A method for constructing a multi-fork tree virtual network on a single host

Abstract

The application belongs to the field of multi-fork tree virtual network construction, and discloses a multi-fork tree virtual network construction method on a single host, comprising the following steps: S1: abstract definition of a multi-fork tree virtual network node, definition of a network attribute set of the multi-fork tree virtual network node based on a logical node model; S2: standard encapsulation of atomic actions, decomposition of a multi-fork tree virtual network creation process into minimum granularity indivisible operations, i.e. atomic actions, based on a preset atomic action library; S3: topology arrangement and heterogeneous node configuration generation based on layer sequence traversal, completion of multi-fork tree virtual network topology generation by inputting an atomic action list and executing atomic actions on corresponding nodes; and S4: instantiation execution of the multi-fork tree virtual network and mounting on underlying resources, conversion of the corresponding configuration of step S3 into entity resources in a host kernel by a virtual instantiation engine. Thus, the application realizes construction of a large-scale, high-fidelity and easily reconfigurable multi-level tree-shaped virtual network.

Description

Technical Field

[0001] This application belongs to the field of multi-branch tree virtual network construction, and in particular relates to a method for constructing a multi-branch tree virtual network on a single host. Background Technology

[0002] With the development of cloud computing, network security, and IoT technologies, researchers often need to build complex network topologies in test environments to verify routing algorithms, conduct network attack and defense drills (honeypot or test range deployments), or test distributed systems. Among these, tree networks (especially multi-branch tree structures) are a common network model, widely used in hierarchical routing, sensor network convergence, and large-scale network simulation scenarios.

[0003] Currently, the following technical methods are mainly adopted when constructing such multi-node network environments.

[0004] Option 1: Networking based on physical devices: The traditional method involves purchasing physical routers, switches, and servers, and connecting them using physical network cables to form a network;

[0005] Option 2: Simulation based on full virtualization technology: Using software such as VMware and KVM, multiple complete virtual machines are run on the host machine to simulate network nodes, and Open vSwitch is used to connect the network nodes and form a network;

[0006] Option 3: Flat networking based on basic container networks (such as Docker Bridge): Using container engines such as Docker, multiple containers are connected to the same virtual bridge.

[0007] However, the aforementioned existing technologies all have significant shortcomings when building a large-scale multi-branch tree virtual network on a single host.

[0008] Option 1 is extremely costly and limited by physical space and cabling constraints, resulting in poor scalability. Physically deploying it to simulate a multi-branch tree with 100 nodes is virtually impossible. Furthermore, topology reconfiguration of the physical environment (such as changing the number of branches in the tree) requires rewiring, leading to very low flexibility.

[0009] Option two is resource-intensive. Each virtual machine needs to run a complete operating system kernel, consuming a significant amount of CPU and memory. A single ordinary physical host can typically only run a few dozen virtual machine nodes, which is insufficient to support large-scale network simulations (such as hundreds or thousands of nodes). Furthermore, the slow startup speed of virtual machines makes it difficult to meet the needs of rapid and repeated testing.

[0010] Option 3 lacks support for complex topologies, and existing tools struggle to automatically generate multi-hop tree structures with hierarchical relationships and parent-child node routing. Summary of the Invention

[0011] The purpose of this application is to address the problems of high resource consumption, poor scalability, and cumbersome, inefficient, and error-prone calculations when configuring multi-level topologies in existing technologies for large-scale network simulation on a single physical host. This application discloses a method for constructing multi-branch tree virtual networks on a single host, aiming to achieve the construction of large-scale, high-fidelity, and easily reconfigurable multi-level tree virtual networks with limited hardware resources by combining automated algorithm generation with lightweight virtualization technology.

[0012] The objective of this application is achieved through the following technical solution:

[0013] A method for constructing a multi-branch tree virtual network on a single host, the method comprising:

[0014] S1: Abstract definition of multi-branch tree virtual network node. Based on the logical node model, the network attribute set of multi-branch tree virtual network node is defined. The network attribute set is a parameter template to be filled, including: upstream node information, local address, child node interface list, downstream subnet routing information, and local node subnet information.

[0015] S2: Standardized encapsulation of atomic actions. Based on a pre-defined atomic action library, the process of creating a multi-branch tree virtual network is decomposed into the smallest indivisible operations, namely atomic actions.

[0016] S3: Topology arrangement and heterogeneous node configuration generation based on level order traversal. By inputting a list of atomic actions and executing atomic actions on the corresponding nodes, the topology of the multi-way tree virtual network is generated.

[0017] S4: Instantiation and underlying resource mounting of the multi-branch tree virtual network, where the virtual instantiation engine converts the configuration corresponding to step S3 into entity resources in the host kernel.

[0018] According to a preferred embodiment, in step S2, the atomic action is defined through a parameterized interface, and the definition process includes:

[0019] a) Instantiation of the root node and bridge mapping

[0020] The root node is defined by using the unique identifier and network address information of the receiving node as configuration parameters, initializing a logical node object, and injecting the corresponding configuration parameters into the corresponding attribute fields.

[0021] In the underlying network implementation, the root node is configured as a Layer 3 virtual bridge in the host network protocol stack. The corresponding Layer 3 virtual bridge is assigned a management IP address, and the corresponding device name is generated according to a preset deterministic naming standard.

[0022] b) Construction of the root node downlink and instantiation of the first-level child nodes

[0023] According to the preset network addressing strategy, the first-level child nodes share the CIDR address block resources of the root node, and receive the node's unique identifier and target IP address as input parameters during the construction process;

[0024] c) Route node cascading expansion based on independent subnet partitioning

[0025] When cascading child nodes to any node other than the root node, an independent subnet allocation strategy is executed. This strategy ensures that data packets must cross the network segment boundary when transmitted between nodes by placing the parent and child nodes in different logical IP network segments, thereby triggering the standard route lookup and gateway forwarding process.

[0026] The parameters for cascading expansion of routing nodes based on independent subnetting include: the IP addresses of the local router and the next-level router in the new network segment, as well as the unique identifier of the next-level router node.

[0027] According to a preferred embodiment, the construction process of the root node downlink in step S2 includes the following three atomic execution phases:

[0028] Address compliance verification: First, perform logical operations on the input IP address to verify whether it falls within the subnet mask range defined by the root node, in order to ensure route reachability;

[0029] Node object instantiation: After successful verification, the system initializes the data structure instance of the child node and injects the configuration parameters into the corresponding attribute fields;

[0030] Link Identifier Generation and Topology Mapping: Generates a globally unique name for the virtual Ethernet veth pair, which is used to build a physical channel connecting the root node network namespace and the child node network namespace on the host side.

[0031] According to a preferred embodiment, the routing node cascading expansion process based on independent subnet division in step S2 includes the following atomic action execution phases:

[0032] Address compliance verification: Determine whether the IP addresses of the current router and the next-level router are in the same network segment and do not overlap with the network segments of all upstream nodes;

[0033] Node object instantiation: After successful validation, initialize the data structure instance of the child node and inject the configuration parameters into the corresponding attribute fields;

[0034] Link identifier generation and topology mapping: Each node maintains a key-value pair-based adjacency mapping table. This adjacency mapping table uses the unique name of the subnet IP address and the network interface name of the node and its child nodes as the combined index key, and the memory pointer pointing to the corresponding child node instance as the value, to achieve accurate indexing and management of the lower-level topology.

[0035] Routing table entry declaration: The newly created routing node involves a new subnet, and routes pointing to the new subnet are added to all upper-level nodes;

[0036] Recursive injection of routing table entries based on backtracking mechanism: For the target network segment introduced by the newly created routing node, perform a path backtracking operation along the tree upwards.

[0037] According to a preferred implementation, the process of performing a path backtracking operation along the tree includes: the algorithm starts from the current node and traverses all ancestor nodes to the root node. At each hop in the traversal process, a static routing table entry pointing to the target network segment is dynamically constructed, wherein the target address is set to the subnet segment of the newly created node; the next-hop gateway is resolved to the address of the direct successor node of the current ancestor node on the path to the target node.

[0038] According to a preferred embodiment, step S3 includes: inputting the multi-branch tree virtual network topology into the automatic orchestration module, which uses a configuration generation engine to scan the multi-branch tree logical topology in memory using a level-order traversal strategy, and generates orchestration instructions and configuration files required for instantiation in a differentiated manner according to the hierarchical position and functional role of the nodes.

[0039] According to a preferred embodiment, step S3 specifically includes the following process:

[0040] a) Access Layer Link Construction

[0041] When traversing to the top level of the topology tree, the host-virtual network interconnection configuration is executed, that is, the root node of the tree is identified and the logical connection between it and the physical host is established, and the interface identifier connecting the host and the node of the next level is generated.

[0042] b) Generation of routing plane configuration

[0043] For the backbone routing nodes in the tree structure, a routing configuration file is automatically calculated and generated. The routing configuration file defines static routing table entries and forwarding rules and is marked as read-only.

[0044] c) Layer 2 emulation of the terminal subnet

[0045] When the traversed node contains a virtual host subnet, perform Layer 2 network construction and instantiation operations;

[0046] d) Arrange the serialized output of the description file

[0047] After completing the traversal and object construction of all network nodes, all node definitions and link definitions are aggregated, and finally the aggregated object is serialized into a standardized orchestration description file, which serves as the input blueprint for the underlying virtualization engine to start the entire virtual network.

[0048] According to a preferred embodiment, step S4 includes:

[0049] a) Environmental cleanup and preliminary resource preparation

[0050] First, a status check and cleanup operation is performed. If an old virtual network instance with the same name is detected, a destruction command is invoked to forcibly remove the related container, bridge, and residual virtual interface. Then, a bridge for connecting the downlink between the host machine and the virtual network root node is initialized in the host machine's network protocol stack.

[0051] b) Parallel startup of containerized nodes

[0052] Read the orchestration configuration file generated by S3 and drive the container runtime to concurrently start all virtual node containers;

[0053] c) Cross-namespace link mounting and interconnection

[0054] After the container starts up, the physical links are mounted later according to the topology definition in memory.

[0055] d) Injection and activation of routing policies

[0056] After the link is physically connected, the routing table loading operation in the control plane is performed.

[0057] According to a preferred embodiment, during the concurrent startup of all virtual node containers in step S4, an independent network namespace is allocated to each container according to the configuration parameters. At this time, the started containers are in a network isolation state, have only a loopback interface, and have not yet been connected to the multi-branch tree topology.

[0058] According to a preferred embodiment, step S4, which involves loading the routing table in the control plane, includes: traversing the static routing forwarding rules in the routing configuration file generated in step S3, and writing the routing table entries into the kernel FIB table by executing routing configuration instructions in the namespace of the corresponding node. This ensures that in the multi-branch tree structure, any node has an accurate forwarding path to all its descendant subnets.

[0059] The aforementioned main solution and its various further alternative solutions can be freely combined to form multiple solutions, all of which are solutions that can be adopted and are claimed in this application. Those skilled in the art, after understanding the solution of this application, will realize that there are many combinations based on the prior art and common general knowledge, all of which are technical solutions to be protected in this application, and will not be exhaustively listed here.

[0060] The beneficial effects of this application are:

[0061] (1) Break through the bottleneck of single-machine resources and realize high-density network simulation.

[0062] Existing virtual machine emulation solutions require each node to run a complete operating system kernel, resulting in high resource consumption and limiting a single machine to only a few dozen nodes. This invention utilizes container technology and Linux network namespace technology to significantly reduce the CPU and memory usage of a single virtual node by sharing the host machine kernel. Specifically, this invention can easily build large-scale multi-branch tree virtual networks with hundreds or even thousands of nodes on a single ordinary physical host, significantly improving simulation density and resource utilization in a single-machine environment, and solving the problem that traditional virtual machine solutions cannot perform large-scale network testing.

[0063] (2) It realizes the automated construction of complex multi-level topologies, eliminating manual configuration errors.

[0064] Existing basic container networks mostly have a flat structure. Building multi-level, multi-hop networks requires manual calculation of complex subnet masks, allocation of IP addresses, and writing of massive routing rules, which is inefficient and prone to errors. This invention achieves fully automated conversion from "abstract topology parameters (tree depth, number of branches)" to "underlying network configuration" through recursive generation algorithms and atomic action encapsulation. The system can automatically complete the hierarchical division of all network nodes, conflict-free planning of IP address resources, and pre-calculation and injection of static routing tables.

[0065] (3) It has high-fidelity Layer 3 routing and forwarding capabilities, which makes up for the simulation deficiencies of container networks.

[0066] Existing solutions such as Docker bridges are typically based on Layer 2 switching, which cannot realistically simulate packet routing and TTL (Time to Live) consumption across network segments. This invention constructs physically isolated broadcast domains between parent and child nodes through a mandatory independent subnetting strategy and virtual Ethernet connection technology, forcing packets to undergo routing lookups and Layer 3 forwarding via the kernel protocol stack. This provides a high-fidelity experimental environment for routing algorithm verification and network attack and defense drills (such as Traceroute path tracing and TTL spoofing detection).

[0067] (4) Extremely low deployment cost and extremely high topology reconfiguration flexibility

[0068] Physical networking solutions are limited by hardware costs and physical cabling. Once the topology is established, reconstruction (such as adding branches) requires rewiring, which is time-consuming and labor-intensive. This invention is based on the concept of software-defined networking, which completely codifies the network topology. Users do not need to purchase expensive physical equipment or plug and unplug physical network cables. By simply modifying the algorithm input parameters, the system can instantly destroy the old network and rebuild a completely new topology, providing flexibility and scalability that physical environments cannot match, and reducing the economic costs of research and testing. Attached Figure Description

[0069] Figure 1 This is a flowchart illustrating the method of this application. Detailed Implementation

[0070] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, unless otherwise specified, the following embodiments and features in the embodiments can be combined with each other.

[0071] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0072] In the description of this application, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship commonly used when the product of this application is in use. They are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation on this application. In addition, the terms "first," "second," and "third," etc., are only used to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0073] In the description of this application, it should also be noted that, unless otherwise expressly specified and limited, the terms "set up," "install," "connect," and "link" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0074] Furthermore, it should be noted that unless otherwise specified in this application, the specific structures, connections, positions, power sources, etc. involved are all things that a person skilled in the art can know without creative effort based on the prior art.

[0075] Example 1

[0076] refer to Figure 1 As shown, this application discloses a method for constructing a multi-branch tree virtual network on a single host. This method defines a network node model and a virtualized atomic action library, and uses a recursive generation algorithm to automatically convert abstract tree topology parameters into specific low-level network configuration instructions, thereby achieving rapid construction of large-scale, highly complex multi-level network environments. The method for constructing a multi-branch tree virtual network on a single host includes the following steps.

[0077] Step S1: Abstract definition of multi-way tree virtual network nodes

[0078] Based on the logical node model, the network attribute set of a multi-way tree virtual network node is defined. This network attribute set is a parameter template to be filled, including: upstream node information, local address, child node interface list, downstream subnet routing information, and the node's own subnet information. The main function of a logical node is network routing; it can be considered a virtual router. The general logical node model contains a unique identifier for each node.

[0079] Step S2: Standardized encapsulation of atomic actions

[0080] Based on a pre-defined atomic action library, the multi-branch tree virtual network creation process is decomposed into indivisible operations of the smallest granularity, i.e., atomic actions. In step S2, the atomic actions are defined through a parameterized interface, and the definition process includes:

[0081] a) Instantiation of the root node and bridge mapping

[0082] The initial stage of constructing a multi-branch tree virtual network involves the creation of the root node. The root node is defined by initializing a logical node object and injecting the corresponding configuration parameters into the relevant attribute fields, using the unique identifier of the receiving node and network address information (IP address and subnet mask defined in CIDR format) as configuration parameters.

[0083] In the underlying network implementation, the root node is configured as a Layer 3 virtual bridge in the host network protocol stack. The corresponding Layer 3 virtual bridge is assigned a management IP address, and the corresponding device name is generated according to a preset deterministic naming convention, such as "br-root node identifier".

[0084] b) Construction of the root node downlink and instantiation of the first-level child nodes

[0085] Establishing direct subordinate connections to the root node is the first step in topology expansion. According to the preset network addressing strategy, first-level child nodes share the CIDR address block resources of the root node, and receive the node's unique identifier and the target IP address as input parameters during the construction process.

[0086] Furthermore, the construction process of the root node downlink includes the following three atomic execution phases:

[0087] Address compliance verification: First, perform logical operations on the input IP address to verify whether it falls within the subnet mask range defined by the root node, in order to ensure route reachability;

[0088] Node object instantiation: After successful verification, the system initializes the data structure instance of the child node and injects the configuration parameters into the corresponding attribute fields;

[0089] Link Identifier Generation and Topology Mapping: This process generates globally unique names for virtual Ethernet veth pairs, used to construct physical channels connecting the root node's network namespace and child node's network namespace on the host side. Given that the virtual network uses a multi-way tree topology, the root node maintains a key-value pair-based adjacency mapping table. This table uses the generated unique virtual link names as index keys and memory pointers to the corresponding child node instances as values, thus enabling precise indexing and management of the lower-level topology. Simultaneously, each node also maintains its own parent node pointer.

[0090] c) Route node cascading expansion based on independent subnet partitioning

[0091] To simulate the Layer 3 forwarding behavior of a real router in a virtual network, an independent subnet allocation strategy is executed when cascading child nodes to any node other than the root node. This strategy ensures that data packets must cross subnet boundaries when transmitted between nodes by placing parent and child nodes in different logical IP subnets, thereby triggering the standard route lookup and gateway forwarding process.

[0092] The parameters for cascading expansion of routing nodes based on independent subnetting include: the IP addresses of the local router and the next-level router in the new network segment, as well as the unique identifier of the next-level router node.

[0093] Furthermore, the routing node cascading expansion process based on independent subnet division includes the following atomic action execution phases:

[0094] Address compliance verification: Determine whether the IP addresses of the current router and the next-level router are in the same network segment and do not overlap with the network segments of all upstream nodes;

[0095] Node object instantiation: After successful validation, initialize the data structure instance of the child node and inject the configuration parameters into the corresponding attribute fields;

[0096] Link identifier generation and topology mapping: Each node maintains a key-value pair-based adjacency mapping table. This adjacency mapping table uses the unique name of the subnet IP address and the network interface name of the node and its child nodes as the combined index key, and the memory pointer pointing to the corresponding child node instance as the value, to achieve accurate indexing and management of the lower-level topology.

[0097] Routing table entry declaration: The newly created routing node involves a new subnet, and routes pointing to the new subnet are added to all upper-level nodes;

[0098] Recursive injection of routing table entries based on backtracking mechanism: For the target network segment introduced by the newly created routing node, perform a path backtracking operation along the tree upwards.

[0099] The process of performing path backtracking upwards along the tree includes: starting from the current node, the algorithm traverses all ancestor nodes to the root node. At each hop during the traversal, a static routing table entry pointing to the target network segment is dynamically constructed, where the target address is set to the subnet segment of the newly assigned node; the next-hop gateway (Next Hop / Via) is resolved to the address of the direct successor node of the current ancestor node on the path to the target node. This process ensures that the root node and all intermediate nodes along the way have an accurate forwarding path to the newly assigned subnet.

[0100] Step S3: Generation of topology arrangement and heterogeneous node configuration based on level-order traversal

[0101] The multi-branch tree virtual network topology is generated by inputting a list of atomic actions and executing those actions on the corresponding nodes. This topology is then input into the automatic orchestration module. This module uses a configuration generation engine and a level-order traversal strategy to scan the logical multi-branch tree topology in memory. Based on the node's level and functional role, it generates differentiated orchestration instructions and configuration files required for instantiation. The specific execution logic is as follows.

[0102] a) Access Layer Link Construction

[0103] When traversing to the top level of the topology tree, the host-virtual network interconnection configuration is executed, that is, the root node of the tree is identified and a logical connection is established between it and the physical host, and an interface identifier connecting the host and the next level node is generated (e.g., veth-s1-r2 on the host side and eth1 on the container side).

[0104] b) Generation of routing plane configuration

[0105] For the backbone routing nodes in the tree structure, a routing configuration file is automatically calculated and generated. This configuration file defines static routing entries and forwarding rules and is marked as read-only. At runtime, the generated routing configuration file is mapped to a specified path inside the container through a file mounting mechanism, ensuring that the node has the preset routing capabilities upon startup.

[0106] c) Layer 2 emulation of the terminal subnet

[0107] When the traversed node contains a virtual host subnet, Layer 2 network construction and instantiation operations are performed. The first step is to construct the software-defined switching unit. In order to simulate Layer 2 switching functions in a containerized environment, instead of relying on a dedicated switch image, a general-purpose lightweight container (such as Alpine Linux) is instantiated. By injecting privileged network instructions, a virtual bridge device is created in the container kernel, and all downlink interfaces are bound to the bridge, thereby constructing a logical virtual switch.

[0108] d) Arrange the serialized output of the description file

[0109] After completing the traversal and object construction of all network nodes, all node definitions and link definitions are aggregated, and finally the aggregated object is serialized into a standardized orchestration description file (such as YAML format) as the input blueprint for the underlying virtualization engine to start the entire virtual network.

[0110] Step S4: Instantiation and mounting of the multi-branch tree virtual network and underlying resources

[0111] After generating the standardized orchestration description file, the final execution phase begins. The virtualization engine (which can be built-in script logic, open-source tools like Containerlab, or a custom scheduler) transforms the configuration from step S3 into physical resources within the host kernel. This process involves strict timing control, and the specific steps are as follows.

[0112] a) Environmental cleanup and preliminary resource preparation

[0113] To ensure the atomicity of the build process and the purity of the environment, a state check and cleanup operation is performed first. If an old virtual network instance with the same name is detected, a destruction command is invoked to forcibly remove the related containers, bridges, and residual virtual interfaces. Subsequently, a bridge for connecting the downlink between the host machine and the virtual network root node is initialized in the host machine's network protocol stack.

[0114] b) Parallel startup of containerized nodes

[0115] The system reads the orchestration configuration file generated by S3 and drives the container runtime (such as Docker) to concurrently start all virtual node containers. During this process, each container is allocated an independent network namespace according to the configuration parameters. At this time, the started containers are in a network isolation state, have only a loopback interface, and have not yet been connected to the multi-way tree topology.

[0116] c) Cross-namespace link mounting and interconnection

[0117] After the container starts up, the physical links are mounted later according to the topology definition in memory. This step can be completed automatically by the orchestration tool or manually by calling the kernel Netlink interface (such as the ip link instruction set). The core logic is as follows: generate pairs of virtual Ethernet interfaces in the host namespace, then keep one end of the virtual Ethernet interface in the host or parent node namespace, inject the other end into the network namespace of the corresponding child node, and finally rename the injected interface to a standard name (such as eth1) in the target namespace and perform the link activation operation.

[0118] d) Injection and activation of routing policies

[0119] After the link is physically connected, the routing table loading operation of the control plane is performed. The process includes: traversing the static routing forwarding rules in the routing configuration file generated in step S3, and writing the routing table entries into the kernel FIB table by executing the routing configuration instructions in the namespace of the corresponding node. This ensures that in the multi-way tree structure, any node has an accurate forwarding path to all its descendant node subnets.

[0120] In this embodiment, the physical implementation of the multi-branch tree virtual network is based on the Linux operating system kernel's Network Namespace (NetNs) technology and Virtual Ethernet Pair (vethpair) technology. Node isolation mechanism: Each logical node of the multi-branch tree is mapped to an independent network namespace within the host machine, thereby constructing an isolated environment with an independent protocol stack (including independent network cards, routing tables, ARP caches, and iptables rules). In actual implementation, independent network namespaces are usually mounted within containers. Link connection mechanism: Logical connections between nodes (i.e., tree edges) are implemented by creating pairs of virtual network interfaces (veth pairs). This interface pair acts as a "virtual network cable," with its two ends placed in the network namespaces of the parent and child nodes respectively, thus establishing a Layer 2 data channel across namespaces.

[0121] The beneficial effects of this application are as follows:

[0122] (1) Break through the bottleneck of single-machine resources and realize high-density network simulation.

[0123] Existing virtual machine emulation solutions require each node to run a complete operating system kernel, resulting in high resource consumption and limiting a single machine to only a few dozen nodes. This invention utilizes container technology and Linux network namespace technology to significantly reduce the CPU and memory usage of a single virtual node by sharing the host machine kernel. Specifically, this invention can easily build large-scale multi-branch tree virtual networks with hundreds or even thousands of nodes on a single ordinary physical host, significantly improving simulation density and resource utilization in a single-machine environment, and solving the problem that traditional virtual machine solutions cannot perform large-scale network testing.

[0124] (2) It realizes the automated construction of complex multi-level topologies, eliminating manual configuration errors.

[0125] Existing basic container networks mostly have a flat structure. Building multi-level, multi-hop networks requires manual calculation of complex subnet masks, allocation of IP addresses, and writing of massive routing rules, which is inefficient and prone to errors. This invention achieves fully automated conversion from "abstract topology parameters (tree depth, number of branches)" to "underlying network configuration" through recursive generation algorithms and atomic action encapsulation. The system can automatically complete the hierarchical division of all network nodes, conflict-free planning of IP address resources, and pre-calculation and injection of static routing tables.

[0126] (3) It has high-fidelity Layer 3 routing and forwarding capabilities, which makes up for the simulation deficiencies of container networks.

[0127] Existing solutions such as Docker bridges are typically based on Layer 2 switching, which cannot realistically simulate packet routing and TTL (Time to Live) consumption across network segments. This invention constructs physically isolated broadcast domains between parent and child nodes through a mandatory independent subnetting strategy and virtual Ethernet connection technology, forcing packets to undergo routing lookups and Layer 3 forwarding via the kernel protocol stack. This provides a high-fidelity experimental environment for routing algorithm verification and network attack and defense drills (such as Traceroute path tracing and TTL spoofing detection).

[0128] (4) Extremely low deployment cost and extremely high topology reconfiguration flexibility

[0129] Physical networking solutions are limited by hardware costs and physical cabling. Once the topology is established, reconstruction (such as adding branches) requires rewiring, which is time-consuming and labor-intensive. This invention is based on the concept of software-defined networking, which completely codifies the network topology. Users do not need to purchase expensive physical equipment or plug and unplug physical network cables. By simply modifying the algorithm input parameters, the system can instantly destroy the old network and rebuild a completely new topology, providing flexibility and scalability that physical environments cannot match, and reducing the economic costs of research and testing.

[0130] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for constructing a multi-branch tree virtual network on a single host, characterized in that, The method for constructing a multi-way tree virtual network on a single host includes: S1: Abstract definition of multi-branch tree virtual network node. Based on the logical node model, the network attribute set of multi-branch tree virtual network node is defined. The network attribute set is a parameter template to be filled, including: upstream node information, local address, child node interface list, downstream subnet routing information, and local node subnet information. S2: Standardized encapsulation of atomic actions. Based on a pre-defined atomic action library, the process of creating a multi-branch tree virtual network is decomposed into the smallest indivisible operations, namely atomic actions. S3: Topology arrangement and heterogeneous node configuration generation based on level order traversal. By inputting a list of atomic actions and executing atomic actions on the corresponding nodes, the topology of the multi-way tree virtual network is generated. S4: The instantiation and underlying resource mounting of the multi-branch tree virtual network are carried out by the virtual instantiation engine, which converts the configuration corresponding to step S3 into the entity resources in the host kernel. In step S2, the atomic action is defined through a parameterized interface, and the definition process includes: a) Instantiation of the root node and bridge mapping The root node is defined by using the unique identifier and network address information of the receiving node as configuration parameters, initializing a logical node object, and injecting the corresponding configuration parameters into the corresponding attribute fields. In the underlying network implementation, the root node is configured as a Layer 3 virtual bridge in the host network protocol stack. The corresponding Layer 3 virtual bridge is assigned a management IP address, and the corresponding device name is generated according to a preset deterministic naming standard. b) Construction of the root node downlink and instantiation of the first-level child nodes According to the preset network addressing strategy, the first-level child nodes share the CIDR address block resources of the root node, and receive the node's unique identifier and target IP address as input parameters during the construction process; c) Route node cascading expansion based on independent subnet partitioning When cascading child nodes to any node other than the root node, an independent subnet allocation strategy is executed. This strategy ensures that data packets must cross the network segment boundary when transmitted between nodes by placing the parent and child nodes in different logical IP network segments, thereby triggering the standard route lookup and gateway forwarding process. The parameters for cascading expansion of routing nodes based on independent subnetting include: the IP addresses of the local router and the next-level router in the new network segment, as well as the unique identifier of the next-level router node. The routing node cascading expansion process based on independent subnet division in step S2 includes the following atomic action execution phases: Address compliance verification: Determine whether the IP addresses of the current router and the next-level router are in the same network segment and do not overlap with the network segments of all upstream nodes; Node object instantiation: After successful validation, initialize the data structure instance of the child node and inject the configuration parameters into the corresponding attribute fields; Link identifier generation and topology mapping: Each node maintains a key-value pair-based adjacency mapping table. This adjacency mapping table uses the unique name of the subnet IP address and the network interface name of the node and its child nodes as the combined index key, and the memory pointer pointing to the corresponding child node instance as the value, to achieve accurate indexing and management of the lower-level topology. Routing table entry declaration: The newly created routing node involves a new subnet, and routes pointing to the new subnet are added to all upper-level nodes; Recursive injection of routing table entries based on backtracking mechanism: For the target network segment introduced by the newly created routing node, perform a path backtracking operation along the tree upwards; The process of performing a path backtracking operation along the tree includes: starting from the current node, the algorithm traverses all ancestor nodes to the root node. At each hop in the traversal process, a static routing table entry pointing to the target network segment is dynamically constructed, where the target address is set to the subnet segment of the newly created node; the next-hop gateway is resolved to the address of the direct successor node of the current ancestor node on the path to the target node.

2. The method for constructing a multi-branch tree virtual network on a single host as described in claim 1, characterized in that, The construction process of the root node downlink in step S2 includes the following three atomic execution phases: Address compliance verification: First, perform logical operations on the input IP address to verify whether it falls within the subnet mask range defined by the root node, in order to ensure route reachability; Node object instantiation: After successful verification, the system initializes the data structure instance of the child node and injects the configuration parameters into the corresponding attribute fields; Link Identifier Generation and Topology Mapping: Generates a globally unique name for the virtual Ethernet veth pair, which is used to build a physical channel connecting the root node network namespace and the child node network namespace on the host side.

3. The method for constructing a multi-branch tree virtual network on a single host as described in claim 1, characterized in that, Step S3 includes: inputting the multi-branch tree virtual network topology into the automatic orchestration module. The automatic orchestration module uses a configuration generation engine to scan the multi-branch tree logical topology in memory using a level-order traversal strategy, and generates orchestration instructions and configuration files required for instantiation in a differentiated manner according to the hierarchical position and functional role of the nodes.

4. The method for constructing a multi-branch tree virtual network on a single host as described in claim 3, characterized in that, The specific execution process of step S3 includes: a) Access Layer Link Construction When traversing to the top level of the topology tree, the host-virtual network interconnection configuration is executed, that is, the root node of the tree is identified and the logical connection between it and the physical host is established, and the interface identifier connecting the host and the node of the next level is generated. b) Generation of routing plane configuration For the backbone routing nodes in the tree structure, a routing configuration file is automatically calculated and generated. The routing configuration file defines static routing table entries and forwarding rules and is marked as read-only. c) Layer 2 emulation of the terminal subnet When the traversed node contains a virtual host subnet, perform Layer 2 network construction and instantiation operations; d) Arrange the serialized output of the description file After completing the traversal and object construction of all network nodes, all node definitions and link definitions are aggregated, and finally the aggregated object is serialized into a standardized orchestration description file, which serves as the input blueprint for the underlying virtualization engine to start the entire virtual network.

5. The method for constructing a multi-branch tree virtual network on a single host as described in claim 4, characterized in that, Step S4 includes: a) Environmental cleanup and preliminary resource preparation First, a status check and cleanup operation is performed. If an old virtual network instance with the same name is detected, a destruction command is called to remove the related container, bridge, and residual virtual interface. Then, a bridge for connecting the downlink between the host machine and the virtual network root node is initialized in the host machine's network protocol stack. b) Parallel startup of containerized nodes Read the orchestration configuration file generated by S3 and drive the container runtime to concurrently start all virtual node containers; c) Cross-namespace link mounting and interconnection After the container starts up, the physical links are mounted later according to the topology definition in memory. d) Injection and activation of routing policies After the link is physically connected, the routing table loading operation in the control plane is performed.

6. The method for constructing a multi-branch tree virtual network on a single host as described in claim 5, characterized in that, During step S4, when all virtual node containers are started concurrently, an independent network namespace is allocated to each container according to the configuration parameters. At this time, the started containers are in a network isolation state, have only a loopback interface, and have not yet been connected to the multi-branch tree topology.

7. The method for constructing a multi-branch tree virtual network on a single host as described in claim 5, characterized in that, Step S4, which involves loading the routing table in the control plane, includes: By traversing the static routing forwarding rules in the routing configuration file generated in step S3, and executing routing configuration instructions in the namespace of the corresponding node, the routing table entries are written into the kernel FIB table, thereby ensuring that any node in the multi-way tree structure has an accurate forwarding path to all its descendant node subnets.

Images