Virtualized network topology building method and virtual network resource management system

Abstract

The invention aims to provide a virtualized network resource management system and a method for establishing virtualized network topology, and the method comprises the steps: configuring a trigger condition and / or a timed scanning task in advance, traversing all three-layer networks, obtaining information of associated subordinate cloud hosts, and writing the information into a real-time table; and finding a port link, a network card link and a switch link from the real-time table, and assembling to obtain a network topological relation, thereby realizing virtualized networking and network resource management functions, and providing a basis for management of a security component and a cloud host.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of network resource management, and particularly relates to a component method of a virtual network topology structure and a resource management system applying the method. BACKGROUND

[0002] With the rapid development of Internet technology and the increasing urgency of the country's concern for network space security, with the landing of EPS 2.0 and the implementation of the Network Security Law, the scale of enterprises or organizations is becoming larger and larger, and the number of corresponding network resources and assets is becoming more and more huge. It becomes more and more difficult to sort out the network and assets, especially for some units with high security and confidentiality requirements, such as government departments, military units, research institutes and financial institutions. How to timely discover the user's arbitrary modification of internal computers, unauthorized access, information leakage and other violations, and track and collect evidence on related events is an important means to solve the computer and network security within the organization.

[0003] In order to meet the requirements of the network security protection system, enterprises and organizations also purchase a large number of various protection hardware devices to achieve compliance, and the EPS all-in-one machine integrates multiple virtual security functions in one, which can replace traditional physical security devices to provide corresponding security services. However, the problem that follows is that due to the use of network virtualization deployment, how to accurately and comprehensively identify the network relationship of various network resources in the all-in-one machine cluster and arrange a virtual network topology that meets the security service requirements according to the customer's security service needs is an important prerequisite for realizing effective network monitoring and management, and is also the basis for further realizing network threat analysis. SUMMARY

[0004] In view of the above background, the present application aims to provide a virtualized network resource management system and a method for building a virtualized network topology. The specific technical solutions are described as follows.

[0005] In the first aspect, a method for building a virtualized network topology is provided, comprising, creating a VXLAN resource address pool; querying a VXLAN network resource pool list to obtain available addresses and creating a corresponding layer 2 network; querying a list of layer 2 networks that have not been mounted with a layer 3 network, and creating a corresponding layer 3 network; obtaining cloud host information; timely scanning the connection relationship between the layer 3 network and its subordinate cloud hosts, associating and generating a network topology structure.

[0006] The creating of the two-layer network further comprises obtaining available physical interfaces of the platform and binding the two-layer network, marking the two-layer network resource type according to the interface type, and saving the created data to the database; when the two-layer network is deleted, the two-layer network is first unbound from the corresponding three-layer network, and after the network is deleted by the engine, the system deletes the corresponding data from the database; When the three-layer network is deleted, the cloud host referring to the three-layer network is removed first, and after the underlying resource configuration is deleted by the engine, the system deletes the corresponding configuration data from the database.

[0007] Further, the creating process of the two-layer network resource specifically comprises: The administrator creates a two-layer network through a WEB management interface, obtains a list of physical network interfaces of the platform from a network resource management service, queries physical network interface data from a database, the database returns currently available physical network interfaces, and the service returns the list of physical network interfaces to the interface. The administrator fills in all parameter items on the interface, sends a new request to the service, saves data configuration to the database, and simultaneously calls a network resource scheduling engine to issue a creating instruction to an OVS management and maintenance engine; The scheduling engine returns a successful calling to the service, the service returns a successful creating to the interface, and the interface displays a successful creating to the administrator. The administrator queries a two-layer network list on the interface, the interface queries two-layer network list data from the database, the database returns the latest two-layer network list to the interface, and the interface displays the two-layer network list to the administrator.

[0008] Further, the network topology building method further comprises configuration synchronization of the two-layer network. According to the configuration table, the underlying is checked and corrected after each restart, and the configuration is synchronized. The network resource engine executes the following after each restart: querying and traversing the two-layer network configuration table, querying the associated physical network card to be normal and the network link configuration table to be normal, and synchronizing the two-layer network IP.

[0009] Further, the timing scanning and discovering connection relationship comprises a topology discovery timing task and a WEB service interface: the topology discovery timing task traverses all three-layer service networks first, and then queries all three-layer service networks associated with the host, assembles the network connection relationship between the three-layer service network and the cloud host, and updates the network relationship to the network topology database; the WEB service interface returns the topology data queried from the database to the front-end interface to display the topology logical structure.

[0010] Further, before the scanning and discovering of the connection relationship, the method further comprises switch information collection, which is called when the topology is generated, and the specific collection process comprises: (1) Get switch information and port information of the switch through the Bridge table, and establish a mapping relationship; (2) Get port information through the Interface and Port tables, and determine the relationship between the port and the switch in combination with the switch and Port mapping relationship; (3) Get link traffic information through the statics information in the Interface; (4) Finally, write into the openvswitch_port table after summarizing.

[0011] Preferably, the cloud host information includes cloud host name, running state, CPU, memory, disk, and uplink and downlink traffic size.

[0012] In a second aspect, a virtualized network resource management system is provided, comprising: A platform network management module provides a physical network port list of a switch; A network resource management module is used to manage layer 2, layer 3, VXLAN network and network topology; A cloud host management module is used to monitor cloud host state and information, and provide cloud host information; A database module saves network configuration and network topology information; A Web interface module is used to display the generated network topology structure.

[0013] The process of the network resource management module to build a network topology includes: creating a VXLAN resource address pool; querying a VXLAN network resource pool list to obtain available addresses, and creating a corresponding layer 2 network; querying a list of layer 2 networks that have not been mounted with layer 3 networks, and creating a corresponding layer 3 network; obtaining cloud host information; periodically scanning the connection relationship between the layer 3 network and its subordinate cloud hosts, associating and generating a network topology structure.

[0014] Periodic scanning and discovering connection relationship include topology discovery periodic task and WEB service interface: the topology discovery periodic task traverses all layer 3 service networks through a 10-minute periodic tasker, then queries all layer 3 service networks associated with the host, assembles the network connection relationship between the layer 3 service network and the cloud host, and updates the network relationship to the network topology database; the WEB service interface returns the topology data of the database to the front-end interface to display the topology logical structure.

[0015] The present invention adopts the above technical solution, which has at least the following beneficial effects: pre-configuring trigger conditions and / or scheduled scanning tasks, traversing all three-layer networks and obtaining associated subordinate cloud host information and writing it into a real-time table, discovering port links, network card links and switch links in the real-time table, assembling to obtain network topology relationships, realizing virtualized networking and network resource management functions, and providing a basis for security component and cloud host management. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solutions and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with embodiments.

[0017] In order to better understand the technical content of the embodiments of the present invention, the main technical terms involved are first explained.

[0018] An information security level protection appliance (platform), also known as an information security level protection appliance, is a security device that assists business systems in passing security compliance checks. Deployed on a server, it provides information security protection for the user data center where the server resides. Built on a virtualization or cloud computing platform, it transforms traditional physical security devices into software-based, virtualized security components that are then used by the information platform to deliver security services. These components can include firewalls, database auditing, security operations and maintenance, intrusion prevention, network access, vulnerability scanning, security management, website monitoring, and log auditing, offering any one or a combination of these services based on business needs.

[0019] Topology discovery of virtual network resources primarily focuses on the management of underlying virtual switches and the design of virtualized networking. This process spans both the appliance subsystem and the cloud resource pool subsystem, involving the security component management module within the appliance, cloud host management, and network management within the cloud resource pool system. Its primary purpose is to manage Layer 2, VXLAN, and Layer 3 networks, and to implement network topology management. Example

[0020] This embodiment proposes a method for establishing a virtualized network topology, including: Create a VXLAN resource address pool; Query the VXLAN network resource pool list to obtain available addresses and create the corresponding Layer 2 network; Query the list of Layer 2 networks that have not yet been mounted with a Layer 3 network, and create the corresponding Layer 3 network; Get cloud host information; The connection relationship between the three-layer network and its subordinate cloud hosts is scanned regularly, and the network topology is associated and generated.

[0021] As a preferred embodiment, the above-mentioned creation of the Layer 2 network also includes obtaining the platform's available physical interface and binding it to the Layer 2 network, so as to mark the Layer 2 network resource type according to the interface type, and saving the created data to the database; when deleting the Layer 2 network, first unbinding it from the corresponding Layer 3 network, and after the engine deletes the network, the system deletes the corresponding data from the database; When deleting a three-layer network, first remove the cloud host that references the three-layer network. After the engine deletes the underlying resource configuration, the system deletes the corresponding configuration data from the database.

[0022] Furthermore, it also includes the creation of Layer 2 network resources. The specific process includes: The administrator creates a new Layer 2 network through the web management interface, obtains the platform's physical network port list from the network resource management service, queries the physical network port data from the database, and the database returns the currently available physical network ports. The service returns the physical network port list to the interface, which displays a physical network port drop-down box to the administrator. The administrator fills in all parameters on the interface, sends a new request to the service, saves the data configuration to the database, and calls the network resource scheduling engine to send a creation instruction to the OVS management and maintenance engine. The scheduling engine returns a successful call to the service, the service returns a successful creation to the interface, and the interface returns a successful creation to the administrator; The administrator queries the Layer 2 network list on the interface. The interface queries the database for Layer 2 network list data. The database returns the latest Layer 2 network list to the interface, which then displays it to the administrator.

[0023] As a preferred embodiment, the above-mentioned network topology establishment method further includes configuration synchronization of the Layer 2 network: According to the configuration table, after each restart, the bottom layer is checked and corrected, and the configuration is synchronized; After each restart of the network resource engine, the following operations are executed: query and traverse the Layer 2 network configuration table, query the associated physical network card and the network link configuration table to ensure that they are normal, and then synchronize the Layer 2 network IP.

[0024] As a preferred implementation method, the above-mentioned scheduled scanning and connection relationship discovery include a topology discovery scheduled task and a WEB service interface: the topology discovery scheduled task first traverses all three-layer business networks through a scheduled tasker every 10 minutes, then queries the three-layer business networks associated with all hosts, assembles the network connection relationship between the three-layer business network and the cloud host, and updates its network relationship to the network topology database; the WEB service interface returns the topology data of the query database to the front-end interface to display the topology logical structure.

[0025] Furthermore, before scanning and discovering connection relationships, switch information collection is also included, which is called when topology is generated. The specific collection process includes: (1) Obtain switch information and switch port information through the Bridge table and establish a mapping relationship; (2) Obtain port information through the Interface and Port tables, and determine the relationship between the port and the switch by combining the mapping relationship between the switch and the port; (3) Obtain link traffic information through the statics information in the Interface; (4) Finally, the data is summarized and written into the openvswitch_port table.

[0026] As a preferred implementation, the above-mentioned cloud host information includes the cloud host name, operating status, CPU, memory, disk, and upstream and downstream traffic sizes. Example

[0027] This embodiment provides a virtualized network resource management system, including: The platform network management module provides a list of physical network ports of the switch; Network resource management module, used to manage Layer 2, Layer 3, VXLAN networks and network topology; Cloud host management module, used to monitor cloud host status and information, and provide cloud host information; Database module, saves network configuration and network topology information; Web interface module, used to display the generated network topology.

[0028] The above-mentioned network resource management module, the process of forming a network topology, includes: creating a VXLAN resource address pool; querying the VXLAN network resource pool list to obtain available addresses and creating a corresponding Layer 2 network; querying the Layer 2 network list that has not yet mounted a Layer 3 network and creating a corresponding Layer 3 network; obtaining cloud host information; regularly scanning the connection relationship between the Layer 3 network and its subordinate cloud hosts, associating and generating a network topology structure.

[0029] As a preferred implementation method, the above-mentioned scheduled scanning and connection relationship discovery include a topology discovery scheduled task and a WEB service interface: the topology discovery scheduled task first traverses all three-layer business networks through a scheduled tasker every 10 minutes, then queries the three-layer business networks associated with all hosts, assembles the network connection relationship between the three-layer business network and the cloud host, and updates its network relationship to the network topology database; the WEB service interface returns the topology data of the query database to the front-end interface to display the topology logical structure.

[0030] As described above, the technical solution of the embodiment of the present invention pre-configures trigger conditions and / or scheduled scanning tasks, traverses all three-layer networks and obtains the associated subordinate cloud host information and writes it into a real-time table, discovers port links, network card links and switch links in the real-time table, assembles the network topology relationship, realizes virtualized networking and network resource management functions, and provides a basis for security component and cloud host management.

[0031] Those skilled in the art will understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a program, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc.

[0032] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein, but is intended to be embodied in the widest possible manner consistent with the principles disclosed herein.

Claims

1. A method for establishing a virtualized network topology, characterized in that: include, Create a VXLAN resource address pool; Query the VXLAN network resource pool list to obtain available addresses and create the corresponding Layer 2 network; Query the list of Layer 2 networks that have not yet been mounted with a Layer 3 network, and create the corresponding Layer 3 network; Get cloud host information; The connection relationship between the three-layer network and its subordinate cloud hosts is scanned regularly, and the network topology is associated and generated.

2. The network topology building method according to claim 1, characterized in that: The creation of the Layer 2 network also includes obtaining the platform's available physical interface and binding it to the Layer 2 network, marking the Layer 2 network resource type according to the interface type, and saving the created data to the database; when deleting the Layer 2 network, first unbinding it from the corresponding Layer 3 network, and after the engine deletes the network, the system deletes the corresponding data from the database; When deleting a three-layer network, first remove the cloud host that references the three-layer network. After the engine deletes the underlying resource configuration, the system deletes the corresponding configuration data from the database.

3. The network topology establishment method according to claim 2, characterized in that: The process of creating the Layer 2 network resources includes: The administrator creates a new Layer 2 network through the web management interface, obtains the platform's physical network port list from the network resource management service, queries the physical network port data from the database, and the database returns the currently available physical network ports. The service returns the physical network port list to the interface, which displays a physical network port drop-down box to the administrator. The administrator fills in all parameters on the interface, sends a new request to the service, saves the data configuration to the database, and calls the network resource scheduling engine to send a creation instruction to the OVS management and maintenance engine. The scheduling engine returns a successful call to the service, the service returns a successful creation to the interface, and the interface returns a successful creation to the administrator; The administrator queries the Layer 2 network list on the interface. The interface queries the database for Layer 2 network list data. The database returns the latest Layer 2 network list to the interface, which then displays it to the administrator.

4. The network topology building method according to claim 1, characterized in that: It also includes Layer 2 network configuration synchronization: According to the configuration table, after each restart, the bottom layer is checked and corrected, and the configuration is synchronized; After each restart of the network resource engine, the following operations are executed: query and traverse the Layer 2 network configuration table, query the associated physical network card and the network link configuration table to ensure that they are normal, and then synchronize the Layer 2 network IP.

5. The network topology building method according to claim 1, characterized in that: The scheduled scanning and connection relationship discovery includes a topology discovery scheduled task and a WEB service interface: the topology discovery scheduled task first traverses all three-layer business networks through a scheduled tasker every 10 minutes, then queries the three-layer business networks associated with all hosts, assembles the network connection relationship between the three-layer business network and the cloud host, and updates its network relationship to the network topology database; The WEB service interface queries the topology data of the database and returns it to the front-end interface to display the topology logical structure.

6. The network topology building method according to claim 5, characterized in that: Including switch information collection, which is called when topology is generated: (1) Obtain switch information and switch port information through the Bridge table and establish a mapping relationship; (2) Obtain port information through the Interface and Port tables, and determine the relationship between the port and the switch by combining the mapping relationship between the switch and the port; (3) Obtain link traffic information through the statics information in the Interface; (4) Finally, the data is summarized and written into the openvswitch_port table.

7. The network topology building method according to claim 1, characterized in that: The cloud host information includes the cloud host name, operating status, CPU, memory, disk, and upstream and downstream traffic sizes.

8. A virtualized network resource management system, characterized in that: include: The platform network management module provides a list of physical network ports of the switch; Network resource management module, used to manage Layer 2, Layer 3, VXLAN networks and network topology; Cloud host management module, used to monitor cloud host status and information, and provide cloud host information; Database module, saves network configuration and network topology information; Web interface module, used to display the generated network topology.

9. The network resource management system according to claim 8, characterized in that: The process of the network resource management module to build a network topology includes: creating a VXLAN resource address pool; querying the VXLAN network resource pool list to obtain available addresses and creating a corresponding Layer 2 network; querying the list of Layer 2 networks that have not yet mounted a Layer 3 network and creating a corresponding Layer 3 network; obtaining cloud host information; regularly scanning the connection relationship between the Layer 3 network and its subordinate cloud hosts, associating and generating a network topology structure.

10. The network resource management system according to claim 9, characterized in that: Scheduled scanning and connection relationship discovery, including topology discovery scheduled tasks and web service interfaces: The topology discovery scheduled task uses a scheduled tasker every 10 minutes to first traverse all three-layer business networks, then query the three-layer business networks associated with all hosts, assemble the network connection relationships between the three-layer business networks and cloud hosts, and update these network relationships to the network topology database; The WEB service interface queries the topology data of the database and returns it to the front-end interface to display the topology logical structure.