A system and related cloud network and forwarding method that supports multi-tenancy traffic forwarding

Abstract

The application discloses a system supporting multi-tenant traffic forwarding and a related cloud network and a forwarding method. The method comprises: at least one proxy component and a traffic forwarding component; the at least one proxy component is in communication connection with the traffic forwarding component; the proxy component is used for performing traffic hijacking and port conversion on received access traffic according to tenant port configuration information in preset first configuration information, and redirecting the access traffic to a corresponding listening port in multiple listening ports of the traffic forwarding component; the listening port corresponds to a service accessed by the access traffic and a tenant to which the service belongs; and the traffic forwarding component is used for forwarding the access traffic received from each listening port to a backend service corresponding to the listening port according to preset second configuration information. The application separates and forwards the traffic of different tenants and different services through port isolation, improves the security of the traffic forwarding process, reduces the operation and maintenance pressure of the tenants, and also reduces the cost of the cloud vendor.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network, in particular to a system and related cloud network and forwarding method supporting multi-tenant traffic forwarding. BACKGROUND

[0002] In the traditional single-tenant application scenario in the field of cloud computing, the cloud vendor provides a corresponding cloud server for each tenant, and performs forwarding processing on all traffic of the tenant through a forwarding component on the cloud server. For example, three different tenants providing video streaming services may occupy three cloud servers respectively, and use respective forwarding components to process access traffic.

[0003] With the development of the field of cloud computing, technologies supporting multi-tenancy have gradually emerged, that is, multiple tenants share the same cloud server, the cloud server carries access traffic of multiple tenants, and the access traffic of multiple tenants is forwarded through the same forwarding component. The currently widely used forwarding component, such as the nginx service cluster, differentiates multiple tenants on the same port by using different domain names in the forwarding process of access traffic belonging to different tenants. The same nginx service cluster realizes the listening of multiple domain names under the same port by configuring multiple service (server) blocks, thereby realizing the forwarding of traffic corresponding to different tenants. SUMMARY

[0004] The present application relates to the technical field of network, in particular to a system and related cloud network and forwarding method supporting multi-tenant traffic forwarding.

[0005] In view of the above problems, the present application is proposed to provide a system and related cloud network and forwarding method supporting multi-tenant traffic forwarding to overcome the above problems or at least partially solve the above problems.

[0006] In a first aspect, an embodiment of the present application provides a system supporting multi-tenant traffic forwarding, comprising:

[0007] at least one proxy component and a traffic forwarding component; the at least one proxy component is in communication connection with the traffic forwarding component;

[0008] The proxy component is configured to perform traffic hijacking and port conversion on the received access traffic according to tenant port configuration information in the preset first configuration information, and to redirect the access traffic to a corresponding listening port in a plurality of listening ports of the traffic forwarding component; the listening port corresponds to a service accessed by the access traffic and a tenant to which the service belongs.

[0009] The traffic forwarding component is configured to forward the access traffic received from each of the listening ports to a backend service corresponding to the listening port according to preset second configuration information.

[0010] In one embodiment, the proxy component is a transport layer proxy component, and is configured to determine whether the access traffic needs to be redirected according to a correspondence between a destination IP address in the tenant port configuration information and the listening port identifier, and if so, modify a source IP address and a source port of a packet of the access traffic to an IP address of the traffic forwarding component and the listening port identifier, and send the packet to a corresponding listening port of the traffic forwarding component.

[0011] In one embodiment, the first configuration information further includes first authentication rule information, and the first authentication information includes legal IP information allowed to access; and the proxy component is further configured to determine whether a source IP address of the packet is legal according to the legal IP address information, and if so, allow the access traffic to be redirected to a corresponding listening port of the traffic forwarding component.

[0012] In one embodiment, the second configuration information includes second authentication rule information.

[0013] The traffic forwarding component is specifically configured to parse a packet of the access traffic received from the listening port to obtain application layer header information of the packet, determine whether an application layer header of the packet is a legal header according to the second authentication rule information, and if so, allow the access traffic to be forwarded to a backend service corresponding to the listening port.

[0014] In one embodiment, the second configuration information further includes traffic management rule information corresponding to the listening port.

[0015] The traffic forwarding component is specifically configured to perform corresponding service listening, routing distribution, and processing of service cluster corresponding rules on the access traffic received from the listening port according to the traffic management rule information, and send the processed access traffic to a corresponding backend service.

[0016] In one embodiment, the proxy component is a first type proxy component or a second type proxy component.

[0017] The first type proxy component is configured to be connected with a plurality of service initiators respectively, and receive access traffic initiated by the plurality of service initiators respectively.

[0018] The second type proxy component is configured to be integrated in a service initiator, and receive access traffic initiated by the service initiator.

[0019] In an embodiment, the system further comprises a controller.

[0020] The controller is configured to generate the first configuration information and the second configuration information according to the input configuration information, and save the first configuration information in the at least one proxy component and save the second configuration information in the traffic forwarding component, respectively.

[0021] In an embodiment, the controller is specifically configured to generate the correspondence between the destination IP and the listening port identifier in the first configuration information by performing a hash operation according to the tenant identifier, the service identifier, the virtual private cloud identifier and the timestamp information of each tenant, respectively, to obtain a corresponding hash value, and determining the listening port identifier corresponding to the hash value according to the hash value, and determining the correspondence between the destination IP and the listening port identifier in the first configuration information according to the correspondence between the service identifier and the listening port identifier.

[0022] In an embodiment, the traffic forwarding component is an envoy forwarding component or a cluster comprising multiple envoy forwarding component nodes.

[0023] In a second aspect, an embodiment of the present application provides a cloud network, wherein the cloud network architecture comprises the system for supporting multi-tenant traffic forwarding as described above.

[0024] In a third aspect, an embodiment of the present application provides a method for performing traffic forwarding by using the system for supporting multi-tenant traffic forwarding as described above, comprising:

[0025] The proxy component performs traffic hijacking and port conversion on the received access traffic according to the tenant port configuration information in the preset first configuration information, and redirects the access traffic to a corresponding listening port in the multiple listening ports of the traffic forwarding component; the listening port corresponds to a service and a tenant to which the service belongs required to be accessed by the access traffic.

[0026] The traffic forwarding component forwards the access traffic received from each listening port to a backend service corresponding to the listening port according to the preset second configuration information.

[0027] The above technical solutions provided by the embodiments of the present application have at least the following beneficial effects:

[0028] The system supporting multi-tenant traffic forwarding and the related cloud network and the forwarding method in the embodiment of the application, since the access traffic of different services of different tenants is introduced by the proxy component to different listening ports of the traffic forwarding component, and finally sent by the traffic forwarding component from different listening ports to corresponding backend services, on the basis of supporting multi-tenant traffic forwarding, the traffic of different services of different tenants is separately forwarded through the isolation of ports, the traffic of different tenants is isolated from each other, the security of the traffic forwarding process is improved, the operation and maintenance pressure of the tenants is reduced, and the cost of the cloud manufacturer is also reduced.

[0029] Further, whether the proxy component or the traffic forwarding component, the corresponding layer authentication can be performed on the access traffic, further ensuring the security of the access traffic, shielding the access traffic of unexpected attackers, and the tenants do not need to additionally deploy a security access control mechanism, thereby reducing the operation difficulty and cost of the tenants.

[0030] Other features and advantages of the present application will be set forth in the following description, and in part will become apparent from the description, or can be learned by practice of the present application. The objects and other advantages of the present application will be realized and achieved by means of the structures particularly pointed out in the written description and claims hereof as well as the appended drawings.

[0031] The technical solutions of the present application will be further described in detail below with the help of the drawings and embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0032] The accompanying drawings are included to provide a further understanding of the present application, and constitute a part of the specification, illustrate the present application together with the embodiments, and explain the present application, and do not constitute a limitation of the present application. In the drawings:

[0033] Figure 1 The architecture of the nginx service cluster related forwarding process in the embodiment of the present application;

[0034] Figure 2 The architecture diagram of the system supporting multi-tenant traffic forwarding in the embodiment of the present application;

[0035] Figures 3A-3C The schematic diagram of different architectures containing the first type of proxy component and / or the second type of proxy component in the cloud network;

[0036] Figure 4 The architecture diagram of one instance of the system supporting multi-tenant traffic forwarding in the embodiment of the present application;

[0037] Figure 5 The flowchart of the method for traffic forwarding by using the system supporting multi-tenant traffic forwarding as described above in the embodiment of the present application. DETAILED DESCRIPTION

[0038] Exemplary embodiments of the present disclosure will be described in greater detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it is understood that the present disclosure can be embodied in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the present disclosure to those skilled in the art.

[0039] The inventor of the present application found that in the prior art, in the multi-tenant scenario, for example, using nginx, the same port is used for multi-tenant configuration by different domain names, and the same nginx service cluster is configured with multiple server blocks to realize the listening of multiple domain names under the same port. The architecture of the forwarding process can be referred to Figure 1 As shown in FIG. 1, a user calls a configuration interface, and the configuration is notified to the controller through the controller, and then the controller integrates the configurations of different users into the same listening port. For example, the listening of the http protocol message is integrated into the 80 port, and the listening of the https protocol message is integrated into the 443 port. When the access traffic of the http protocol reaches the nginx cluster, the corresponding configuration block is found according to the server block configuration on the 80 port, and then the traffic is parsed into a message form that can be processed by the application, and then the corresponding backend server (also called upstream server, upstream) is determined according to the parsed content, and the traffic is forwarded to the corresponding backend server, so that the backend server processes the access traffic.

[0040] Since the listening port is shared by the traffic of multiple tenants, the access traffic of each tenant is not securely and effectively isolated, and the access traffic of each tenant may affect each other. For example, in the extreme case of the same port multi-domain name mode, an attacker can attack the services of other tenants by artificially modifying the domain name information carried by himself, which leads to the need for additional security access control mechanism to avoid unexpected traffic access.

[0041] Based on the above problems, the inventor of the present application improves the existing multi-tenant traffic forwarding structure and forwarding mechanism, and proposes a system and related cloud network and forwarding method supporting multi-tenant traffic forwarding different from the traditional way.

[0042] The structure, function and implementation process of the system supporting multi-tenant traffic forwarding provided by the embodiment of the present application will be described below with reference to the accompanying drawings.

[0043] Referring to Figure 2 The embodiment of the present application provides a system supporting multi-tenant traffic forwarding, which comprises:

[0044] At least one proxy component and a traffic forwarding component; a communication connection between the at least one proxy component and the traffic forwarding component; wherein:

[0045] The proxy component is configured to perform traffic hijacking and port conversion on the received access traffic according to tenant port configuration information in preset first configuration information, and to redirect the access traffic to a corresponding listening port in a plurality of listening ports of the traffic forwarding component; the listening port corresponds to a service and a tenant to which the service belongs that the access traffic needs to access;

[0046] The traffic forwarding component is configured to forward the access traffic received from each listening port to a backend service corresponding to the listening port according to preset second configuration information.

[0047] In the embodiments of the present application, in order to distinguish, the configuration information on the proxy component side is called first configuration information, and the configuration information on the traffic forwarding component side is called second configuration information, but in the multi-tenant scenario, the first configuration information contains configuration information corresponding to different tenants, and similarly, the second configuration information contains configuration information corresponding to different ports (corresponding to different tenants and services).

[0048] It should be noted that in the embodiments of the present application, the access traffic can come from service initiators of different tenants, assuming that A, B and C are three tenants sharing the same cloud server, A, B and C provide services for their own users respectively, and the service initiation ends of A, B and C can respectively initiate access traffic to the corresponding service end to request the corresponding service.

[0049] For the convenience of understanding, it is assumed that the service initiation ends belonging to different tenants are represented by User1, User2 and User3 in Figure 2 The embodiments of the present application do not limit the number of tenants, the number and type of service initiation ends, and the type of service itself.

[0050] The service initiation end may, for example, be a browser, and the same tenant can have multiple service initiation ends with different roles.

[0051] Figure 2 The service initiation ends of User1, User2 and User3 in

[0052] The proxy component, for example, a transport layer proxy component, can determine whether the access traffic needs to be redirected according to the correspondence between the destination IP address in the tenant port configuration information and the listening port identifier, and if so, modify the original destination IP address and the original destination port of the packet of the access traffic to the IP address of the traffic forwarding component and the listening port identifier, and send to the corresponding listening port of the traffic forwarding component.

[0053] In the embodiments of the present application, although the listening port corresponds to the service accessed by the access traffic and the tenant to which the service belongs, in the proxy component, since it is a transport layer proxy component and processes transport layer information, the tenant port configuration information does not directly provide the correspondence between the tenant, the service and the port, but binds the IP of the service end (i.e. the destination IP) and the corresponding listening port identifier, so that when the access traffic reaches the proxy component, according to the destination IP in the tenant port configuration information and the corresponding listening port identifier, the destination IP parsed by the transport layer can be directly forwarded to the corresponding listening port of the traffic forwarding component.

[0054] Referring to Figure 2 The proxy component intercepts the access traffic of the service initiator (for example, User1, User2 and User3 in Figure 2 ) received, determines whether it needs to be redirected according to the destination IP in the tenant port configuration information, and if so, determines that the access traffic needs to be redirected, or, in more detail, determines whether the destination IP and the destination port meet the tenant port configuration information, and if so, determines that the access traffic needs to be redirected. At this time, the access traffic is not directly forwarded to the destination IP and the port, but is first introduced into the corresponding listening port of the plurality of listening ports of the backend traffic forwarding component, and the subsequent forwarding processing is completed by the traffic forwarding component.

[0055] The proxy component performs port conversion on the packet of the access traffic, for example, including the following operations: modifying the original destination IP address and the original destination port of the packet of the access traffic to the IP address of the traffic forwarding component and the listening port identifier.

[0056] Further, the proxy component is further configured to put the original destination IP address and the original destination port identifier of the packet of the access traffic into the packet header or the application layer identifier of the application layer.

[0057] The purpose of modifying the original destination IP address and the original destination port of the access traffic message is to import them into the corresponding monitoring port of the traffic forwarding component. Since the messages eventually need to reach the real backend service, the original destination IP address and the original destination port of the message can be identified and placed in the packet header of the application layer or the application layer identifier.

[0058] For example, the original destination IP and destination port of the message can be placed in the Header of the application layer of the message or in the Http identifier. Different processing methods are used according to different protocols of the message. Of course, the embodiments of the present application are not limited to the above-mentioned processing methods of the original destination IP and destination port identifier.

[0059] After the traffic hijacking and port conversion processing, the access traffic of services belonging to different tenants is imported into different monitoring ports of the traffic forwarding component.

[0060] In the embodiments of the present application, since the access traffic of services of different tenants is imported into different monitoring ports of the traffic forwarding component by the proxy component and is finally sent to the corresponding backend service from different monitoring ports by the traffic forwarding component, on the basis of supporting multi-tenant traffic forwarding, the traffic of different services of different tenants is separately forwarded through port isolation, the traffic of different tenants is isolated from each other, the security of the traffic forwarding process is improved, the operation and maintenance pressure of the tenants is reduced, and the cost of the cloud vendor is also reduced.

[0061] In order to reduce the operation and maintenance pressure of the tenants on the access traffic security management, further, in the embodiments of the present application, the first configuration information can further include first authentication rule information, and the first authentication information includes legal IP information allowed to access; the proxy component is further configured to judge whether the source IP address of the message is legal according to the legal IP address information, and if it is judged to be legal, the access traffic is allowed to be redirected to the corresponding monitoring port in the multiple monitoring ports of the traffic forwarding component.

[0062] The first authentication rule information saved on the side of the proxy component defines which IP can access the backend service or defines which IP cannot access the backend service, or defines both.

[0063] The second configuration information in the traffic forwarding component includes second authentication rule information and traffic management rule information corresponding to each monitoring port.

[0064] The second authentication rule information is for the packet header information of the application layer in the access traffic. The traffic forwarding component parses the message of the access traffic received from the listening port, obtains the application layer packet header information of the message, judges whether the application layer packet header of the message is a legal packet header according to the second authentication rule information, and if the judgment result is yes, considers that the message is a legal message and allows the access traffic to be forwarded to the backend service corresponding to the listening port.

[0065] For example, the traffic forwarding component parses the Http packet header in the message, matches the parsing result with the second authentication rule information, determines whether the Http packet header of the message is a legal packet header, and if yes, performs subsequent forwarding, and if no, does not allow forwarding, for example, discards the message, etc.

[0066] Both the proxy component and the traffic forwarding component can perform authentication of the corresponding layer on the access traffic, further ensuring the security of the access traffic, shielding the access traffic of unexpected attackers, and reducing the operation difficulty and cost of the tenant.

[0067] In order to independently forward the traffic under the services of different tenants, the second configuration information can further include traffic management rule information corresponding to each listening port. The traffic management rule information of different ports is respectively configured and independent of each other.

[0068] The traffic management rule includes but is not limited to various traffic limiting, load balancing and other traffic management rules, and other necessary rules for implementing the traffic forwarding function.

[0069] For the backend service, it is usually implemented by a cluster, that is, the traffic forwarding component needs to determine what way the traffic needs to be forwarded to which node in the cluster for processing according to certain rules. Based on this, the traffic management rule can define these contents. The traffic management rule includes but is not limited to, for example, traffic limiting, load balancing and other traffic management rules.

[0070] The traffic forwarding component is specifically configured to perform processing of the corresponding service listener (Listener), router (Router) and service cluster (Cluster) rules on the access traffic received by the listening port according to the traffic management rule information, and send the processed access traffic to the corresponding backend service.

[0071] These rules define what kind of message will be forwarded to which node of the backend service through what path. The details of these forwarding processing procedures can be defined by the second configuration information.

[0072] In an embodiment, refer to Figure 2As shown, the system supporting multi-tenant traffic forwarding provided by the embodiment of the present application can further include a controller, which is a configuration information input interface, receives various configuration information input by a user, converts the configuration information into an information format readable by the proxy component and the traffic forwarding component, and delivers the information format. That is, the controller generates the corresponding first configuration information and second configuration information according to the configuration information of the tenant input by the user, and delivers the first configuration information to the corresponding proxy component for storage and the second configuration information to the traffic forwarding component for storage.

[0073] The configuration information of different tenants can be configured through the controller respectively, and the configuration process is also independent of each other.

[0074] Further, in the embodiment of the present application, the proxy component directs the access traffic of different services of different tenants to different listening ports of the traffic forwarding component for subsequent forwarding, and therefore, the listening port identifier in the first configuration information should satisfy that the listening port identifiers corresponding to the access traffic of different tenants and services should be different from each other. In order to achieve this purpose, for example, a hash algorithm can be used; further, for example, a corresponding hash operation can be performed according to the tenant identifier, service identifier (such as service IP, service DNS, etc.), virtual private cloud identifier and timestamp information of each tenant to obtain a corresponding hash value, and then the listening port identifier corresponding to the hash value is determined according to the hash value.

[0075] There can be multiple ways to obtain the listening port identifier through the hash value, for example, a further modulo operation can be performed on the hash value to obtain the corresponding listening port identifier. Of course, the listening port identifier corresponding to the service of each tenant can also be determined by directly mapping the hash value to the preset listening port.

[0076] Because the tenant identifier and the service identifier have a corresponding relationship with the destination IP in the message of the access traffic, the controller can generate the corresponding relationship between the destination IP and the listening port identifier in the first configuration information according to the corresponding relationship between the tenant identifier, the service identifier and the listening port identifier, for use by the proxy component in the traffic hijacking and port conversion process.

[0077] Further, the above proxy component can be divided into a first type of proxy component or a second type of proxy component; wherein:

[0078] The first type of proxy component is used to connect with a plurality of service initiators respectively, and receive the access traffic initiated by the plurality of service initiators respectively; for example, Figure 2 The proxy component connected with the service initiator 1 and the service initiator 2.

[0079] The second type of proxy component is used to be integrated in a service initiator, and receive the access traffic initiated by the service initiator; for example, Figure 2The proxy component set in Service Initiator 3 is a second-type proxy component.

[0080] The first type of proxy component and the second type of proxy component mentioned above have similar functions, but are suitable for different application scenarios.

[0081] In a cloud network architecture, you can use only the first type of proxy component, or only the second type of proxy component, or deploy both types of proxy components in the network.

[0082] Reference Figure 3A-3C The example shown, Figure 3A This refers to a cloud network architecture that includes both Type I and Type II proxy components. User1 and User2 are connected to the same Type I proxy component, while the Type II proxy component is configured in User3. Those skilled in the art will understand that, since the Type I proxy component can connect to multiple service initiators or a single service initiator, in this network architecture, several service initiators may be connected to a Type I proxy component. Simultaneously, there may be cases where a single service initiator is connected to a Type I proxy component alone, and cases where the Type II proxy component is configured within a single service initiator (not described in the text). Figure 3A (Illustrated in the diagram). This embodiment of the invention does not limit the specific connection method in this case.

[0083] Figure 3B The diagram shows a cloud network architecture that only includes the first type of proxy component. Figure 3B In the example shown, User1, User2, and User3 are all connected to the first type of proxy component. Of course, some of these service initiators may be connected to the same first type of proxy component, some may be connected to the first type of proxy component individually, or each may be connected to the first type of proxy component individually. This embodiment of the invention does not limit the specific connection method in this case.

[0084] Figure 3C The diagram shows a cloud network architecture that only includes the second type of proxy component. Figure 3C In the example shown, each type II proxy component is set up in a single service requester.

[0085] In one embodiment, the traffic forwarding component may be, for example, the open-source Envoy forwarding component, or a cluster containing multiple Envoy forwarding component nodes.

[0086] Envoy is an open-source edge and service proxy for cloud-native applications. The Envoy forwarding component is a layer 7 network proxy component developed based on C++.

[0087] In the case of the envoy forwarding component node cluster, each envoy forwarding component node can process multi-tenant traffic forwarding, and each envoy forwarding component node can be disaster recovery backup for each other.

[0088] In order to illustrate the above-mentioned system supporting multi-tenant traffic forwarding provided by the embodiments of the present application, a specific example is used to illustrate.

[0089] Referring to Figure 4 As shown in the figure, in the network architecture of the example, a plurality of service requestors are included, service requestor 1 (user1), service requestor 2 (user2) and service requestor 3 (user3), wherein user1 and user2 are connected to the ebpf L4 proxy component, and user3 integrates the ebpf agent, and in user3, a plurality of kernel spaces (pod1-pod3) are further included.

[0090] The extended Berkeley packet filter (ebpf) is a general-purpose execution engine with customizable specific functions for network message filtering, and the ebpf agent and the ebpf L4 proxy component are developed based on the ebpf.

[0091] The envoy cluster includes a plurality of envoy forwarding component nodes. Among them, the ebpf agent and the ebpf L4 proxy component have similar functions, and are mainly used for traffic hijacking and port conversion. According to the configuration issued by the controller, the traffic is redirected to the listening port corresponding to the envoy forwarding component node.

[0092] The controller is responsible for issuing configuration information to the ebpf L4 proxy or the ebpf agent. On the controller, the following elements related to tenant services can be used for hash operation: virtual private cloud (VPC) information, tenant ID, service name (such as IP of destination service, DNS of service, etc.), and timestamp information, etc. The hash value obtained by hash calculation determines the listening port corresponding to the service of each tenant, and the hash operation makes the port identification of the listening port as random as possible, so as to ensure that the services of different tenants correspond to different listening ports, such as port 2000, port 2001 and port 2002 in Figure 4 The service of tenant user1 corresponds to the listening port 2001, and the controller issues the rule to the envoy forwarding component node and the ebpf L4 proxy or the ebpf agent at the same time.

[0093] The ebpf L4 agent or ebpf agent performs traffic hijacking and port conversion operations, so that the access traffic of the backend server (destination IP) is taken over by the envoy forwarding component. At this time, assuming that a client wants to access the original service, the ebpf L4 agent or ebpf agent performs port conversion on the access traffic packet, inserts the original destination IP and destination port into the packet header, and changes the original destination IP in the packet to the IP of the envoy forwarding component and changes the original destination port to the listening port of the envoy forwarding component, to realize the redirection process of directing the access traffic to the envoy forwarding component. Whether the actual access is the 80 port or the 443 port, the traffic is directed to the corresponding listening port of the envoy forwarding component, and finally forwarded to the final accessed service through the envoy forwarding component.

[0094] The internal architecture of the ebpf L4 agent or ebpf agent can include two parts, namely the agent + forwarding architecture. The agent part is responsible for receiving the configuration information issued by the controller and placing it in the shared memory of the agent and forwarding architecture. The ebpf forwarding architecture will compare the packet according to the configuration information in the memory to realize traffic hijacking.

[0095] The implementation of traffic hijacking is based on ebpf technology, which performs hooking operations on the system call points of receiving and transmitting data packets to realize traffic hijacking operations.

[0096] When performing traffic hijacking operations, the target address, source address and other information of the data packet are compared with the configuration information to determine whether they match.

[0097] If they match, the corresponding operation is performed according to the action set in the configuration information. The action defined operation may have multiple cases in specific implementation, including, for example, changing the destination IP and destination port of the packet.

[0098] If they do not match, the original forwarding logic continues the original forwarding process.

[0099] When the traffic reaches the envoy forwarding component node, different ports on the envoy forwarding component node save the configurations of different users (issued by the controller), and according to the traffic management rules, the processing of listener (Listener), router (Router) and cluster (Cluster) rules is performed in turn, and then sent to the corresponding backend service (upstream).

[0100] These rules include, but are not limited to, rate limiting policies and load balancing policies for routing Envoy requests to certain ones of the cluster members, routing rules (e.g., domain name of the request, what path matches, which Cluster to forward to), and the like. Relevant rules can refer to the prior art.

[0101] The embodiments of the present application also provide a cloud network, which comprises the system for supporting multi-tenant traffic forwarding as described above.

[0102] Based on the same inventive concept, the embodiments of the present application also provide a method for performing traffic forwarding by using the system for supporting multi-tenant traffic forwarding as described above. Since the principles of the problems solved by the method are similar to those of the system for supporting multi-tenant traffic forwarding as described above, the implementation of the method can refer to the implementation of the system as described above, and the repeated parts will not be described herein.

[0103] The embodiments of the present application provide a method for performing traffic forwarding by using the system for supporting multi-tenant traffic forwarding as described above, which comprises the following steps as shown in Fig. 5: Figure 5

[0104] S51, the proxy component performs traffic hijacking and port conversion on the received access traffic according to the tenant port configuration information in the preset first configuration information, and redirects the access traffic to a corresponding listening port in the plurality of listening ports of the traffic forwarding component; the listening port corresponds to a service accessed by the access traffic and a tenant to which the service belongs;

[0105] S52, the traffic forwarding component forwards the access traffic received from each listening port to a backend service corresponding to the listening port according to the preset second configuration information.

[0106] The user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of the related data need to comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation entrances for the user to choose authorization or refusal.

[0107] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program code.

[0108] ​The present application is described in reference to the accompanying drawings, which use flow diagrams and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each block of the flow diagrams and / or block diagrams, and combinations of blocks in the flow diagrams and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks. Figure 1 one or more flow or flow diagrams and / or block or blocks. Figure 1 one or more flow or flow diagrams and / or block or blocks.

[0109] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flow diagrams and / or block diagrams block or blocks. Figure 1 one or more flow or flow diagrams and / or block or blocks. Figure 1 one or more flow or flow diagrams and / or block or blocks.

[0110] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flow diagrams and / or block diagrams block or blocks. Figure 1 one or more flow or flow diagrams and / or block or blocks. Figure 1 one or more flow or flow diagrams and / or block or blocks.

[0111] Obviously, numerous modifications and variations of the present application are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims and their legal equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A system supporting multi-tenant traffic forwarding, characterized in that, include: At least one proxy component and a traffic forwarding component; The at least one proxy component is communicatively connected to the traffic forwarding component; The proxy component is used to hijack and port switch the received access traffic according to the tenant port configuration information in the preset first configuration information, and redirect the access traffic to the corresponding listening port among the multiple listening ports of the traffic forwarding component; The listening port corresponds to the service that the access traffic needs to access and the tenant to which the service belongs. The traffic forwarding component is used to forward access traffic received from each listening port to the backend service corresponding to the listening port according to the preset second configuration information. The system also includes: a controller; The controller is specifically configured to generate the correspondence between the destination IP and the listening port identifier in the first configuration information in the following manner: perform corresponding hash operations based on the tenant identifier, service identifier, virtual private cloud identifier and timestamp information of each tenant to obtain the corresponding hash value; determine the listening port identifier corresponding to the hash value based on the hash value; and determine the correspondence between the destination IP and the listening port identifier in the first configuration information based on the correspondence between the service identifier and the listening port identifier.

2. The system as described in claim 1, characterized in that, The proxy component is a transport layer proxy component, specifically used to determine whether the access traffic needs to be redirected based on the correspondence between the destination IP address and the listening port identifier in the tenant port configuration information. If determined, the original destination IP address and original destination port of the access traffic packet are modified to the IP address of the traffic forwarding component and the listening port identifier, and then sent to the corresponding listening port of the traffic forwarding component.

3. The system as described in claim 1, characterized in that, The first configuration information also includes first authentication rule information, which contains information on allowed legitimate IP addresses. The proxy component is further configured to determine whether the source IP address of the packet is legitimate based on the legitimate IP address information. If the IP address is legitimate, the access traffic is redirected to the corresponding listening port among the multiple listening ports of the traffic forwarding component.

4. The system as described in claim 1, characterized in that, The second configuration information includes: second authentication rule information; The traffic forwarding component is specifically used to parse the packets of access traffic received from the listening port, obtain the application layer header information of the packets, and determine whether the application layer header of the packets is a valid header according to the second authentication rule information. If the determination result is yes, the access traffic is allowed to be forwarded to the backend service corresponding to the listening port.

5. The system as described in claim 1, characterized in that, The second configuration information also includes: traffic management rule information corresponding to the listening port; The traffic forwarding component is specifically used to process the access traffic received by the listening port according to the traffic governance rule information, and then process the corresponding service listening, routing distribution and service cluster rules in sequence, and send the processed access traffic to the corresponding backend service.

6. The system according to any one of claims 1-5, wherein the proxy component is a first type of proxy component or a second type of proxy component; The first type of proxy component is used to connect to multiple service initiators respectively and receive access traffic initiated by the multiple service initiators respectively; The second type of proxy component is used to be integrated into a service initiator to receive access traffic initiated by the service initiator.

7. The system according to any one of claims 1-5, characterized in that, The controller is further configured to generate the first configuration information and the second configuration information based on the input configuration information, and to send the first configuration information to the at least one proxy component for storage, and to send the second configuration information to the traffic forwarding component for storage.

8. The system according to any one of claims 1-5, characterized in that, The traffic forwarding component is an Envoy forwarding component or a cluster containing multiple Envoy forwarding component nodes.

9. A cloud network, characterized in that, The cloud network architecture includes a system that supports multi-tenant traffic forwarding as described in any one of claims 1-8.

10. A method for traffic forwarding using a multi-tenant traffic forwarding system as described in any one of claims 1-8, characterized in that, include: The proxy component performs traffic hijacking and port conversion on the received access traffic according to the tenant port configuration information in the preset first configuration information, and redirects the access traffic to the corresponding listening port among the multiple listening ports of the traffic forwarding component; The listening port corresponds to the service that the access traffic needs to access and the tenant to which the service belongs. According to the preset second configuration information, the traffic forwarding component forwards the access traffic received from each listening port to the backend service corresponding to the listening port.

Images