requirements of the edge computer room for low cost and high performance. Summary of the invention

[0004] A technical problem to be solved by the present disclosure is to provide a message processing method, a gateway, a storage medium and a program product, which can reduce the cost of edge computer rooms while improving the transmission rate of messages.

[0005] According to one aspect of the present disclosure, a message processing method is proposed, which is executed by a gateway, including: using a first module to identify whether a first message sent by a public network core device is a first path message; when the first message is not a first path message, identifying whether the first message is a load balancing message; when the first message is a load balancing message, using a second module to perform second path processing on the first message, select a destination address and a destination port for the first message, and inject the destination address and the destination port into the first module, so that the first module performs first path processing on the first message to send the first message that meets the specified conditions to the private network core device.

[0006] In some embodiments, performing second path processing on the first message, selecting a destination address and a destination port for the first message includes: selecting an available real server according to user configuration rules, using the address of the real server as the destination address of the first message, and using the port of the real server as the destination port of the first message.

[0007] In some embodiments, when the first message is a first path message, the first path processing is performed on the first message to send the first message that meets the specified conditions to the private network core device.

[0008] In some embodiments, performing first path processing on a first message to send the first message that meets specified conditions to a private network core device includes: when the rate of the first message meets the rate requirement configured by the user, converting the target address of the first message to a private network server address, converting the destination port of the first message to a private network server port, and generating a second message; encapsulating the second message and sending it to the private network core device.

[0009] In some embodiments, when the rate of the first message does not meet the rate requirement configured by the user, the first message is discarded.

[0010] In some embodiments, when the first message is not a load balancing message, the first message is discarded.

[0011] In some embodiments, identifying whether the first message is a first-path message includes: using a matching operation table to identify whether the first message is a first-path message.

[0012] In some embodiments, the matching operation table includes a flow table, an elastic IP table, and a target network address translation table, and using the matching operation table to identify whether the first message is a first path message includes: based on the five-tuple information of the first message, when it is identified that the five-tuple information of the first message matches an entry in at least one of the flow table, the elastic IP table, and the target network address translation table, determining that the first message is a first path message.

[0013] In some embodiments, a first module is used to identify whether a third message sent by a private network core device is a first path message; when the third message is not a first path message, a second module is used to perform second path processing on the third message, select a source address and a source port for the third message, and inject the source address and the source port into the first module, so that the first module performs third path processing on the third message to send the third message that meets the specified conditions to the public network core device.

[0014] In some embodiments, performing second path processing on the third message, selecting a source address and a source port for the third message includes: selecting an available public network address and a public network port according to user configuration rules, using the public network port as the source address of the third message, and using the public network port as the source port of the third message.

[0015] In some embodiments, when the third message is a first path message, the third message is processed according to the first path, so as to send the third message satisfying the specified conditions to the public network core device.

[0016] In some embodiments, performing first path processing on the third message to send the third message that meets specified conditions to the public network core device includes: converting the source address of the third message to a public network address, converting the source port of the third message to a public network port, and generating a fourth message; when the rate of the fourth message meets the rate requirement configured by the user, sending the fourth message to the public network core device.

[0017] In some embodiments, the first module is a programmable data processor; the second module is an advanced reduced instruction set machine module.

[0018] According to another aspect of the present disclosure, a gateway is also proposed, including: a first module, configured to identify whether a first message sent by a public network core device is a first path message, and when the first message is not a first path message, identify whether the first message is a load balancing message; a second module, configured to perform second path processing on the first message when the first message is a load balancing message, select a destination address and a destination port for the first message, and inject the destination address and the destination port into the first module, so that the first module performs first path processing on the first message to send the first message that meets the specified conditions to the private network core device.

[0019] In some embodiments, the first module is also configured to identify whether the third message sent by the private network core device is a first path message; the second module is also configured to perform second path processing on the third message when the third message is not a first path message, select a source address and a source port for the third message, and inject the source address and the source port into the first module, so that the first module performs third path processing on the third message to send the third message that meets the specified conditions to the public network core device.

[0020] According to another aspect of the present disclosure, a gateway is further proposed, including: a memory; and a processor coupled to the memory, wherein the processor is configured to execute the above-mentioned message processing method based on instructions stored in the memory.

[0021] In some embodiments, the processor includes modules of a programmable data processor architecture and modules of an advanced reduced instruction set machine architecture.

[0022] According to another aspect of the present disclosure, a computer-readable storage medium is further provided, on which computer program instructions are stored, and when the instructions are executed by a processor, the message processing method as described above is implemented.

[0023] According to another aspect of the present disclosure, a computer program product is also proposed, including a computer program or instructions, and the computer program or instructions implement the above-mentioned message processing method when executed by a processor.

[0024] In the disclosed embodiment, the first module is used to implement fast path processing of the message, the slow path processing is implemented through the first module, and the message processed by the slow path is injected into the first module, and the first module implements fast processing, and the fast forwarding of the message can be achieved without using an x86 server to meet the bandwidth requirements. Compared with the x86 server cluster gateway, this gateway does not need to be implemented in a cluster manner, and the cost is lower for the edge computer room.

[0025] Other features and advantages of the present disclosure will become apparent from the following detailed description of exemplary embodiments of the present disclosure with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The accompanying drawings, which constitute a part of the specification, illustrate embodiments of the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0027] The present disclosure may be more clearly understood from the following detailed description with reference to the accompanying drawings, in which:

[0028] Figure 1 It is a flowchart of some embodiments of the message processing method disclosed in the present invention;

[0029] Figure 2 Schematic diagram of the flow of other embodiments of the message processing method disclosed in the present invention;

[0030] Figure 3 Schematic diagram of the flow of other embodiments of the message processing method disclosed in the present invention;

[0031] Figure 4 Schematic diagram of the flow of other embodiments of the message processing method disclosed in the present invention;

[0032] Figure 5 It is a schematic diagram of the structure of some embodiments of the gateway disclosed in the present invention;

[0033] Figure 6 It is a schematic diagram of the structure of other embodiments of the gateway disclosed in the present invention;

[0034] Figure 7 A schematic diagram of the deployment topology of the gateway disclosed in the present invention. DETAILED DESCRIPTION

[0035] Various exemplary embodiments of the present disclosure will now be described in detail with reference to the accompanying drawings. It should be noted that the relative arrangement of components and steps, numerical expressions and numerical values ​​set forth in these embodiments do not limit the scope of the present disclosure unless otherwise specifically stated.

[0036] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0037] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present disclosure, its application, or uses.

[0038] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered as part of the specification.

[0039] In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limiting. Therefore, other examples of the exemplary embodiments may have different values.

[0040] It should be noted that like reference numerals and letters refer to similar items in the following figures, and therefore, once an item is defined in one figure, it need not be further discussed in subsequent figures.

[0041] In order to make the objectives, technical solutions and advantages of the present disclosure more clearly understood, the present disclosure is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0042] In the related technologies, the self-developed gateway cluster of x86 servers includes NAT (Network Address Translation) cluster, LB (Load Balancer) cluster, and EIP (Elastic IP Address) cluster. NAT realizes efficient access from the intranet to the public network, LB cluster realizes intelligent load balancing from the external network to the intranet, and EIP cluster realizes flexible elastic public IP function. EIP (Elastic IP Address) cluster: realizes flexible elastic public IP function.

[0043] Each gateway cluster requires at least 8 high-configuration x86 servers to ensure its excellent performance and reliability. These gateway clusters are usually based on Intel's open source DPDK (Data Plane Development Kit) framework, and achieve ultra-high-performance network packet processing capabilities through cutting-edge technologies such as bypass kernel channels, zero copy, large page memory, and CPU affinity.

[0044] With the rapid development of emerging businesses such as live streaming and video, the demand for network bandwidth has exploded, which has also led to increasingly serious network congestion problems, greatly affecting the user experience. In order to effectively reduce network traffic and improve user experience, CDN (Content Delivery Network) and 5G technology came into being, and the deployment of edge data centers has also increased rapidly.

[0045] Although the number of servers in edge data centers is relatively small and the requirements for network functions are relatively simple, the bandwidth requirements of edge data centers are still very high, usually reaching hundreds of Gbps.

[0046] The present disclosure provides a message processing method and a gateway, which is applied to an edge computer room and can improve the message transmission rate on the basis of reducing the cost of the edge computer room. The scheme of the present disclosure will be described in detail below by taking a specific embodiment as an example.

[0047] Figure 1 The flowchart of some embodiments of the message processing method disclosed in the present invention is executed by a gateway, including steps S11-S14. The gateway is a converged gateway, deployed at the exit of the edge computer room, located between the public network core device and the private network core device, and is divided into an uplink to the public network core device and a downlink to the private network core device.

[0048] In step S11, a first module is used to identify whether a first message sent by a public network core device is a first path message.

[0049] In some embodiments, the first path message is a fast path message. The fast path is a code path that is executed most frequently and has the lowest overhead.

[0050] The first module is a programmable DPU (Data Processing Unit). The public network core device is the external network core device, such as an external network core switch.

[0051] The programmable DPU is a programmable ASIC (Application-Specific Integrated Circuit) chip, which is programmed using P4 (Programming Protocol-Independent Packet Processors). The programmable DPU can support multiple ports, with a single port capable of 200G and dual ports capable of 400G. The cost of each DPU is low.

[0052] In some embodiments, the first message is an incoming message, and the programmable DPU can identify whether the message is a fast path message through the five-tuple information of the incoming message. The five-tuple is a set of five basic attributes of a network data packet, including a source IP address (source IP), a source port (source port), a destination IP address (destination IP), a destination port (destination port) and two quantities of the transport layer protocol (the layer 4 protocol).

[0053] In some embodiments, fast path processing of packets is implemented through a match-action table.

[0054] For example, based on the quintuple information of the first message, when it is identified that the quintuple information of the first message matches an entry in at least one of the flow table, the elastic IP table, and the target network address translation table, the first message is determined to be a first path message, i.e., a fast path message.

[0055] In step S12, when the first message is not a first path message, it is identified whether the first message is a load balancing message.

[0056] In some embodiments, the destination IP of the first message is matched with the vip_tbl (virtual Internet Protocol address table). If they match, it means that the message is a load balancing message. If they do not match, it means that the message is not a load balancing message. If the first message is not a load balancing message, the first message is discarded.

[0057] In step S13, when the first message is a load balancing message, the second module is used to perform second path processing on the first message, select a destination address and a destination port for the first message, and inject the destination address and the destination port into the first module, so that the first module performs first path processing on the first message to send the first message that meets the specified conditions to the private network core device, and the duration of the second path is greater than the duration of the first path.

[0058] In some embodiments, the second path is a slow path, and the slow path code will be executed for situations where the fast path conditions are not met or more complex processing is required.

[0059] The second module is the ARM (Advanced RISC Machines) module, which runs an open source operating system and a slow path process developed based on DPDK to process messages that fail to find the fast path, and runs the GoBGP process to publish routes to divert inbound and outbound traffic.

[0060] In some embodiments, the ARM module is used to select an available real server according to user configuration rules, and the address of the real server is used as the destination address of the first message, and the port of the real server is used as the destination port of the first message.

[0061] In the related art, all functions are realized by one chip, and when executing the slow path, a characteristic algorithm is required to realize message forwarding. For example, the message content of the request message is hashed to obtain the hash value corresponding to the request message; based on the hash value, the candidate server Internet Protocol address corresponding to the request message is determined in the server Internet Protocol address set; the session generated by the candidate server Internet Protocol address is inserted into the historical session set, and the candidate server Internet Protocol address is determined as the backend server Internet Protocol address corresponding to the request message.

[0062] In this embodiment, the ARM module is used to process the message in a slow path, and a variety of algorithms can be used to select the destination address and destination port of the message. After the destination address and destination port are selected, they are sent to the programmable DPU to realize message re-injection, and then the message fast path processing can be realized through the DPU.

[0063] In the above embodiment, the first module is used to implement fast path processing of the message, the second module is used to implement slow path processing, and the message processed by the slow path is injected into the first module, and the first module implements fast path processing, so that the message can be quickly forwarded without using an x86 server to meet the bandwidth requirements. Compared with the x86 server gateway, this gateway does not need to be implemented in a cluster manner, which is lower cost for edge computer rooms.

[0064] In some embodiments of the present disclosure, when the first message is a first path message, the first path processing is performed on the first message to send the first message that meets the specified conditions to the private network core device.

[0065] For example, when the first message is a fast path message, the message is fast path processed. The first message that meets the specified conditions is transmitted to the private network core device. The private network core device sends the message to the TOR (Top Of Rank, a switch placed on the cabinet), and the message finally reaches the private network server. The private network core device is the intranet core device, such as the intranet core switch.

[0066] In some embodiments, satisfying the specified condition refers to satisfying the rate condition, for example, when the rate of the first message meets the rate requirement configured by the user, the target address of the first message is converted to the private network server address, the destination port of the first message is converted to the private network server port, and a second message is generated; the second message is encapsulated and sent to the private network core device.

[0067] In some embodiments, if the rate of the first message does not meet the rate requirement configured by the user, the first message is discarded.

[0068] In the above embodiment, only the messages that meet the rate requirement are sent to the private network core device. If the message does not meet the rate configured by the user, the message is discarded, thereby achieving message rate limiting processing.

[0069] The following will take a specific embodiment as an example to illustrate the processing flow of incoming messages. Figure 2 As shown, Figure 2 The flowchart of another embodiment of the message processing method disclosed in the present invention includes steps S21-S211. The programmable DPU pregenerates a flow table (flow_tbl), an elastic IP table (eip_tbl), a target network address translation table (dnat_tbl), and a virtual Internet Protocol address table (vip_tbl), and each matching operation table has a key.

[0070] In step S21, the programmable DPU searches for flow_tbl according to the five-tuple information of the incoming message. If there is no match, step S22 is executed. If there is a match, step S26 is executed.

[0071] For incoming messages, the traffic of the public network IP is directed through the uplink port of the programmable DPU. By searching flow_tbl, if the five-tuple information of the message matches the key (also a five-tuple) defined in flow_tbl, it means that the fast path session table is hit, and step S26 is subsequently executed. Otherwise, it is necessary to continue to judge.

[0072] In step S22, eip_tbl is searched according to the destination IP of the incoming message. If there is no match, step S23 is executed. If there is a match, step S26 is executed.

[0073] If the destination IP of the incoming message matches the entry of eip_tbl, it means that the incoming message is eip traffic, and step S26 is subsequently executed. Otherwise, it is necessary to continue to judge.

[0074] In step S23, dnat_tbl is searched continuously according to the destination IP and destination port of the incoming message. If there is no match, step S24 is executed. If there is a match, step S26 is executed.

[0075] If the destination IP and destination port of the incoming message match the entry of dnat_tbl, it means that the incoming message is dnat traffic, and step S26 is subsequently executed. Otherwise, it is necessary to continue to judge.

[0076] In step S24, the destination IP of the incoming message is matched with vip_tbl. If they match, step S25 is executed; otherwise, the incoming message is discarded.

[0077] If the destination IP of the incoming message matches the entry of vip_tbl, it means that the incoming message is load balancing traffic and needs to be sent to the ARM module for processing. Otherwise, the message is discarded. The vip_tbl can filter out messages related to LB (load balancing). Virtual ip is the virtual ip that Layer 4 load balancing provides services to the outside world.

[0078] In step S25, the ARM module performs slow path processing on the incoming message and re-injects the incoming message into flow_tbl.

[0079] In this step, the slow path processing is related to LB processing, that is, according to the user configuration, select the available RS (realserver, the backend real server of the 4-layer load balancing), send the corresponding session (a session management mechanism based on the HTTP protocol) to flow_tbl, and re-inject the incoming message into flow_tbl. Then continue to execute step S21 on the message. At this time, the five-tuple information of the incoming message matches the key defined by flow_tbl, and then execute step S26.

[0080] In step S26, it is determined whether the destination IP of the incoming message hitting flow_tbl, eip_tbl and dnat_tbl matches meter_tbl. If not, step S27 is executed. If matching, the message is discarded.

[0081] The meter_tbl is used to limit the speed of user messages. If the destination IP of the message matches the meter_tbl, it means that the message exceeds the user-configured rate and the message is discarded. If it does not match, it means that the message can be sent to the private network server.

[0082] In step S27, the destination IP of the incoming message is replaced with the private network server IP, and the destination port is replaced with the private network server port.

[0083] In step S28, the incoming message is encapsulated into a vxlan message.

[0084] Vxlan is a tunnel encapsulation technology that encapsulates complete udp and vxlan packet headers in the outer layer of the original message, so that it can be forwarded between traditional forwarding devices based on the outer tunnel ip, achieving the functions of message encapsulation and routing.

[0085] In step S29, the encapsulated message is sent to the intranet core device.

[0086] In step 210, the intranet core device sends the message to a switch, such as a TOR.

[0087] In step S211, the switch forwards the message to the intranet server.

[0088] In the above embodiment, stateless functions such as EIP and speed limit, as well as stateful network functions such as LB and NAT are implemented based on the programmable DPU. Since the programmable DPU has hundreds of G network ports and line-speed forwarding capabilities, and does not reduce processing performance due to long data packets, it can handle tens of millions of sessions and has a lower price cost. In addition, the ARM module implements slow path processing and publishes routes, which can also reduce the difficulty of the algorithm and improve data forwarding capabilities.

[0089] Figure 3 1 is a flowchart of some other embodiments of the message processing method disclosed in the present invention. The embodiment is executed by a gateway and includes steps S31-S33.

[0090] In step S31, the first module is used to identify whether the third message sent by the private network core device is a first path message.

[0091] In some embodiments, the first path message is a fast path message. The fast path is a code path that is executed most frequently and has the lowest overhead.

[0092] In some embodiments, the third message is an outgoing message, and the programmable DPU can identify whether the message is a fast path message through the quintuple information of the outgoing message.

[0093] In some embodiments, the first module is a programmable DPU. Using the programmable DPU, a matching operation table is used to identify whether the third message is a first path message. The matching operation table includes a flow table, an elastic IP table, and a target network address translation table.

[0094] For example, based on the quintuple information of the third message, when it is identified that the quintuple information of the third message matches an entry in at least one of the flow table, the elastic IP table, and the target network address translation table, the third message is determined to be a first path message.

[0095] In step S32, when the third message is not a first path message, the second module is used to perform second path processing on the third message, select a source address and a source port for the third message, and inject the source address and the source port into the second module, so that the second module performs third path processing on the third message to send the third message that meets the specified conditions to the public network core device.

[0096] In some embodiments, the second path is a slow path, and the slow path code will be executed for situations where the fast path conditions are not met or more complex processing is required.

[0097] In some embodiments, the second module is an ARM module, which uses the ARM module to select an available public network address and public network port according to user configuration rules, and uses the public network port as the source address of the third message and the public network port as the source port of the third message.

[0098] In this embodiment, the ARM module is used to perform slow path processing on the message, and a variety of algorithms can be used to implement the selection of the message public network address and public network port. In addition, after the public network address and public network port are selected, they are sent to the programmable DPU to implement message re-injection, and then the message fast path processing can be implemented through the DPU.

[0099] In the above embodiment, the first module is used to implement fast path processing of messages, and the second module is used to implement slow path processing. Compared with the x86 server gateway, the gateway does not need to adopt the x86 server model, which is lower cost for the edge computer room and can also realize fast forwarding of messages.

[0100] In some embodiments, when the third message is a first path message, the third message is processed according to the first path, so as to send the third message satisfying the specified conditions to the public network core device.

[0101] For example, when the third message is a fast path message, the message is fast path processed. The third message that meets the specified conditions is transmitted to the public network core device. The public network core device sends the message to the Internet, and the user applies the data through the client.

[0102] In some embodiments, satisfying a condition refers to satisfying a rate condition, for example, converting the source address of the third message to a public network address, converting the source port of the third message to a public network port, generating a fourth message, and sending the fourth message to a public network core device when the rate of the fourth message meets the rate requirement configured by the user.

[0103] In some embodiments, when the rate of the fourth message does not meet the rate requirement configured by the user, the fourth message is discarded.

[0104] In the above embodiment, only the messages that meet the rate requirement are sent to the public network core device. If the message does not meet the rate configured by the user, the message is discarded, thereby achieving message rate limiting processing.

[0105] The following will take a specific embodiment as an example to illustrate the processing flow of outgoing messages. Figure 4 As shown, Figure 4 It is a flowchart diagram of other embodiments of the message processing method disclosed in the present invention, including steps S41-S411.

[0106] In step S41, the programmable DPU determines whether the export message is a vxlan message. If so, step S42 is executed; otherwise, the export message is discarded.

[0107] The vxlan traffic is diverted through the downlink port of the programmable DPU to determine whether it is a vxlan message. If it is not a vxlan message, the message is discarded. If it is a vxlan message, the subsequent steps are executed.

[0108] In step S42, the vxlan message is decapsulated.

[0109] In step S43, flow_tbl is searched according to the five-tuple information of the outgoing message. If there is no match, step S44 is executed. If there is a match, step S47 is executed.

[0110] For outgoing messages, the programmable DPU searches flow_tbl according to the source IP, destination IP, source port, destination port, and protocol of the outgoing message. If the five-tuple information of the message matches the key defined in flow_tbl, it means that the fast path session table is hit, and step S47 is executed subsequently. Otherwise, it is necessary to continue the judgment.

[0111] In step S44, eip_tbl is searched according to the inner source IP of the outgoing message. If there is no match, step S45 is executed. If there is a match, step S47 is executed.

[0112] If the inner source IP of the outgoing message matches the entry of eip_tbl, it means that the incoming message is eip traffic, and step S47 is subsequently executed. Otherwise, it is necessary to continue to judge.

[0113] In step S45, dnat_tbl is searched according to the inner source IP and source port of the incoming message. If there is no match, step S46 is executed. If there is a match, step S47 is executed.

[0114] If the inner source IP and source port of the outgoing message match the entry of dnat_tbl, it means that the outgoing message is dnat traffic, and step S47 is subsequently executed. Otherwise, it is necessary to continue to judge.

[0115] In step S46, the ARM module performs slow path processing on the outgoing message and re-injects the outgoing message into flow_tbl.

[0116] The programmable DPU sends the outgoing message to the ARM module, which performs slow path processing. The slow path processing in this step refers to SNAT (source network address translate) related processing, that is, according to the user configuration rules, select the available public network IP and port, that is, the source IP and source port, send the corresponding session to flow_tbl, and re-inject the outgoing message into flow_tbl. Subsequently, step S43 is continued to be executed on the message. At this time, the five-tuple information of the incoming message matches the key defined by flow_tbl, and step S47 is subsequently executed. The SNAT can convert the intranet IP into a public network IP.

[0117] In step S47, for the packets hitting flow_tbl, eip_tbl and dnat_tbl, the inner source IP is replaced with the public network IP, and the inner source port is replaced with an available port.

[0118] In step S48, meter_tbl is matched according to the public network IP of the message. If there is no match, step S410 is executed. If there is a match, the message is discarded.

[0119] The meter_tbl is used to limit the speed of user messages. If the public network IP of the message matches the meter_tbl, it means that the message exceeds the user-configured rate and the message is discarded. If it does not match, it means that the message can be sent to the external network server.

[0120] In step S49, the outgoing message is sent to the external network core device.

[0121] In step S410, the external network core device sends the message to the Internet.

[0122] In the above embodiment, the programmable DPU is used to implement stateless functions such as EIP and speed limit of messages, as well as stateful network functions such as NAT. The ARM module is used to implement slow path processing and publish routes, which can also reduce the difficulty of the algorithm and improve data forwarding capabilities.

[0123] Figure 5 The schematic diagram of the structure of some embodiments of the gateway disclosed in the present invention is a converged gateway, which is deployed at the exit of the edge computer room and located between the public network core device and the private network core device. The gateway includes a first module 510 and a second module 520.

[0124] The first module 510 is configured to identify whether a first message sent by a public network core device is a first path message, and if the first message is not a first path message, identify whether the first message is a load balancing message.

[0125] For example, the first module is a programmable DPU, and the programmable DPU uses a matching operation table to identify whether the first message is a first path message.

[0126] The matching operation table includes a flow table, an elastic IP table, and a target network address translation table. Using the matching operation table to identify whether the first message is a first path message includes: based on the five-tuple information of the first message, when it is identified that the five-tuple information of the first message matches an entry in at least one of the flow table, the elastic IP table, and the target network address translation table, determining that the first message is a first path message.

[0127] In some embodiments, the first module 510 is further configured to perform first path processing on the first message when the first message is a first path message, so as to send the first message that meets the specified conditions to the private network core device.

[0128] For example, when the rate of the first message meets the rate requirement configured by the user, the target address of the first message is converted to the private network server address, and the destination port of the first message is converted to the private network server port to generate a second message; the second message is encapsulated and sent to the private network core device.

[0129] If the rate of the first message does not meet the rate requirement configured by the user, or the first message is not a load balancing message, the first message is discarded.

[0130] The first path is a fast path, and the second path is a slow path.

[0131] In some embodiments, the first module 510 is also configured to identify whether the third message sent by the private network core device is a first path message. If the third message is a first path message, the third message is processed according to the first path to send the third message that meets the specified conditions to the public network core device.

[0132] For example, the programmable DPU uses a matching operation table to identify whether the third message is a first path message.

[0133] The matching operation table includes a flow table, an elastic IP table, and a target network address translation table. Using the matching operation table to identify whether the third message is a first path message includes: based on the five-tuple information of the third message, when it is identified that the five-tuple information of the third message matches an entry in at least one of the flow table, the elastic IP table, and the target network address translation table, determining that the third message is a first path message.

[0134] For another example, the programmable DPU converts the source address of the third message into a public network address, converts the source port of the third message into a public network port, and generates a fourth message; when the rate of the fourth message meets the rate requirement configured by the user, the fourth message is sent to the public network core device.

[0135] When the rate of the fourth message does not meet the rate requirement configured by the user, the fourth message is discarded.

[0136] The second module 520 is configured to perform second path processing on the first message when the first message is a load balancing message, select a destination address and a destination port for the first message, and inject the destination address and the destination port into the first module, so that the first module performs first path processing on the first message to send the first message that meets the specified conditions to the private network core device, and the duration of the second path is greater than the duration of the first path.

[0137] For example, the second module is an ARM module, and the ARM module selects an available real server according to a user configuration rule, uses the address of the real server as the destination address of the first message, and uses the port of the real server as the destination port of the first message.

[0138] For another example, the ARM module selects an available public network address and a public network port according to the user configuration rule, and uses the public network port as the source address of the third message and the public network port as the source port of the third message.

[0139] In the above embodiment, a converged gateway is constructed by programmable DPU and ARM modules. The programmable DPU implements fast path processing of messages through the match-action table. The ARM module runs an open source operating system, on which a slow path process developed based on DPDK is run to process messages that fail to find the fast path, and runs the GoBGP process to publish routes to guide inbound and outbound traffic. It implements stateless EIP, rate limiting, stateful LB and NAT, and can reach tens of millions of sessions. While meeting the requirements of message forwarding functions, the cost of the edge computer room is reduced.

[0140] Figure 6 Schematic diagram of the structure of other embodiments of the gateway of the present disclosure, the gateway includes a memory 610 and a processor 620. Wherein: the memory 610 can be a disk, a flash memory or any other non-volatile storage medium. The memory is used to store the instructions in the above embodiments. The processor 620 is coupled to the memory 610 and can be implemented as one or more integrated circuits, such as a microprocessor or a microcontroller. The processor 620 is used to execute the instructions stored in the memory.

[0141] In some embodiments, the processor 620 is coupled to the memory 610 via a BUS 630. The gateway can also be connected to an external storage device 650 via a storage interface 640 to call external data, and can also be connected to a network or another computer system (not shown) via a network interface 660. No further detailed description will be given here.

[0142] In this embodiment, data instructions are stored in a memory, and the instructions are processed by a processor, thereby reducing the cost of the edge computer room while meeting the requirements of the message forwarding function.

[0143] The processor of the gateway can be a programmable DPU architecture module and an ARM architecture module.

[0144] In some embodiments of the present disclosure, Figure 7 As shown, Figure 7 The topology diagram of the deployment of the gateway of the present disclosure includes a gateway 710 , the Internet 720 , a public network core device 730 , a private network core device 740 , a switch 750 and a server 760 .

[0145] The gateway 710 is located at the exit of the edge computer room, between the public network core switch and the private network core switch, and is divided into an upper connection to the public network core device 730 and a lower connection to the private network core device 740. The upper and lower single-port bandwidth is 100G, and multiple ports can be supported.

[0146] The user terminal is connected to the public network core device through the Internet, can generate a request message, and send it to the public network core device through the Internet.

[0147] The public network core device 730 may be a core switch connected to the gateway 710. The public network core device 730 may receive a request message sent by a user terminal and send the request message to the gateway 710, or send the message information sent to the user terminal through the gateway 710 to the user terminal through the Internet.

[0148] The private network core device 740 is located between the gateway 710 and the switch 750, which is, for example, a TOR. The switch receives the feedback message returned by the server 760 and sends the feedback message to the gateway 710. The data sent to the server 760 through the gateway 710 is sent to the server 760 through the switch.

[0149] The server 760 may be hardware or software. When the server is hardware, it may be various electronic devices that provide various services to the user terminal. When the server is software, it may be implemented as multiple software or software modules that provide various services to the user terminal, or it may be implemented as a single software or software module that provides various services to the client.

[0150] To improve system security, the topology can be redundantly backed up. For example, it includes two public network core devices, two converged gateways, two private network core devices, multiple switches, and multiple servers. The programmable DPU can achieve 200G processing capacity per port and 400G processing capacity per dual port. The cost of a single DPU is low, and high availability can be achieved by using two DPUs. Therefore, the converged gateway can meet the requirements of the edge computer room for low cost and high performance.

[0151] Those skilled in the art should understand that more integrated gateways, Internet, public network core devices, private network core devices, TOR and servers may be provided according to actual conditions.

[0152] In other embodiments, a computer-readable storage medium stores computer program instructions, which implement the steps of the methods in the above-mentioned embodiments when executed by a processor. It should be understood by those skilled in the art that the embodiments of the present disclosure may be provided as methods, devices, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present disclosure may take the form of a computer program product implemented on one or more computer-usable non-transient storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0153] In some embodiments, a computer program product is protected, including a computer program or an instruction, which implements the above method when the computer program or instruction is executed by a processor. The computer program product includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by the CPU, the above functions defined in the method of the embodiment of the present disclosure are executed.

[0154] The present disclosure is described with reference to flowcharts and / or block diagrams of methods, devices (systems) and computer program products according to embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram and the combination of processes and / or blocks in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0155] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0156] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0157] So far, the present disclosure has been described in detail. In order to avoid obscuring the concept of the present disclosure, some details known in the art are not described. Based on the above description, those skilled in the art can fully understand how to implement the technical solution disclosed here.

[0158] The method and apparatus of the present disclosure may be implemented in many ways. For example, the method and apparatus of the present disclosure may be implemented by software, hardware, firmware, or any combination of software, hardware, and firmware. The above order of steps for the method is for illustration only, and the steps of the method of the present disclosure are not limited to the order specifically described above, unless otherwise specifically stated. In addition, in some embodiments, the present disclosure may also be implemented as a program recorded in a recording medium, which includes machine-readable instructions for implementing the method according to the present disclosure. Therefore, the present disclosure also covers a recording medium storing a program for executing the method according to the present disclosure.

[0159] Although some specific embodiments of the present disclosure have been described in detail by way of example, it should be understood by those skilled in the art that the above examples are for illustration only and are not intended to limit the scope of the present disclosure. It should be understood by those skilled in the art that the above embodiments may be modified without departing from the scope and spirit of the present disclosure. The scope of the present disclosure is defined by the appended claims.

Claims

1. A message processing method, executed by a gateway, comprising: Using the first module, identifying whether the first message sent by the public network core device is a first path message; In the case where the first message is not a first path message, identifying whether the first message is a load balancing message; In the case where the first message is a load balancing message, the second module is used to perform second path processing on the first message, select a destination address and a destination port for the first message, and inject the destination address and the destination port into the first module, so that the first module performs first path processing on the first message to send the first message that meets the specified conditions to the private network core device.

2. The message processing method according to claim 1, wherein: Performing second path processing on the first message, and selecting a destination address and a destination port for the first message includes: According to the user configuration rule, an available real server is selected, the address of the real server is used as the destination address of the first message, and the port of the real server is used as the destination port of the first message.

3. The message processing method according to claim 1, further comprising: In the case where the first message is a first path message, the first path processing is performed on the first message to send the first message that meets the specified condition to the private network core device.

4. The message processing method according to claim 1 or 3, wherein: Performing a first path processing on the first message to send the first message that meets a specified condition to a private network core device includes: When the rate of the first message meets the rate requirement configured by the user, convert the target address of the first message into the private network server address, convert the destination port of the first message into the private network server port, and generate a second message; The second message is encapsulated and sent to the private network core device.

5. The message processing method according to claim 4, further comprising: If the rate of the first message does not meet the rate requirement configured by the user, the first message is discarded.

6. The message processing method according to any one of claims 1 to 3, further comprising: If the first message is not a load balancing message, the first message is discarded.

7. The message processing method according to any one of claims 1 to 3, wherein: Identifying whether the first message is a first path message includes: A matching operation table is used to identify whether the first message is a first path message.

8. The message processing method according to claim 7, wherein: The matching operation table includes a flow table, an elastic IP table, and a target network address translation table, and using the matching operation table to identify whether the first message is a first path message includes: According to the five-tuple information of the first message, when it is identified that the five-tuple information of the first message matches an entry in at least one of the flow table, the elastic IP table, and the target network address translation table, the first message is determined to be a first path message.

9. The message processing method according to any one of claims 1 to 3, further comprising: Using the first module, identifying whether the third message sent by the private network core device is a first path message; In the case that the third message is not a first path message, the second module is used to perform second path processing on the third message, select a source address and a source port for the third message, and inject the source address and the source port into the first module, so that the first module performs third path processing on the third message to send the third message that meets the specified conditions to the public network core device.

10. The message processing method according to claim 9, wherein: Performing second path processing on the third message, and selecting a source address and a source port for the third message includes: According to the user configuration rule, an available public network address and a public network port are selected, and the public network port is used as the source address of the third message, and the public network port is used as the source port of the third message.

11. The message processing method according to claim 9, further comprising: In the case where the third message is a first path message, the first path processing is performed on the third message to send the third message that meets the specified conditions to the public network core device.

12. The message processing method according to claim 9, wherein: Performing first path processing on the third message to send the third message that meets the specified condition to the public network core device includes: Convert the source address of the third message into a public network address, convert the source port of the third message into a public network port, and generate a fourth message; When the rate of the fourth message meets the rate requirement configured by the user, the fourth message is sent to the public network core device.

13. The message processing method according to any one of claims 1 to 3, wherein: The first module is a programmable data processor; The second module is an advanced reduced instruction set machine module.

14. A gateway, comprising: The first module is configured to identify whether a first message sent by a public network core device is a first path message, and if the first message is not a first path message, identify whether the first message is a load balancing message; The second module is configured to perform second path processing on the first message when the first message is a load balancing message, select a destination address and a destination port for the first message, and inject the destination address and the destination port into the first module, so that the first module performs first path processing on the first message to send the first message that meets the specified conditions to the private network core device.

15. The gateway according to claim 14, wherein: The first module is further configured to identify whether the third message sent by the private network core device is a first path message; The second module is also configured to perform second path processing on the third message when the third message is not a first path message, select a source address and a source port for the third message, and inject the source address and the source port into the first module, so that the first module performs third path processing on the third message to send the third message that meets the specified conditions to the public network core device.

16. A gateway, comprising: Memory; as well as A processor coupled to the memory, the processor being configured to execute the message processing method according to any one of claims 1 to 13 based on instructions stored in the memory.

17. The gateway according to claim 16, wherein: The processor includes modules of a programmable data processor architecture and modules of an advanced reduced instruction set machine architecture.

18. A computer-readable storage medium having computer program instructions stored thereon, wherein the instructions, when executed by a processor, implement the message processing method according to any one of claims 1 to 13.

19. A computer program product, comprising a computer program or instructions, wherein when the computer program or instructions are executed by a processor, the message processing method according to any one of claims 1 to 13 is implemented.

Images