A flow transmission method, system, device and storage medium

Abstract

The present invention discloses a traffic transmission method, system, device and storage medium, which relates to the field of information technology. After receiving the traffic sent by the source virtual machine, the source OVN router first determines whether the traffic is to be encapsulated and encrypted. If it is to be encapsulated and encrypted, the traffic is directly sent to the source namespace, so that the source namespace encapsulates and encrypts the traffic and then sends it to the target namespace. The target namespace decapsulates and decrypts the traffic and then sends it to the target virtual machine through the target OVN router. In this application, the OVN router is used to realize the transmission of traffic, and the encapsulation, encryption and decapsulation and decryption of the traffic are performed by the namespace instead of the OVN router, which ensures the secure transmission of the traffic while being less invasive to the source OVN router, and utilizes the keep-alive feature of OVN to reduce the overhead of the keep-alive mechanism.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a flow transmission method, system, device and storage medium. Background Art

[0002] In the prior art, when traffic is transmitted between virtual machines in different intranets, the virtual machine sending the traffic sends the traffic to its corresponding router, and the router encapsulates and encrypts the traffic and transmits it to the virtual machine that needs to receive the traffic through the router corresponding to the virtual machine that needs to receive the traffic.

[0003] OpenStack is an open source cloud computing management platform project and a combination of a series of software open source projects.

[0004] With the development of technology, the OVN (Open Virtual Network) architecture under OpenStack has also been gradually developed, and the OVN architecture can also realize the router function. Therefore, how to use OVN to realize the above-mentioned traffic transmission is a problem that needs to be solved urgently by technical personnel in this field. Summary of the invention

[0005] The purpose of the present invention is to provide a traffic transmission method, system, device and storage medium, which utilizes the OVN router to realize traffic transmission, and performs traffic encapsulation encryption and decryption processing through namespace instead of the OVN router, thereby ensuring the secure transmission of traffic while being less invasive to the source OVN router, and utilizing the keep-alive feature of OVN to reduce the overhead of the keep-alive mechanism.

[0006] In order to solve the above technical problems, the present invention provides a traffic transmission method, which is applied to a source OVN router, the OVN router manages multiple virtual machines, and the OVN router is connected to a namespace correspondingly. The method includes:

[0007] After receiving the traffic sent by the source virtual machine, determining whether the traffic is traffic to be encapsulated and encrypted;

[0008] If so, the traffic is sent to the source namespace, so that the source namespace encapsulates and encrypts the traffic and then sends it to the target namespace, so that the target namespace decapsulates and decrypts the traffic and then sends it to the target virtual machine through the target OVN router.

[0009] Preferably, after receiving the traffic sent by the source virtual machine, after determining whether the traffic is traffic to be encapsulated and encrypted, the method further includes:

[0010] If not, the traffic is sent to the target virtual machine through the target OVN router.

[0011] Preferably, after receiving the traffic sent by the source virtual machine, after determining whether the traffic is traffic to be encapsulated and encrypted, the method further includes:

[0012] After receiving the traffic sent by the source virtual machine, determining the target virtual machine corresponding to the traffic;

[0013] Determine a target namespace for connecting to a target OVN router that manages the target virtual machine based on the IP address of the target virtual machine.

[0014] Preferably, the source OVN router is connected to the source namespace via a transit OVN switch;

[0015] Sending the traffic to the source namespace, so that the source namespace encapsulates and encrypts the traffic and then sends it to the target namespace, so that the target namespace decapsulates and decrypts the traffic and then sends it to the target virtual machine through the target OVN router, including:

[0016] The traffic is sent to the source namespace through the transit OVN switch, so that the source namespace encapsulates and encrypts the traffic and then sends it to the target namespace, so that the target namespace decapsulates and decrypts the traffic and then sends it to the target virtual machine through the target OVN router.

[0017] Preferably, each of the source virtual machines is connected to the source OVN router via an intranet OVN switch;

[0018] After receiving the traffic sent by the source virtual machine, determining whether the traffic is traffic to be encapsulated and encrypted includes:

[0019] After receiving the traffic sent by the source virtual machine through the intranet OVN switch, it is determined whether the traffic is traffic to be encapsulated and encrypted.

[0020] Preferably, the source namespace and the target namespace are connected via an external network OVN switch;

[0021] Sending the traffic to the source namespace, so that the source namespace encapsulates and encrypts the traffic and then sends it to the target namespace, so that the target namespace decapsulates and decrypts the traffic and then sends it to the target virtual machine through the target OVN router, including:

[0022] The traffic is sent to the source namespace, so that the source namespace encapsulates and encrypts the traffic and then sends it to the target namespace through the external network OVN router, so that the target namespace decapsulates and decrypts the traffic and then sends it to the target virtual machine through the target OVN router.

[0023] Preferably, the namespace includes a strongSwan unit;

[0024] The source namespace encapsulates and encrypts the traffic and sends it to the target namespace, including:

[0025] The strongSwan unit in the source namespace uses the IPsec protocol to encapsulate and encrypt the traffic and then sends it to the target namespace;

[0026] The target namespace decrypts the traffic and sends it to the target virtual machine through the target OVN router, including:

[0027] The strongSwan unit in the target namespace uses the IPsec protocol to decrypt the traffic and then sends it to the target virtual machine through the target OVN router.

[0028] In order to solve the above technical problems, the present invention provides a traffic transmission system, which is applied to a source OVN router, the OVN router manages multiple virtual machines, the OVN router is connected to a namespace, and the method includes:

[0029] A judging unit, configured to judge whether the traffic sent by the source virtual machine is traffic to be encapsulated and encrypted after receiving the traffic;

[0030] A sending unit is used to send the traffic to a source namespace when the traffic is the traffic to be encapsulated and encrypted, so that the source namespace encapsulates and encrypts the traffic and then sends it to a target namespace, so that the target namespace decapsulates and decrypts the traffic and then sends it to a target virtual machine through a target OVN router.

[0031] In order to solve the above technical problems, the present invention provides a flow transmission device, comprising:

[0032] Memory for storing computer programs;

[0033] The source OVN router is used to implement the steps of the traffic transmission method as described above when executing the computer program.

[0034] To solve the above technical problem, the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by the source OVN router, the steps of the traffic transmission method as described above are implemented.

[0035] The present application provides a traffic transmission method, system, device and storage medium, which relates to the field of information technology. After receiving the traffic sent by the source virtual machine, the source OVN router first determines whether the traffic is to be encapsulated and encrypted. If it is to be encapsulated and encrypted, the traffic is directly sent to the source namespace, so that the source namespace encapsulates and encrypts the traffic and sends it to the target namespace. The target namespace decapsulates and decrypts the traffic and sends it to the target virtual machine through the target OVN router. In the present application, the OVN router is used to realize the transmission of traffic, and the encapsulation, encryption and decapsulation and decryption of the traffic are performed by the namespace instead of the OVN router, which ensures the secure transmission of the traffic while being less invasive to the source OVN router, and utilizes the keep-alive feature of OVN to reduce the overhead of the keep-alive mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the prior art and the drawings required for use in the embodiments are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0037] Figure 1 A flow chart of a flow transmission method provided by the present invention;

[0038] Figure 2 A schematic diagram of a traffic transmission network topology in the prior art;

[0039] Figure 3 A schematic diagram of a traffic transmission network topology provided by the present invention;

[0040] Figure 4 A schematic diagram of the structure of a flow transmission system provided by the present invention;

[0041] Figure 5 A schematic structural diagram of a flow transmission device provided by the present invention. DETAILED DESCRIPTION

[0042] The core of the present invention is to provide a traffic transmission method, system, device and storage medium, which utilizes the OVN router to realize traffic transmission, and performs traffic encapsulation, encryption and decryption processing through the namespace instead of the OVN router, thereby ensuring the secure transmission of traffic while being less invasive to the source OVN router, and utilizing the keep-alive feature of OVN to reduce the overhead of the keep-alive mechanism.

[0043] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] Please refer to Figure 1 , Figure 1 A flow chart of a traffic transmission method provided by the present invention is applied to a source OVN router, the OVN router manages multiple virtual machines, the OVN router is connected to a namespace, and the method includes:

[0045] S11: after receiving the traffic sent by the source virtual machine, determining whether the traffic is traffic to be encapsulated and encrypted;

[0046] First, in the prior art, VPN (Virtual Private Network) is a remote access technology that establishes a private network on a public network to perform encrypted communication between different devices.

[0047] VPN can establish a logical link at the L2 layer (data link layer) or L3 layer (IP (Internet Protocol) layer) to allow multiple intranets on the WAN to access each other. There are many ways to implement VPN: one is based on leasing dedicated physical lines, such as frame relay and ATM (asynchronous transfer mode). Because it is a dedicated line, the price is higher, but the QoS (Quality of Service) is better, which is crucial for delay-sensitive data streams such as voice. Therefore, it can run multiple protocols such as upper-layer IP, IPX (Internetwork Packet Exchange protocol), AppleTalk (Apple Communication Protocol) and IP multicast; another is based on the implementation of Ethernet virtual connection, which is not a dedicated line, flexible, and the data channel is not secure. It needs to be combined with IPSec (Internet Protocol Security) to ensure the security of data transmission.

[0048] Among them, the implementation methods of Ethernet-based virtual connections are classified as follows:

[0049] GRE (Generic Routing Encapsulation), L2TP (Layer 2 Tunneling Protocol), MPLS (Multi-Protocol Label Switching) and IPSec are all L3 VPN technologies;

[0050] GRE VPN: The process of establishing VPN is convenient, but it has no security mechanism and needs to be combined with IPSec to support identity authentication, data integrity, access control and confidentiality during traffic transmission;

[0051] SSL VPN only needs a single TCP (Transmission Control Protocol) or UDP (User Datagram Protocol) port to easily pass through most firewalls for traffic transmission;

[0052] MPLS VPN, when using GRE tunneling technology to implement VPN, because GRE is point-to-point transmission traffic, when a new site is added, the VPN configuration of each site needs to be modified. However, MPLS uses the L3 layer routing mechanism to pre-calculate the L2 layer label on each router on the way before transmitting traffic, and this label is automatically configured, so it is more convenient to add a new site in the MPLS implementation;

[0053] IPSec VPN is a technology with a very high click rate among current VPN technologies. It can provide both VPN and information encryption technologies.

[0054] There are three application scenarios of IPSec VPN:

[0055] Site-to-Site (site-to-site or gateway-to-gateway): For example, if three organizations of an enterprise are located in three different places on the Internet, each organization uses a Business Navigator gateway to establish a VPN channel with each other. The data traffic between the enterprise intranets (several PCs) is securely interconnected through the IPSec VPN channels established by these gateways.

[0056] End-to-End (PC to PC): The communication between two PCs is protected by the IPSec session between the two PCs, not the gateway.

[0057] End-to-Site (end-to-site or PC-to-gateway): The communication between two PCs is protected by IPSec between the gateway and the remote PC.

[0058] However, VPN is only one application of IPSec. IPSec is the abbreviation of IP Security. Its purpose is to provide high security features for IP, and VPN is a solution generated under the way to achieve this security feature.

[0059] IPSec is a framework architecture consisting of two types of protocols:

[0060] AH protocol (Authentication Header, less commonly used): can provide security features such as data integrity confirmation, data source confirmation, and anti-replay. AH commonly uses digest algorithms (one-way hash functions) MD5 and SHA1 to implement this security feature.

[0061] ESP protocol (Encapsulated Security Payload, widely used): can provide security features such as data integrity confirmation, data encryption, and anti-replay. ESP usually uses encryption algorithms such as DES, 3DES, and AES to implement data encryption, and uses MD5 or SHA1 to achieve data integrity.

[0062] In the Havana version of Openstack, a feature added to Neutron is VPNaaS (VPN as a service), which introduces VPN functionality into Neutron and implements IPSecVPN.

[0063] Neutron's VPNaaS is based on the open source StrongSwan implementation. By running VPNaaSagent in the network node and configuring the StrongSwan service in the network namespace of the virtual router, the site-to-site function of IPSecVPN is implemented in OpenStack. The main code implementation framework is as follows:

[0064] The RestAPI layer defines the API extension of IPSecVPN and provides an API interface to the outside world.

[0065] Add IPSec VPN service plugin in neutron server to receive and process VPNaaS resource-related requests sent by API interface, operate DB, which is a database that stores routing information, network information and VPN encryption information, and send RPC messages to VPNaaS agent process running on network node according to demand. At the same time, IPSec VPN service plugin will register several callbacks using neutron callback mechanism. For example, if VPN function is implemented on router, VPNaaS confirmation is required before deleting router through neutron command. Otherwise, if it is deleted by mistake, it will affect the normal use of VPN, that is, affect the secure transmission of traffic.

[0066] When VPNaaS agent initializes strongSwan, it creates a consumer to listen to RPC calls, thereby ensuring that strongSwan is callable, that is, ensuring that the traffic can be encapsulated and encrypted. Then a series of commands are executed to create the IPSec process and update the status of the VPN connection. When VPNaaS agent is initialized, it also registers several callbacks for the operation of the router and performs corresponding operations when the status of the router changes. For example, when the router switches from active to standby, the IPsec process on the VPNaaS agent where the slave router is located needs to be deleted to avoid leakage of encrypted traffic.

[0067] Based on the above logical framework, in the prior art, a site-to-site solution of IPSecVPN is implemented in Neutron based on the open source strongswan solution. The network topology finally implemented is as follows: Figure 2 As shown, Figure 2 The figure is a schematic diagram of a traffic transmission network topology in the prior art, wherein the strongSwan process in the prior art runs in the namespace of the router, and provides VPN services for the internal subnet under the router, that is, for each virtual machine managed by the router.

[0068] Specifically, in the prior art, when transmitting traffic, the strongSwan process in the router is used for encapsulation and encryption. For example, when a virtual machine in the subnet (10.10.10.0 / 24) wants to access a virtual machine in a subnet (20.20.20.0 / 24) in another external network, the traffic is first sent to the router corresponding to the subnet (10.10.10.0 / 24). There are rules pre-configured by VPNaaSagent on the router. When it is found that the virtual machine in the destination subnet (20.20.20.0 / 24) is a subnet controlled by VPN, that is, when the traffic is to be encapsulated and encrypted, the strongSwan process in the router will take over this traffic and encrypt the traffic through the IPSec channel to send it to the destination router. The destination router is connected to the virtual machine in the subnet (20.20.20.0 / 24), which has a similar StrongSwan process. It decrypts the traffic based on the IPSec protocol and sends it to the virtual machine in the destination subnet (20.20.20.0 / 24). At this point, the communication of IPSecVPN traffic is completed.

[0069] Please refer to Figure 3 , Figure 3 A schematic diagram of a traffic transmission network topology provided by the present invention.

[0070] In this application, the OVN architecture is used to establish a VPN channel. Specifically, the source virtual machines are managed by the source OVN router, that is, the source virtual machines must pass through the source OVN router when transmitting traffic between the source virtual machines and the virtual machines in the external network.

[0071] When the source virtual machine transmits traffic through the source OVN router and the target virtual machine on the external network, it is necessary to determine whether the traffic is to be encapsulated and encrypted. If it is to be encapsulated and encrypted, the traffic must be encapsulated and encrypted before it can be transmitted to avoid malicious interception of the traffic, which may lead to data leakage.

[0072] After neutron uses OVN to implement the underlying virtual network, that is, to use OVN to build an OVN router, considering that OVN itself does not provide VPN functions, the present invention is based on the implementation of neutronVPNaaS, by introducing an independent VPNaaS agent, adding a specific OVN service plug-in and device driver to support the latest VPNaaS agent. There is no impact on the original VPNaaS. The new VPNaaS agent will create a namespace on the corresponding node and connect to the OVN router.

[0073] Based on the existing network architecture and code design of VPNaaS, the present invention combines the OVN router and innovatively designs a new VPN-specific namespace on the host where the OVN router is located, diverts the traffic sent from the source virtual machine to the source OVN router to the source namespace, and allocates a new external network IP in the source namespace to encapsulate and encrypt IPSecVPN traffic data packets. In terms of logical code design, a new OVN VPN service plug-in and a new VPNaaS agent are added to realize the scheduling of VPN services in different agents according to router attributes, and a new agent activation mechanism is also realized.

[0074] S12: If the traffic is to be encapsulated and encrypted, the traffic is sent to the source namespace, so that the source namespace encapsulates and encrypts the traffic and then sends it to the target namespace, so that the target namespace decapsulates and decrypts the traffic and then sends it to the target virtual machine through the target OVN router.

[0075] In this embodiment, if the traffic is to be encapsulated and encrypted, the source OVN router does not need to encapsulate and encrypt the traffic, but only needs to direct the traffic to the source namespace, so that the source namespace encapsulates and encrypts the traffic and then sends it to the target namespace for decapsulation and decryption, and then sends it to the target virtual machine through the target OVN router.

[0076] The network topology implemented by VPN under the OVN router in this application is different from the implementation of VPNaaS based on setting namesapce in the virtual router. The OVN router is implemented through the flow table. There is no namesapce in the OVN router and the gateway IP of the OVN router is in the OVN flow table and cannot be used by strongswan. Therefore, the specific implementation process of VPN under the OVN router is as follows;

[0077] 1) The VPNaaS agent on the OVN router node creates a new namespace and inserts two ports into the namespace: one is the VPN external gateway port for communicating with the external network, and the other is connected to the OVN router.

[0078] 2) Add a port connection namespace on the OVN router to route the traffic from the local virtual machine to the peer network to the namespace, so that the namespace encapsulates the IPSecVPN traffic. When the IPsecVPN connection is created, the corresponding traffic routing will be added to the OVN router;

[0079] 3) Similarly, when creating an IPsecVPN connection, the corresponding diversion route is added to the namespace, the traffic from the peer network to the local network is unblocked and diverted to the OVN router of the local network;

[0080] 4) The OVN router is automatically created when the first VPN service is created and automatically deleted when the last VPN is deleted. That is, it is created when the first traffic is transmitted and automatically deleted after the last traffic is transmitted.

[0081] It can be seen that the VPN structure in this application has been creatively changed based on the VPNaaS structure in the prior art to adapt to the inherent characteristics of the OVN router. In the code logic implementation of the present invention, the process of defining the API extension of IPSecVPN is the same as that of the prior art, and the main improvements are concentrated in the plug-in and the lower layer.

[0082] 1) Different from the VPNaaS service plug-in, the OVN router no longer relies on the traditional neutron L3 router and L3 agent. The new service plug-in implements a new scheduler. The new VPNaaS agent scheduler will run based on the OVN router to connect all IPSec sites of the OVN router of the same agent. This ensures that each OVN router has only one VPN namespace and only schedules one VPNaaS agent. At the same time, the creation and deletion of VPN gateway ports and transit OVN switches are completed.

[0083] 2) The OVN VPNaaS agent uses the new OVN device driver to complete the creation of the namespace and the insertion of ports. The namespace is created by the VPNaaS agent when the first OVN router IPSec site connection is created. If all IPSec sites are deleted, the OVN router IPSec site connection is deleted as well.

[0084] 3) OVN’s keepalive mechanism utilizes the synchronization mechanism of OVN’s north-south database. The plug-in sets a new value in the external_id of NB_Global, and the agent monitors SB_Global and sets the chassis column external_id at the same time.

[0085] In summary, in this application, the OVN router is used to realize the transmission of traffic, and the encapsulation, encryption, and decryption of the traffic are performed through the namespace instead of the OVN router, which ensures the secure transmission of the traffic while being less invasive to the source OVN router, and utilizes the keep-alive feature of OVN to reduce the overhead of the keep-alive mechanism.

[0086] Based on the above embodiments:

[0087] As a preferred embodiment, after receiving the traffic sent by the source virtual machine, determining whether the traffic is traffic to be encapsulated and encrypted, the method further includes:

[0088] If not, the traffic is sent to the target VM via the target OVN router.

[0089] In this embodiment, if the traffic sent by the source virtual machine received by the source OVN router is not the traffic to be encapsulated and encrypted, that is, the security of the traffic does not need to be considered, there is no need to send the traffic to the source namespace for encapsulation and encryption. The traffic can be directly sent to the target virtual machine through the target OVN router, thereby improving the traffic transmission efficiency.

[0090] It can be seen that the process of encapsulating and encrypting the traffic in the source namespace and decapsulating and decrypting the traffic in the target namespace is omitted, thereby improving the efficiency of traffic transmission.

[0091] As a preferred embodiment, after receiving the traffic sent by the source virtual machine, determining whether the traffic is traffic to be encapsulated and encrypted, the method further includes:

[0092] After receiving the traffic sent by the source virtual machine, determine the target virtual machine corresponding to the traffic;

[0093] Determine the target namespace to which the target OVN router that manages the target virtual machine is connected based on the target virtual machine's IP address.

[0094] In this embodiment, after receiving the traffic sent by the source virtual machine, the target virtual machine that needs to receive the traffic can be determined through the traffic, and then the target OVN router that manages the target virtual machine can be determined based on the IP of the target virtual machine. The traffic is encapsulated and encrypted, and then sent to the target namespace connected to the target OVN router for decapsulation and decryption to realize the transmission of traffic between gateways.

[0095] As a preferred embodiment, the source OVN router is connected to the source namespace via a transit OVN switch;

[0096] Send traffic to the source namespace, so that the source namespace encapsulates and encrypts the traffic and sends it to the target namespace, so that the target namespace decapsulates and decrypts the traffic and sends it to the target virtual machine through the target OVN router, including:

[0097] The traffic is sent to the source namespace through the transit OVN switch, so that the source namespace encapsulates and encrypts the traffic and sends it to the target namespace, so that the target namespace decapsulates and decrypts the traffic and sends it to the target virtual machine through the target OVN router.

[0098] In this embodiment, considering that the same source OVN router is usually connected to multiple source namespaces, each source namespace corresponds to the IP addresses of multiple different target virtual machines, so as to realize the traffic transmission between each source virtual machine and more target virtual machines under the management of the source OVN router. However, the source OVN router usually does not have enough interfaces to connect to multiple source namespaces at the same time, so a transit OVN switch is set between the source OVN router and the source namespace, and the source OVN router transmits the traffic to the source namespace through the transit OVN switch for traffic encapsulation and encryption processing.

[0099] It should be noted that when the traffic is transmitted to the source namespace for encapsulation and encryption through the transit OVN router, the source namespace corresponding to the target virtual machine IP can be determined in advance. After the traffic is transmitted to the source namespace, the source namespace will encapsulate and encrypt the traffic into the IP corresponding to the target virtual machine, thereby ensuring that only the target virtual machine can receive the traffic sent by the source virtual machine, avoiding traffic interception and leakage.

[0100] As a preferred embodiment, each source virtual machine is connected to the source OVN router via an intranet OVN switch;

[0101] After receiving the traffic sent by the source virtual machine, determine whether the traffic is to be encapsulated and encrypted, including:

[0102] After receiving the traffic sent by the source virtual machine through the intranet OVN switch, it is determined whether the traffic is to be encapsulated and encrypted.

[0103] In this embodiment, since each OVN router manages multiple virtual machines, the OVN router does not have enough interfaces to connect to each virtual machine. Therefore, in order to be able to manage each virtual machine, in this embodiment, an intranet OVN switch is also set between the source OVN router and each source virtual machine. Each source virtual machine can be connected to the source OVN router through the intranet OVN switch to transmit traffic to the source OVN router through the intranet OVN switch.

[0104] Of course, the target virtual machine and the target OVN router can also be connected through the intranet OVN switch. The intranet OVN switch between the target virtual machine and the target OVN router is not the same as the intranet OVN switch between the source virtual machine and the source OVN router. That is, each OVN router and each virtual machine it manages can be connected through the intranet OVN switch to enable the OVN router to transmit traffic to each virtual machine and send traffic to each virtual machine.

[0105] As a preferred embodiment, the source namespace and the target namespace are connected via an external network OVN switch;

[0106] Send traffic to the source namespace, so that the source namespace encapsulates and encrypts the traffic and sends it to the target namespace, so that the target namespace decapsulates and decrypts the traffic and sends it to the target virtual machine through the target OVN router, including:

[0107] Send the traffic to the source namespace so that the source namespace encapsulates and encrypts the traffic and sends it to the target namespace through the external network OVN router, so that the namespace decapsulates and decrypts the traffic and sends it to the target virtual machine through the target OVN router.

[0108] Considering that the source OVN router will be connected to multiple source namespaces, the target OVN router will also be connected to multiple target namespaces, and that traffic transmission will actually need to be carried out between multiple OVN routers, based on this, in this embodiment, an external network OVN switch is also set between the namespaces for traffic transmission, and different namespaces are connected through the external network OVN switch to realize traffic transmission between different gateways.

[0109] As a preferred embodiment, the namespace includes a strongSwan unit;

[0110] The source namespace encapsulates and encrypts the traffic and sends it to the target namespace, including:

[0111] The strongSwan unit in the source namespace uses the IPsec protocol to encapsulate and encrypt the traffic and then sends it to the target namespace;

[0112] The target namespace decrypts the traffic and sends it to the target virtual machine through the target OVN router, including:

[0113] The strongSwan unit in the target namespace uses the IPsec protocol to decrypt the traffic and then sends it to the target virtual machine through the target OVN router.

[0114] In this embodiment, the namespace includes a strongSwan unit. After the source namespace receives the traffic transmitted by the source OVN router, the strongSwan unit therein uses the IPsec protocol to encapsulate and encrypt the traffic, so as to encapsulate and encrypt the traffic into the IP of the target virtual machine, and then send it to the target namespace. The target namespace also includes a strongSwan unit, which decapsulates and decrypts the received traffic sent by the source namespace, and transmits the decapsulated and decrypted traffic to the target virtual machine through the target OVN router, thereby realizing the construction of a VPN channel between the source virtual machine and the target virtual machine, that is, realizing secure traffic transmission between the source virtual machine and the target virtual machine through the VPN channel.

[0115] Please refer to Figure 4 , Figure 4 A structural schematic diagram of a traffic transmission system provided by the present invention is applied to a source OVN router, the OVN router manages multiple virtual machines, the OVN router is connected to a namespace correspondingly, and the method includes:

[0116] The judging unit 41 is used to judge whether the traffic is to be encapsulated and encrypted after receiving the traffic sent by the source virtual machine;

[0117] The sending unit 42 is used to send the traffic to the source namespace when the traffic is to be encapsulated and encrypted, so that the source namespace encapsulates and encrypts the traffic and then sends it to the target namespace, so that the target namespace encapsulates and encrypts the traffic and then sends it to the target virtual machine through the target OVN router.

[0118] For an introduction to a traffic transmission system provided by the present invention, please refer to the above method embodiment, and the present invention will not be repeated here.

[0119] Please refer to Figure 5 , Figure 5 A schematic diagram of the structure of a flow transmission device provided by the present invention, the device comprising:

[0120] A memory 51, used for storing computer programs;

[0121] The source OVN router 52 is used to implement the steps of the above-mentioned traffic transmission method when executing a computer program.

[0122] For an introduction to a flow transmission device provided by the present invention, please refer to the above method embodiment, and the present invention will not be repeated here.

[0123] The computer-readable storage medium in the present invention stores a computer program, and when the computer program is executed by the source OVN router 52, the steps of the above-mentioned traffic transmission method are implemented.

[0124] For an introduction to the computer-readable storage medium provided by the present invention, please refer to the above method embodiment, and the present invention will not be repeated here.

[0125] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0126] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A traffic transmission method, characterized in that: Applied to a source OVN router, the OVN router manages multiple virtual machines, the OVN router is connected to a namespace, and the method includes: After receiving the traffic sent by the source virtual machine, determining whether the traffic is traffic to be encapsulated and encrypted; If yes, the traffic is sent to the source namespace, so that the source namespace encapsulates and encrypts the traffic and then sends it to the target namespace, so that the target namespace decapsulates and decrypts the traffic and then sends it to the target virtual machine through the target OVN router; After receiving the traffic sent by the source virtual machine, determining whether the traffic is traffic to be encapsulated and encrypted, the method further includes: After receiving the traffic sent by the source virtual machine, determining the target virtual machine corresponding to the traffic; Determine a target namespace for connecting to a target OVN router that manages the target virtual machine based on the IP address of the target virtual machine.

2. The flow transmission method according to claim 1, characterized in that: After receiving the traffic sent by the source virtual machine, determining whether the traffic is traffic to be encapsulated and encrypted, the method further includes: If not, the traffic is sent to the target virtual machine through the target OVN router.

3. The flow transmission method according to claim 1, characterized in that: The source OVN router is connected to the source namespace via a transit OVN switch; Sending the traffic to the source namespace, so that the source namespace encapsulates and encrypts the traffic and then sends it to the target namespace, so that the target namespace decapsulates and decrypts the traffic and then sends it to the target virtual machine through the target OVN router, including: The traffic is sent to the source namespace through the transit OVN switch, so that the source namespace encapsulates and encrypts the traffic and then sends it to the target namespace, so that the target namespace decapsulates and decrypts the traffic and then sends it to the target virtual machine through the target OVN router.

4. The flow transmission method according to claim 1, characterized in that: Each of the source virtual machines is connected to the source OVN router via an intranet OVN switch; After receiving the traffic sent by the source virtual machine, determining whether the traffic is traffic to be encapsulated and encrypted includes: After receiving the traffic sent by the source virtual machine through the intranet OVN switch, it is determined whether the traffic is traffic to be encapsulated and encrypted.

5. The flow transmission method according to claim 1, characterized in that: The source namespace and the target namespace are connected via an external network OVN switch; Sending the traffic to the source namespace, so that the source namespace encapsulates and encrypts the traffic and then sends it to the target namespace, so that the target namespace decapsulates and decrypts the traffic and then sends it to the target virtual machine through the target OVN router, including: The traffic is sent to the source namespace, so that the source namespace encapsulates and encrypts the traffic and then sends it to the target namespace through the external network OVN router, so that the target namespace decapsulates and decrypts the traffic and then sends it to the target virtual machine through the target OVN router.

6. The traffic transmission method according to any one of claims 1 to 5, characterized in that: The namespace includes a strongSwan unit; The source namespace encapsulates and encrypts the traffic and sends it to the target namespace, including: The strongSwan unit in the source namespace uses the IPsec protocol to encapsulate and encrypt the traffic and then sends it to the target namespace; The target namespace decrypts the traffic and sends it to the target virtual machine through the target OVN router, including: The strongSwan unit in the target namespace uses the IPsec protocol to decrypt the traffic and then sends it to the target virtual machine through the target OVN router.

7. A flow transmission system, characterized in that: Applied to a source OVN router, the OVN router manages multiple virtual machines, the OVN router is connected to a namespace, and the system includes: A judging unit, configured to judge whether the traffic sent by the source virtual machine is traffic to be encapsulated and encrypted after receiving the traffic; A sending unit, configured to send the traffic to a source namespace when the traffic is the traffic to be encapsulated and encrypted, so that the source namespace encapsulates and encrypts the traffic and then sends it to a target namespace, so that the target namespace decapsulates and decrypts the traffic and then sends it to a target virtual machine through a target OVN router; Among them, after receiving the traffic sent by the source virtual machine, the judgment unit determines whether the traffic is the traffic to be encapsulated and encrypted, and is also used to: after receiving the traffic sent by the source virtual machine, determine the target virtual machine corresponding to the traffic; based on the IP of the target virtual machine, determine the target namespace connected to the target OVN router that manages the target virtual machine.

8. A flow transmission device, characterized in that: include: Memory for storing computer programs; A source OVN router, configured to implement the steps of the traffic transmission method according to any one of claims 1 to 6 when executing the computer program.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by the source OVN router, the steps of the traffic transmission method according to any one of claims 1 to 6 are implemented.

Images