Flow rate limiting system, flow rate limiting method and flow rate limiting device

Abstract

The invention relates to the technical field of cloud computing networks, and provides a traffic speed limiting system, a traffic speed limiting method and a traffic speed limiting device. The system comprises a network element agent unit, a monitoring unit, a speed limiting configuration unit, a program loading unit, a speed limiting execution tool and a filter agent unit. When the monitoring unit monitors that the life cycle or the bandwidth configuration strategy of the network element agent unit is changed, the speed-limiting configuration unit is triggered to obtain a bandwidth speed-limiting execution mode and a bandwidth information configuration file according to the bandwidth configuration strategy; the program loading unit updates ip address bandwidth mapping data in the filter speed limiting program file through the speed limiting execution tool and the bandwidth information configuration file; and the program loading unit also acquires and loads a filter speed limiting program file to an operating system kernel, so that a speed limiting execution tool realizes flow speed limiting according to ip mapping data and bandwidth mapping data in the file and a bandwidth speed limiting execution mode. By adopting the system, the expandability can be improved.

Description

Technical Field

[0001] The present application relates to the field of cloud computing network technology, and in particular to a flow rate limiting system, a flow rate limiting method and a flow rate limiting device. Background Art

[0002] Cloud native environments usually use virtualization and containerization technologies. Multiple users share the same network bandwidth, which may lead to bandwidth grabbing among multiple users. To address this problem, you can use a traffic speed limit system to implement traffic control strategies, such as setting bandwidth caps for users, to ensure fair distribution of network resources as much as possible.

[0003] In traditional traffic speed limiting systems, when limiting traffic speed, IP data and bandwidth data are stored in the same data structure. The association between IP and bandwidth is less flexible, and the scalability of the traffic speed limiting system is poor. Summary of the invention

[0004] Based on this, it is necessary to provide a flow rate limiting system, a flow rate limiting method and a flow rate limiting device to address the above technical problems.

[0005] In a first aspect, the present application provides a traffic speed limiting system, the traffic speed limiting system comprising a network element agent unit, a speed limit controller, a speed limit execution tool and a filter agent unit, the speed limit controller comprising a monitoring unit, a speed limit configuration unit and a program loading unit, wherein:

[0006] The monitoring unit is used to monitor whether the life cycle and bandwidth configuration policy of the network element agent unit have changed, and when it is monitored that the life cycle or bandwidth configuration policy of the network element agent unit has changed, send a speed limit operation start instruction to the speed limit configuration unit;

[0007] The speed limit configuration unit is configured to obtain a bandwidth speed limit execution mode and a bandwidth information configuration file according to the bandwidth configuration strategy when receiving the speed limit operation start instruction;

[0008] The program loading unit is used to update the IP mapping data and bandwidth mapping data in the filter speed limit program file through the speed limit execution tool and the bandwidth information configuration file;

[0009] The program loading unit is also used to obtain and load the filter speed limit program file into the operating system kernel, so that the speed limit execution tool performs speed limit operations in the operating system kernel according to the IP mapping data and bandwidth mapping data in the filter speed limit program file, as well as the bandwidth speed limit execution mode, so as to realize traffic speed limit.

[0010] In one of the embodiments, the network element agent unit is a deployment resource or a stateful set resource in a container orchestration platform, and the annotation field of the deployment resource or the stateful set resource includes a bandwidth configuration policy.

[0011] In one of the embodiments, the monitoring unit is used to monitor whether the life cycle and bandwidth configuration policy of the network element agent unit have changed through the coordination cycle mechanism of the container orchestration platform.

[0012] In one embodiment, the monitoring unit monitors whether the life cycle and bandwidth configuration strategy of the network element agent unit have changed, specifically including:

[0013] When it is monitored that the hash value of the bandwidth configuration policy is inconsistent with the hash value of the container group in the container orchestration platform, it is determined that the life cycle of the network element agent unit or the bandwidth configuration policy has changed.

[0014] In one embodiment, the bandwidth configuration strategy includes a bandwidth identification speed limit mode and a bandwidth information identification speed limit scheme, and the speed limit configuration unit obtains a bandwidth speed limit execution mode and a bandwidth information configuration file according to the bandwidth configuration strategy, specifically including:

[0015] Obtaining a bandwidth speed limit execution mode according to the bandwidth identification speed limit mode in the bandwidth configuration strategy;

[0016] A bandwidth information configuration file is obtained according to the bandwidth information identification speed limit scheme in the bandwidth configuration strategy.

[0017] In one embodiment, the program loading unit updates the IP mapping data and the bandwidth mapping data in the filter speed limit program file through the speed limit execution tool and the bandwidth information configuration file, specifically including:

[0018] When the speed limit execution tool determines, according to the bandwidth information configuration file, that the bandwidth speed limit value has changed, the bandwidth mapping data corresponding to the bandwidth speed limit value is updated;

[0019] When the speed limit execution tool determines, according to the bandwidth information configuration file, that a unique bandwidth configuration identifier has been deleted, the bandwidth mapping data corresponding to the unique bandwidth configuration identifier is deleted;

[0020] When the speed limit execution tool determines, based on the bandwidth information configuration file, that the public network IP corresponding to the bandwidth has changed, the IP mapping data corresponding to the public network IP is updated;

[0021] When the speed limit execution tool determines, based on the bandwidth information configuration file, that a unique bandwidth configuration identifier has been deleted, the IP mapping data corresponding to the unique bandwidth configuration identifier is deleted.

[0022] In one of the embodiments, the filter proxy unit is used to provide the filter rate limiting program file and an application programming interface, so that the program loading unit calls the application programming interface to obtain the filter rate limiting program file.

[0023] In one embodiment, the speed limit execution tool performs speed limit operations on different IPs sharing the same bandwidth size in the operating system kernel according to the IP mapping data and bandwidth mapping data in the filter speed limit program file and the bandwidth speed limit execution mode, specifically including:

[0024] Determine the bandwidth speed limit value corresponding to each IP according to the IP in the IP mapping data and the bandwidth speed limit value in the bandwidth mapping data;

[0025] Through the network traffic speed limit algorithm, in the tc module of the operating system kernel, according to the bandwidth speed limit execution mode and the bandwidth speed limit value corresponding to each IP, the speed limit operation of different IPs sharing the same bandwidth size is performed.

[0026] In a second aspect, the present application further provides a flow rate limiting method, the method being applied to a rate limiting controller in a flow rate limiting system, the flow rate limiting system further comprising a network element agent unit, a rate limiting execution tool and a filter agent unit, the method comprising:

[0027] When a change is detected in the life cycle of the network element proxy unit or the bandwidth configuration policy, a bandwidth speed limit execution mode and a bandwidth information configuration file are obtained according to the bandwidth configuration policy;

[0028] By means of the speed limit execution tool and the bandwidth information configuration file, the IP mapping data and the bandwidth mapping data in the filter speed limit program file are updated;

[0029] The filter speed limit program file is obtained and loaded into the operating system kernel, so that the speed limit execution tool performs speed limit operations on different IPs sharing the same bandwidth size in the operating system kernel according to the IP mapping data and bandwidth mapping data in the filter speed limit program file and the bandwidth speed limit execution mode, so as to realize traffic speed limit.

[0030] In a third aspect, the present application further provides a flow rate limiting device, which is applied to a rate limiting controller in a flow rate limiting system, wherein the flow rate limiting system further includes a network element agent unit, a rate limiting execution tool and a filter agent unit, and the device includes:

[0031] A monitoring module, configured to obtain a bandwidth speed limit execution mode and a bandwidth information configuration file according to the bandwidth configuration policy when a change is detected in the life cycle of the network element proxy unit or the bandwidth configuration policy;

[0032] A mapping data updating module, used to update the IP mapping data and bandwidth mapping data in the filter speed limit program file through the speed limit execution tool and the bandwidth information configuration file;

[0033] The speed limit operation module is used to obtain and load the filter speed limit program file into the operating system kernel, so that the speed limit execution tool performs speed limit operations on different IPs sharing the same bandwidth size in the operating system kernel according to the IP mapping data and bandwidth mapping data in the filter speed limit program file and the bandwidth speed limit execution mode, so as to realize traffic speed limit.

[0034] In a fourth aspect, the present application further provides a speed limit controller, wherein the speed limit controller comprises a memory and a processor, wherein the memory stores a computer program, and the processor executes the above method.

[0035] In a fifth aspect, the present application further provides a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and the computer program is executed by a processor to execute the above method.

[0036] In a sixth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and the computer program is executed by a processor to execute the above method.

[0037] The above-mentioned flow speed limit system includes a network element agent unit, a speed limit controller, a speed limit execution tool and a filter agent unit, and the speed limit controller includes a monitoring unit, a speed limit configuration unit and a program loading unit. The monitoring unit is used to monitor whether the life cycle of the network element agent unit and the bandwidth configuration policy have changed. When the life cycle of the network element agent unit or the bandwidth configuration policy is monitored to change, the speed limit operation start instruction is sent to the speed limit configuration unit; the speed limit configuration unit is used to obtain the bandwidth speed limit execution mode and the bandwidth information configuration file according to the bandwidth configuration policy when receiving the speed limit operation start instruction; the program loading unit is used to update the IP mapping data and bandwidth mapping data in the filter speed limit program file through the speed limit execution tool and the bandwidth information configuration file; the program loading unit is also used to obtain and load the filter speed limit program file into the operating system kernel, so that the speed limit execution tool performs the speed limit operation of different IPs sharing the same bandwidth size according to the IP mapping data and bandwidth mapping data in the filter speed limit program file and the bandwidth speed limit execution mode in the operating system kernel to achieve flow speed limit. This application obtains IP mapping data and bandwidth mapping data based on the IP data and bandwidth data in the bandwidth information configuration file, realizes flexible IP and bandwidth association, realizes accurate speed limit management of network bandwidth, supports business scenarios of single IP exclusive bandwidth and multiple IPs sharing bandwidth, can meet the high-performance requirements of large bandwidth under smart network cards and ordinary network cards, and improves the scalability of the traffic speed limit system. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 It is an application flow chart of a flow rate limiting system in one embodiment;

[0040] Figure 2 A schematic diagram of a cloud-native traffic speed limiting architecture of a traffic speed limiting system in an embodiment;

[0041] Figure 3 A schematic diagram of data structure conversion of a filter rate limiting program in one embodiment;

[0042] Figure 4 A schematic diagram of a flow chart of a flow rate limiting method in an embodiment;

[0043] Figure 5 FIG. 4 is a structural block diagram of a flow rate limiting device in an embodiment. DETAILED DESCRIPTION

[0044] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0045] The present application embodiment provides a flow rate limiting system, such as Figure 1 As shown in Figure 1, the traffic speed limit system includes a network element agent unit, a speed limit controller, a speed limit execution tool, and a filter agent unit. The speed limit controller includes a monitoring unit, a speed limit configuration unit, and a program loading unit. The cloud native traffic speed limit architecture diagram of the traffic speed limit system is shown in Figure 1. Figure 2 shown.

[0046] The monitoring unit is used to monitor whether the life cycle of the network element agent unit and the bandwidth configuration policy have changed. When the life cycle of the network element agent unit or the bandwidth configuration policy is monitored to change, the speed limit operation start instruction is sent to the speed limit configuration unit; the speed limit configuration unit is used to obtain the bandwidth speed limit execution mode and the bandwidth information configuration file according to the bandwidth configuration policy when receiving the speed limit operation start instruction; the program loading unit is used to update the IP mapping data and the bandwidth mapping data in the filter speed limit program file through the speed limit execution tool and the bandwidth information configuration file; the program loading unit is also used to obtain and load the filter speed limit program file into the operating system kernel, so that the speed limit execution tool in the operating system kernel performs the speed limit operation of different IPs sharing the same bandwidth size according to the IP mapping data and the bandwidth mapping data in the filter speed limit program file and the bandwidth speed limit execution mode, so as to realize the flow speed limit.

[0047] The traffic speed limit system uses kubernetes (k8s for short) as the container orchestration platform. The network element proxy unit exists in the form of deployment resources or stateful set resources in the container orchestration platform (Kubernetes), and the bandwidth configuration strategy is added to the annotation field of the deployment resource or stateful set resource.

[0048] The monitoring unit in the speed limit controller can use the reconcile function in the reconcile loop mechanism of the container orchestration platform to monitor whether the life cycle of the network element agent module (agent) and the bandwidth configuration policy have changed. When the hash value of the bandwidth configuration policy is detected to be inconsistent with the hash value of the container group in the container orchestration platform, it is determined that the life cycle of the network element agent unit or the bandwidth configuration policy has changed. At this time, a speed limit operation start instruction can be sent to the speed limit configuration unit.

[0049] When the speed limit configuration unit in the speed limit controller receives a speed limit operation start instruction, the bandwidth speed limit execution mode can be obtained according to the bandwidth identification speed limit mode in the bandwidth configuration strategy; the bandwidth information configuration file can be obtained according to the bandwidth information identification speed limit scheme in the bandwidth configuration strategy.

[0050] The program loading unit in the speed limit controller can call the apply instruction of the speed limit execution tool to enable the speed limit execution tool to determine whether the bandwidth speed limit value, the unique bandwidth configuration identifier and the public network IP (Internet Protocol) corresponding to the bandwidth have changed according to the bandwidth information configuration file. When it is determined that there is a change, the IP mapping data and bandwidth mapping data in the filter speed limit program file are updated accordingly.

[0051] The program loading unit in the speed limit controller can call the application program interface of the filter proxy unit, obtain the filter speed limit program file, and load the filter speed limit program file into the operating system kernel.

[0052] The program loading unit in the speed limit controller can call the load instruction of the speed limit execution tool, so that the speed limit execution tool can determine the bandwidth speed limit value corresponding to each IP in the operating system kernel according to the IP in the IP mapping data and the bandwidth speed limit value in the bandwidth mapping data. Through the network traffic speed limit algorithm, the speed limit program (tc.c) can be loaded in the tc module of the operating system kernel according to the bandwidth speed limit execution mode and the bandwidth speed limit value corresponding to each IP, so as to perform speed limit operations for different IPs to share the same bandwidth size, so as to make the bandwidth configuration strategy of the network element agent unit effective. The operating system can be a Linux system, and the network traffic speed limit algorithm can be an edt (Earlist Departure Time) algorithm.

[0053] The traffic speed limiting system of this embodiment uses kubernetes as the container orchestration platform. It is a traffic speed limiting system that implements dynamic IP bandwidth configuration for network cards based on bpf (Berkeley Packet Filter). The traffic speed limiting system integrates bpf with k8s applications and loads filter speed limiting program files according to dynamic traffic bandwidth configuration. It can not only optimize network resource configuration and realize speed limiting capabilities, so that high-priority services can obtain better network experience, but also allow more ordinary services to obtain basic network traffic. It can also ensure normal data transmission when high bandwidth speed is limited, meet the requirements of giving full play to high-performance bandwidth capabilities and precise speed limit allocation in the cloud native field, avoid the problem of mutual influence between users' services, and support flexible adaptation to a variety of network service modes of shared and exclusive bandwidth in the cloud native environment.

[0054] The traffic speed limit system does not require interruption during the process of changing the IP bandwidth configuration and updating the speed limit function, and does not invade the application code, thereby improving the scalability and stability of the system.

[0055] The above-mentioned traffic speed limiting system obtains IP mapping data and bandwidth mapping data according to the IP data and bandwidth data in the bandwidth information configuration file, realizes flexible IP and bandwidth association, realizes accurate speed limiting management of network bandwidth, supports business scenarios of single IP exclusive bandwidth and multiple IPs sharing bandwidth, can meet the high-performance requirements of large bandwidth under smart network cards and ordinary network cards, and improves the scalability of the traffic speed limiting system.

[0056] In one of the embodiments, the network element agent unit is a deployment resource or a stateful set resource in a container orchestration platform, and the annotation field of the deployment resource or the stateful set resource includes a bandwidth configuration policy.

[0057] The network element proxy unit exists in the form of a deployment resource or a stateful set resource in the container orchestration platform (Kubernetes), and the bandwidth configuration strategy is added to the annotation field of the deployment resource or stateful set resource. Deployment or Statefulsets are two commonly used application deployment methods in Kubernetes.

[0058] The specific bandwidth configuration strategy is as follows:

[0059] meta.xxx.io / bw-mode:bpf; indicates that the smart network card is used as the speed limit mode;

[0060] meta.xxx.io / bw-info:>-{"RuleList":[{"OIId":203531,"BwName":"bw-cmoe4o6jga43j9uu6sg0","Limit":4096,"Ips":["45.56.5.12"]},{"OIId":203677,"BwName":"bw-cmp0p36jga426qtqoiag","Limit":50,"Ips":["45.56.5.36"]}]};

[0061] Among them, bw-mode is the bandwidth information identification speed limit scheme, bpf is the Berkeley packet filter, bw-info is the bandwidth identification speed limit mode, RuleList is the rule list, Ips is the public network IP corresponding to the bandwidth, a bandwidth value can be shared with multiple IPs, and multiple IPs can be filled in Ips. Limit is the specific bandwidth speed limit value, OIId and BwName are unique bandwidth configuration identifiers.

[0062] In this embodiment, the network element proxy unit is determined according to the deployment resources or stateful set resources in the container orchestration platform, and a bandwidth configuration strategy is added to the annotation field of the network element proxy unit.

[0063] In one of the embodiments, the monitoring unit is used to monitor whether the life cycle of the network element agent unit and the bandwidth configuration policy have changed through the coordination cycle mechanism of the container orchestration platform.

[0064] The monitoring unit can use the reconcile function in the reconcile loop mechanism of the container orchestration platform to monitor whether the life cycle of the network element agent module (agent) and the bandwidth configuration policy have changed.

[0065] In this embodiment, the monitoring unit can monitor whether the life cycle of the network element agent unit and the bandwidth configuration policy have changed through the coordination cycle mechanism of the container orchestration platform.

[0066] In one of the embodiments, the monitoring unit monitors whether the life cycle and bandwidth configuration policy of the network element agent unit have changed. The specific steps are as follows: when it is monitored that the hash value of the bandwidth configuration policy is inconsistent with the hash value of the container group in the container orchestration platform, it is determined that the life cycle or bandwidth configuration policy of the network element agent unit has changed.

[0067] The bandwidth identification speed limiting mode and the bandwidth information identification speed limiting scheme in the bandwidth configuration policy may be converted into a hash base 64 value (Hash-Bash64 value) as a hash value of the bandwidth configuration policy.

[0068] When the network element agent unit is newly created, rebuilt, or the bandwidth configuration policy changes, the monitoring unit can detect that the hash value of the bandwidth configuration policy is inconsistent with the hash value of the container group in the container orchestration platform. Therefore, when the monitoring unit detects that the hash value of the bandwidth configuration policy is inconsistent with the hash value of the container group in the container orchestration platform, it can be determined that the life cycle of the network element agent unit or the bandwidth configuration policy has changed.

[0069] In this embodiment, whether the life cycle of the network element agent unit or the bandwidth configuration policy has changed is determined based on whether the hash value of the bandwidth configuration policy is consistent with the hash value of the container group in the container orchestration platform.

[0070] In one of the embodiments, the bandwidth configuration strategy includes a bandwidth identification speed limit mode and a bandwidth information identification speed limit scheme. The speed limit configuration unit obtains a bandwidth speed limit execution mode and a bandwidth information configuration file according to the bandwidth configuration strategy. The specific steps are as follows: according to the bandwidth identification speed limit mode in the bandwidth configuration strategy, the bandwidth speed limit execution mode is obtained; according to the bandwidth information identification speed limit scheme in the bandwidth configuration strategy, the bandwidth information configuration file is obtained.

[0071] The bandwidth configuration policy may include a bandwidth identifier speed limit mode (bw-mode) and a bandwidth information identifier speed limit scheme (bw-info).

[0072] The speed limit configuration unit may obtain a bandwidth speed limit execution mode according to a bandwidth identifier speed limit mode in a bandwidth configuration policy.

[0073] For example, when the content of the bandwidth identification speed limit mode is meta.xxx.io / bw-mode:bpf, it can be determined that the bandwidth speed limit execution mode is bpf.

[0074] The speed limit configuration unit can identify the speed limit scheme according to the bandwidth information in the bandwidth configuration strategy, obtain the bandwidth data corresponding to each IP address, and obtain the bandwidth information configuration file bw-info.yaml according to the bandwidth data corresponding to each IP address.

[0075] In this embodiment, according to the bandwidth identification speed limiting mode and the bandwidth information identification speed limiting scheme in the bandwidth configuration policy, the bandwidth speed limiting execution mode and the bandwidth information configuration file are obtained respectively.

[0076] In one of the embodiments, the program loading unit updates the IP mapping data and bandwidth mapping data in the filter speed limit program file through the speed limit execution tool and the bandwidth information configuration file, and the specific steps are as follows: when the speed limit execution tool determines that the bandwidth speed limit value has changed according to the bandwidth information configuration file, the bandwidth mapping data corresponding to the bandwidth speed limit value is updated; when the speed limit execution tool determines that a unique bandwidth configuration identifier has been deleted according to the bandwidth information configuration file, the bandwidth mapping data corresponding to the unique bandwidth configuration identifier is deleted; when the speed limit execution tool determines that the public network IP corresponding to the bandwidth has changed according to the bandwidth information configuration file, the IP mapping data corresponding to the public network IP is updated; when the speed limit execution tool determines that a unique bandwidth configuration identifier has been deleted according to the bandwidth information configuration file, the IP mapping data corresponding to the unique bandwidth configuration identifier is deleted.

[0077] The speed limit execution tool may be a maptool tool. The maptool tool may define a command tool for processing map structure data of a load command, an apply command, and other filter speed limit programs (also referred to as bpf programs). Among them:

[0078] maptool load command: loads the compiled filter rate limit program into the operating system kernel; supports the following parameters:

[0079] -c<absolute path of the filter rate limit program file>,

[0080] -d<network card name>

[0081] maptool apply command: according to the bandwidth information configuration file bw-info.yaml, update the ip mapping data ipmap and bandwidth mapping data bwmap of the filter speed limit program in the filter agent unit bpf-agent. The ip mapping data ipmap defines the correspondence between the unique bandwidth configuration identifier OIId and the ip in the public network Ips, and the bandwidth mapping data bwmap defines the correspondence between the unique bandwidth configuration identifier OIId and the bandwidth speed limit value Limit. Different ips can be associated with the same unique bandwidth configuration identifier OIId, and one ip can only be associated with one unique bandwidth configuration identifier OIId, and one network card corresponds to one ip.

[0082] Specifically, when the bandwidth information identification speed limit scheme of the network element proxy unit changes, the bandwidth mapping data in the filter speed limit program is updated as follows:

[0083] (1) When the unique bandwidth configuration identifier OIId does not change and the bandwidth speed limit value Limit does not change, the bandwidth mapping data in the filter speed limit program is not updated;

[0084] (2) When the unique bandwidth configuration identifier OIId does not change but the bandwidth limit value Limit changes, the bandwidth mapping data corresponding to the bandwidth limit value is updated;

[0085] (3) When a unique bandwidth configuration identifier OIId is deleted, the bandwidth mapping data corresponding to the unique bandwidth configuration identifier is deleted;

[0086] When the bandwidth information identification speed limit scheme of the network element proxy unit changes, the IP mapping data in the filter speed limit program is updated as follows:

[0087] (1) When the unique bandwidth configuration identifier OIId does not change and the IP in the public network IPs does not change, the IP mapping data corresponding to the public network IP does not operate;

[0088] (2) When the unique bandwidth configuration identifier OIId does not change and the IP in the public network IPs changes, the IP mapping data corresponding to the IP in the public network is updated;

[0089] (3) When the unique bandwidth configuration identifier OIId is deleted, the IP mapping data corresponding to the unique bandwidth configuration identifier is deleted.

[0090] maptool apply supports the following input parameters: -c<absolute path of the filter rate limit program file>.

[0091] In this embodiment, the speed limit execution tool determines whether the bandwidth speed limit value, the unique bandwidth configuration identifier, and the public network IP corresponding to the bandwidth have changed according to the bandwidth information configuration file, and performs corresponding processing when it is determined that there has been a change.

[0092] In one of the embodiments, the filter proxy unit is used to provide a filter rate limiting program file and an application programming interface, so that the program loading unit calls the application programming interface to obtain the filter rate limiting program file.

[0093] The filter agent unit (bpf-Agent) provides the compiled filter rate limit program file and exposes the application programming interface (API) of the internal service so that the program loading unit can call the application programming interface to obtain the filter rate limit program file.

[0094] The data structures of ip mapping data and bandwidth mapping data are initialized in the filter speed limit program file. In addition, according to the content of the bandwidth information configuration file bw-info.yaml, the data structure of the filter speed limit program can be converted and processed by the speed limit execution tool maptool to obtain ip mapping data ipmap and bandwidth mapping data bwmap. Specifically, according to several unique bandwidth configuration identifiers OIId in the bandwidth information configuration file bw-info.yaml and the bandwidth speed limit values ​​Limit corresponding to several unique bandwidth configuration identifiers OIId, the bandwidth mapping data bwmap is obtained. According to several IPs in the bandwidth information configuration file bw-info.yaml and the unique bandwidth configuration identifiers OIId corresponding to several IPs, the ip mapping data ipmap is obtained, such as Figure 3 shown.

[0095] In this embodiment, the filter proxy unit provides the filter rate limiting program file to the program loading unit through the application programming interface.

[0096] In one of the embodiments, the speed limit execution tool performs speed limit operations on different IPs sharing the same bandwidth size in the operating system kernel according to the IP mapping data and bandwidth mapping data in the filter speed limit program file, as well as the bandwidth speed limit execution mode. The specific steps are as follows: determining the bandwidth speed limit value corresponding to each IP according to the IP in the IP mapping data and the bandwidth speed limit value in the bandwidth mapping data; through the network traffic speed limit algorithm, in the TC module of the operating system kernel, performing speed limit operations on different IPs sharing the same bandwidth size according to the bandwidth speed limit execution mode and the bandwidth speed limit value corresponding to each IP.

[0097] The speed limit execution tool can determine the bandwidth speed limit value corresponding to each IP in the operating system kernel according to the IP in the IP mapping data and the bandwidth speed limit value in the bandwidth mapping data.

[0098] Through the network traffic speed limit algorithm, in the tc module of the operating system kernel, according to the bandwidth speed limit execution mode and the bandwidth speed limit value corresponding to each IP, the speed limit operation of different IPs sharing the same bandwidth size can be performed.

[0099] The operating system may be a Linux system, and the network traffic rate limiting algorithm may be an edt (Earlist Departure Time) algorithm.

[0100] In this embodiment, the speed limit execution tool performs speed limit operations on different IPs sharing the same bandwidth size in the TC module of the operating system kernel according to the IP in the IP mapping data and the bandwidth speed limit value in the bandwidth mapping data.

[0101] The embodiment of the present application provides a method for limiting the flow rate, which can be executed by a rate limit controller in a flow rate limit system, wherein the flow rate limit system also includes a network element agent unit, a rate limit execution tool, and a filter agent unit. When the life cycle of the network element agent unit or the bandwidth configuration policy changes are monitored, the flow rate limit is implemented according to the bandwidth configuration policy. In this embodiment, the method includes Figure 4 The steps shown are:

[0102] Step S401: when it is monitored that the life cycle of the network element agent unit or the bandwidth configuration policy changes, a bandwidth speed limit execution mode and a bandwidth information configuration file are obtained according to the bandwidth configuration policy.

[0103] The network element proxy unit exists in the form of a deployment resource or a stateful set resource in the container orchestration platform (Kubernetes), and the bandwidth configuration policy is added to the annotation field of the deployment resource or the stateful set resource.

[0104] The monitoring unit in the speed limit controller can use the reconcile function in the reconcile loop mechanism of the container orchestration platform to monitor whether the life cycle of the network element agent module (agent) and the bandwidth configuration policy have changed. When the hash value of the bandwidth configuration policy is detected to be inconsistent with the hash value of the container group in the container orchestration platform, it is determined that the life cycle of the network element agent unit or the bandwidth configuration policy has changed. At this time, the bandwidth speed limit execution mode can be obtained according to the bandwidth identification speed limit mode in the bandwidth configuration policy; the bandwidth information configuration file can be obtained according to the bandwidth information identification speed limit scheme in the bandwidth configuration policy.

[0105] Step S402: updating the IP mapping data and bandwidth mapping data in the filter speed limiting program file through the speed limiting execution tool and the bandwidth information configuration file.

[0106] The speed limit execution tool may be a maptool tool. When the speed limit execution tool maptool determines that the bandwidth speed limit value Limit has changed according to the bandwidth information configuration file bw-info.yaml, the bandwidth mapping data corresponding to the bandwidth speed limit value may be updated; when the speed limit execution tool maptool determines that a unique bandwidth configuration identifier OIId has been deleted according to the bandwidth information configuration file bw-info.yaml, the bandwidth mapping data corresponding to the unique bandwidth configuration identifier OIId is deleted; when the speed limit execution tool maptool determines that the public network IP corresponding to the bandwidth has changed according to the bandwidth information configuration file bw-info.yaml, the IP mapping data corresponding to the public network IP is updated; when the speed limit execution tool maptool determines that a unique bandwidth configuration identifier OIId has been deleted according to the bandwidth information configuration file bw-info.yaml, the IP mapping data corresponding to the unique bandwidth configuration identifier is deleted.

[0107] The ip mapping data ipmap defines the corresponding relationship between the unique bandwidth configuration identifier OIId and the ip in the public network Ips, and the bandwidth mapping data bwmap defines the corresponding relationship between the unique bandwidth configuration identifier OIId and the bandwidth limit value Limit. Different ips can be associated with the same unique bandwidth configuration identifier OIId. One ip can be associated with only one unique bandwidth configuration identifier OIId, and one network card corresponds to one ip.

[0108] Step S403, obtain and load the filter speed limit program file into the operating system kernel, so that the speed limit execution tool in the operating system kernel performs speed limit operations on different IPs sharing the same bandwidth size according to the IP mapping data and bandwidth mapping data in the filter speed limit program file, as well as the bandwidth speed limit execution mode, to achieve traffic speed limit.

[0109] The program loading unit in the rate limit controller can obtain the filter rate limit program file from the filter proxy unit, and load the filter rate limit program file into the operating system kernel.

[0110] The speed limit execution tool can determine the bandwidth speed limit value corresponding to each IP in the operating system kernel according to the IP in the IP mapping data and the bandwidth speed limit value in the bandwidth mapping data. Through the network traffic speed limit algorithm, the tc module of the operating system kernel can perform speed limit operations for different IPs to share the same bandwidth size according to the bandwidth speed limit execution mode and the bandwidth speed limit value corresponding to each IP. The operating system can be a Linux system, and the network traffic speed limit algorithm can be an edt (earlist departure time) algorithm.

[0111] In the above-mentioned traffic speed limiting method, the IP mapping data and bandwidth mapping data are obtained according to the IP data and bandwidth data in the bandwidth information configuration file, so as to realize flexible IP and bandwidth association, realize accurate speed limiting management of network bandwidth, support business scenarios of single IP exclusive bandwidth and multi-IP shared bandwidth, meet the high-performance requirements of large bandwidth under smart network cards and ordinary network cards, and improve the scalability of the traffic speed limiting system.

[0112] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0113] Based on the same inventive concept, the embodiment of the present application also provides a flow rate limiting device for implementing the flow rate limiting method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more flow rate limiting device embodiments provided below can refer to the limitations of the flow rate limiting method above, and will not be repeated here.

[0114] In an exemplary embodiment, Figure 5 As shown, a flow rate limiting device is provided, wherein:

[0115] The monitoring module 501 is used to obtain a bandwidth speed limit execution mode and a bandwidth information configuration file according to the bandwidth configuration policy when a change is detected in the life cycle of the network element agent unit or the bandwidth configuration policy;

[0116] A mapping data updating module 502, used to update the IP mapping data and bandwidth mapping data in the filter speed limit program file through the speed limit execution tool and the bandwidth information configuration file;

[0117] The speed limit operation module 503 is used to obtain and load the filter speed limit program file into the operating system kernel, so that the speed limit execution tool performs speed limit operations on different IPs sharing the same bandwidth size in the operating system kernel according to the IP mapping data and bandwidth mapping data in the filter speed limit program file and the bandwidth speed limit execution mode, so as to realize traffic speed limit.

[0118] Each module in the above-mentioned flow rate limiting device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the rate limiting controller in the form of hardware, or can be stored in the memory in the rate limiting controller in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0119] In an exemplary embodiment, a speed limit controller is provided, which can be a server. The speed limit controller includes a processor, a memory, an input / output interface (I / O for short) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the speed limit controller is used to provide computing and control capabilities. The memory of the speed limit controller includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the speed limit controller is used to store data of an embodiment of a flow speed limit method. The input / output interface of the speed limit controller is used to exchange information between the processor and an external device. The communication interface of the speed limit controller is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a flow speed limit method is implemented.

[0120] In one embodiment, a speed limit controller is further provided, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0121] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0122] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0123] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0124] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0125] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0126] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A flow rate limiting system, characterized in that: The flow rate limiting system includes a network element agent unit, a rate limiting controller, a rate limiting execution tool and a filter agent unit, and the rate limiting controller includes a monitoring unit, a rate limiting configuration unit and a program loading unit, wherein: The monitoring unit is used to monitor whether the life cycle and bandwidth configuration policy of the network element agent unit have changed, and when it is monitored that the life cycle or bandwidth configuration policy of the network element agent unit has changed, send a speed limit operation start instruction to the speed limit configuration unit; The speed limit configuration unit is configured to obtain a bandwidth speed limit execution mode and a bandwidth information configuration file according to the bandwidth configuration strategy when receiving the speed limit operation start instruction; The program loading unit is used to update the IP mapping data and bandwidth mapping data in the filter speed limit program file through the speed limit execution tool and the bandwidth information configuration file; The program loading unit is also used to obtain and load the filter speed limit program file into the operating system kernel, so that the speed limit execution tool performs speed limit operations in the operating system kernel according to the IP mapping data and bandwidth mapping data in the filter speed limit program file, as well as the bandwidth speed limit execution mode, so as to realize traffic speed limit.

2. The system according to claim 1, characterized in that The network element agent unit is a deployment resource or a stateful set resource in a container orchestration platform, and the annotation field of the deployment resource or the stateful set resource includes a bandwidth configuration policy.

3. The system according to claim 1, characterized in that The monitoring unit is used to monitor whether the life cycle and bandwidth configuration strategy of the network element agent unit have changed through the coordination cycle mechanism of the container orchestration platform.

4. The system according to claim 1, characterized in that The monitoring unit monitors whether the life cycle and bandwidth configuration strategy of the network element agent unit have changed, specifically including: When it is monitored that the hash value of the bandwidth configuration policy is inconsistent with the hash value of the container group in the container orchestration platform, it is determined that the life cycle of the network element agent unit or the bandwidth configuration policy has changed.

5. The system according to claim 1, characterized in that The bandwidth configuration strategy includes a bandwidth identification speed limit mode and a bandwidth information identification speed limit scheme. The speed limit configuration unit obtains a bandwidth speed limit execution mode and a bandwidth information configuration file according to the bandwidth configuration strategy, specifically including: Obtaining a bandwidth speed limit execution mode according to the bandwidth identification speed limit mode in the bandwidth configuration strategy; A bandwidth information configuration file is obtained according to the bandwidth information identification speed limit scheme in the bandwidth configuration strategy.

6. The system according to claim 1, characterized in that The program loading unit updates the IP mapping data and the bandwidth mapping data in the filter speed limit program file through the speed limit execution tool and the bandwidth information configuration file, specifically including: When the speed limit execution tool determines, according to the bandwidth information configuration file, that the bandwidth speed limit value has changed, the bandwidth mapping data corresponding to the bandwidth speed limit value is updated; When the speed limit execution tool determines, according to the bandwidth information configuration file, that a unique bandwidth configuration identifier has been deleted, the bandwidth mapping data corresponding to the unique bandwidth configuration identifier is deleted; When the speed limit execution tool determines, based on the bandwidth information configuration file, that the public network IP corresponding to the bandwidth has changed, the IP mapping data corresponding to the public network IP is updated; When the speed limit execution tool determines, based on the bandwidth information configuration file, that a unique bandwidth configuration identifier has been deleted, the IP mapping data corresponding to the unique bandwidth configuration identifier is deleted.

7. The system according to claim 1, characterized in that The filter proxy unit is used to provide the filter rate limiting program file and an application programming interface, so that the program loading unit can call the application programming interface to obtain the filter rate limiting program file.

8. The system according to claim 1, characterized in that The speed limit execution tool performs speed limit operations on different IPs sharing the same bandwidth size in the operating system kernel according to the IP mapping data and bandwidth mapping data in the filter speed limit program file and the bandwidth speed limit execution mode, specifically including: Determine the bandwidth speed limit value corresponding to each IP according to the IP in the IP mapping data and the bandwidth speed limit value in the bandwidth mapping data; Through the network traffic speed limit algorithm, in the tc module of the operating system kernel, according to the bandwidth speed limit execution mode and the bandwidth speed limit value corresponding to each IP, the speed limit operation of different IPs sharing the same bandwidth size is performed.

9. A flow rate limiting method, characterized in that: The method is applied to a speed limit controller in a flow speed limit system, wherein the flow speed limit system further comprises a network element agent unit, a speed limit execution tool and a filter agent unit, and the method comprises: When a change is detected in the life cycle of the network element proxy unit or the bandwidth configuration policy, a bandwidth speed limit execution mode and a bandwidth information configuration file are obtained according to the bandwidth configuration policy; By means of the speed limit execution tool and the bandwidth information configuration file, the IP mapping data and the bandwidth mapping data in the filter speed limit program file are updated; The filter speed limit program file is obtained and loaded into the operating system kernel, so that the speed limit execution tool performs speed limit operations on different IPs sharing the same bandwidth size in the operating system kernel according to the IP mapping data and bandwidth mapping data in the filter speed limit program file and the bandwidth speed limit execution mode, so as to realize traffic speed limit.

10. A flow rate limiting device, characterized in that: The device is applied to a speed limit controller in a flow speed limit system, the flow speed limit system further includes a network element agent unit, a speed limit execution tool and a filter agent unit, and the device includes: A monitoring module, configured to obtain a bandwidth speed limit execution mode and a bandwidth information configuration file according to the bandwidth configuration policy when a change is detected in the life cycle of the network element proxy unit or the bandwidth configuration policy; A mapping data updating module, used to update the IP mapping data and bandwidth mapping data in the filter speed limit program file through the speed limit execution tool and the bandwidth information configuration file; The speed limit operation module is used to obtain and load the filter speed limit program file into the operating system kernel, so that the speed limit execution tool performs speed limit operations on different IPs sharing the same bandwidth size in the operating system kernel according to the IP mapping data and bandwidth mapping data in the filter speed limit program file and the bandwidth speed limit execution mode, so as to realize traffic speed limit.

Images