Tunnel dynamic offloading method, device and equipment and computer readable storage medium

Abstract

The present disclosure relates to a tunnel dynamic offloading method, device, equipment and computer readable storage medium. The present disclosure monitors the traffic state of each tunnel in the hardware table item, dynamically adjusts the offloading mode of the tunnel according to the traffic state, takes into account the scene of high throughput, high concurrency and complex traffic changes of the tunnel traffic, solves the high concurrency demand of tenant growth on the IPSec tunnel, and maximizes the offloading capacity of the DPU on the IPSec tunnel.

Description

Technical Field

[0001] This disclosure relates to the field of data communication technology, and in particular to a method, apparatus, device and computer-readable storage medium for dynamic tunnel unloading. Background Technology

[0002] IPSec VPN is a tunneling technology that uses the IPSec (IP Security) protocol to securely transmit data over public network infrastructure. IPSec is not a standalone protocol; as a network layer tunneling protocol, it is a suite of security protocols developed by the Internet Engineering Task Force (IETF). It provides high-quality, interoperable, cryptographically based security for IP datagrams. Its architecture includes: security associations, security protocols, key management, operating modes, authentication algorithms, encryption algorithms, and security policies. DPU stands for Data Processing Unit, a hardware accelerator dedicated to data processing. DPUs typically work in parallel with the Central Processing Unit (CPU) and Graphics Processing Unit (GPU) to accelerate various data-intensive tasks, such as machine learning, deep learning, network security, and data center applications.

[0003] To accelerate tunnel data transmission, a combination of hardware and software offloading based on DPU is typically used. The IPSec management plane uses open-source IPSec software, allowing users to select between software and hardware offloading by configuring tunnel parameters. However, the offloading method is determined by the user configuration, and the peak tunnel traffic changes dynamically. A fixed configuration mode cannot meet the complex scenario of dynamic changes in IPSec tunnel traffic in data centers. Summary of the Invention

[0004] To address the aforementioned technical issues, this disclosure provides a method, apparatus, device, and computer-readable storage medium for dynamic tunnel unloading, which can accommodate scenarios with high tunnel throughput, high concurrency, and complex traffic variations.

[0005] In a first aspect, embodiments of this disclosure provide a method for dynamic tunnel unloading, including:

[0006] In response to the tunnel unloading requirement, the tunnel to be unloaded is unloaded to the DPU in hardware unloading mode;

[0007] Traffic monitoring is performed on each tunnel in the hardware table of the DPU to obtain the traffic status of each tunnel. The tunnel in the hardware table is the tunnel that is offloaded to the DPU using the hardware offload mode.

[0008] In response to the new tunnel offloading requirement, if the number of tunnels in the hardware entry is not less than the number of specifications in the hardware entry, the target tunnel in the hardware entry whose traffic status meets the first preset rule will be switched to software offloading mode.

[0009] The newly added tunnel to be uninstalled will be uninstalled into the DPU using hardware uninstallation mode.

[0010] In some embodiments, the method further includes:

[0011] If there is no target tunnel in the hardware table whose traffic status matches the first preset rule, then in response to the newly added tunnel unloading requirement, the newly added tunnel to be unloaded will be unloaded into the DPU in software unloading mode.

[0012] In some embodiments, the first preset rule includes:

[0013] Within a first preset time period, both the average and maximum number of packets passing through the tunnel per unit time are lower than a preset threshold.

[0014] The step of switching the target tunnel whose traffic status in the hardware entry matches the first preset rule to software uninstallation mode includes:

[0015] Determine at least one candidate tunnel whose traffic status in the hardware entry conforms to a first preset rule;

[0016] The tunnel with the lowest maximum number of packets passing per unit time within a first preset time period among the at least one candidate tunnel is selected as the target tunnel.

[0017] Switch the target tunnel to software uninstallation mode.

[0018] In some embodiments, the method further includes:

[0019] Every second preset time interval, if the number of tunnels in the hardware entry is not less than the number of specifications in the hardware entry, obtain the number N of tunnels in the hardware entry whose traffic status conforms to the first preset rule and the number M of tunnels in the software entry whose traffic status conforms to the second preset rule, where N and M are integers not less than 0, and the tunnels in the software entry are tunnels that are uninstalled to the DPU using the software uninstallation mode.

[0020] If N and M are both non-zero, and N is greater than or equal to M, then the M tunnels with the lowest average number of packets per unit time in the hardware entries are switched to software offload mode, and the M tunnels in the software entries whose traffic status conforms to the second preset rule are switched to hardware offload mode.

[0021] In some embodiments, the method further includes:

[0022] If both N and M are not 0, and N is less than M, then the N tunnels with the lowest average number of packets per unit time in the hardware entries are switched to software unloading mode, and the N tunnels with the highest average number of packets per unit time in the software entries are switched to hardware unloading mode.

[0023] In some embodiments, the method further includes:

[0024] Every second preset time interval, if the number of tunnels in the hardware entry is less than the number of specifications in the hardware entry, and there is at least one tunnel in the software entry, then at least one tunnel in the software entry will be switched to hardware unloading mode.

[0025] In some embodiments,

[0026] The hardware offloading mode involves offloading the tunnel configuration and negotiation results to the hardware entry of the DPU and backing them up to the software entry.

[0027] The software uninstallation mode involves uninstalling the tunnel configuration and negotiation results into the DPU's software entries.

[0028] Secondly, embodiments of this disclosure provide a tunnel dynamic unloading device, comprising:

[0029] The first unloading module is used to unload the tunnel to be unloaded into the DPU in hardware unloading mode in response to the tunnel unloading request.

[0030] The traffic monitoring module is used to monitor the traffic of each tunnel in the hardware table of the DPU and obtain the traffic status of each tunnel. The tunnel in the hardware table is a tunnel that is offloaded to the DPU using the hardware offload mode.

[0031] The switching module is used to respond to new tunnel offloading requirements. If the number of tunnels in the hardware entry is not less than the specification number of the hardware entry, the target tunnel in the hardware entry whose traffic status meets the first preset rule is switched to software offloading mode.

[0032] The second unloading module is used to unload newly added tunnels to be unloaded into the DPU in hardware unloading mode.

[0033] Thirdly, embodiments of this disclosure provide an electronic device, including:

[0034] Memory;

[0035] Processor; and

[0036] Computer programs;

[0037] The computer program is stored in the memory and configured to be executed by the processor to implement the method as described in the first aspect.

[0038] Fourthly, embodiments of this disclosure provide a computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the method described in the first aspect.

[0039] Fifthly, embodiments of this disclosure also provide a computer program product, which includes a computer program or instructions that, when executed by a processor, implement the tunnel dynamic offloading method as described above.

[0040] The tunnel dynamic offloading method, apparatus, device, and computer-readable storage medium provided in this disclosure monitor the traffic status of each tunnel in the hardware table and dynamically adjust the tunnel offloading method according to the traffic status. This takes into account scenarios with high tunnel throughput, high concurrency, and complex traffic changes, solves the high concurrency requirements of IPSec tunnels due to tenant growth, and maximizes the DPU's offloading capability for IPSec tunnels. Attached Figure Description

[0041] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0042] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is a flowchart of the tunnel dynamic unloading method provided in the embodiments of this disclosure;

[0044] Figure 2 A schematic diagram illustrating an application scenario provided by an embodiment of this disclosure;

[0045] Figure 3 A flowchart of a tunnel dynamic unloading method provided in another embodiment of this disclosure;

[0046] Figure 4 A flowchart of a tunnel dynamic unloading method provided in another embodiment of this disclosure;

[0047] Figure 5 This is a schematic diagram of the structure of the tunnel dynamic unloading device provided in the embodiments of this disclosure;

[0048] Figure 6This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0049] To better understand the above-mentioned objectives, features, and advantages of this disclosure, the solutions disclosed herein will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0050] Numerous specific details are set forth in the following description in order to provide a full understanding of this disclosure, but this disclosure may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some, and not all, of the embodiments of this disclosure.

[0051] There are generally two common IPSec implementation methods in data centers. The first method involves the server offloading the IPSec tunnel to the smart NIC or DPU. Users create the tunnel by statically configuring xfrm on the server or DPU or by running IPSec user-space software, and synchronize the tunnel negotiation results to the kernel xfrm framework. If the smart NIC or DPU enables the IPSec offloading function, the Security Association (SA) and SP policy library will be synchronized to the hardware entries of the smart NIC or DPU. Through hardware-accelerated encryption, decryption and encapsulation functions, more efficient data transmission and protection are provided, the burden on the host CPU to process encrypted data is reduced, and lower network latency and higher throughput are provided.

[0052] The second approach combines DPU hardware offloading and software offloading. The IPSec management plane uses open-source IPSec software. Users can select either software or hardware offloading by configuring tunnel parameters. Hardware offloading means that after tunnel negotiation is complete, the tunnel's SP and SA are offloaded to the DPU's IP core. Subsequent packets that match hardware entries are then encrypted, decrypted, and encapsulated by the IP core. Software offloading, on the other hand, uses a DPDK+user-space protocol stack running on the DPU's SOC to offload the IPSec tunnel from the server to the DPU software layer. Tunnel traffic that does not match hardware entries is encrypted, decrypted, and encapsulated by the software layer.

[0053] However, in the first approach mentioned above, the SA and SP are offloaded to the hardware through the kernel xfrm architecture. Due to limitations in hardware manufacturing process and network card size, the hardware entries for IPSec offloading have certain specification limitations, which may result in the inability to support unlimited expansion or extremely high expansion costs. In the second approach mentioned above, although the tunnel specifications are not limited, the tunnel offloading method is determined by the user configuration. However, the peak tunnel traffic changes dynamically, and a fixed configuration mode cannot meet the complex scenario of dynamic changes in IPSec tunnel traffic in the data center.

[0054] To address the aforementioned issues, this disclosure provides a method for dynamic tunnel unloading, which will be described below with reference to specific embodiments.

[0055] Figure 1 This is a flowchart illustrating a tunnel dynamic unloading method provided in an embodiment of this disclosure. This method can be applied to... Figure 2 The application scenario shown includes a host (HOST) 21 and a DPU 22. HOST 21 manages the IPSec process in DPU 22 through a management channel, and HOST 21 and DPU 22 exchange data through a data channel. The IPSec packet statistics module 221 in the DPU is used to monitor the traffic status of each tunnel offloaded to the DPU; the IPSec soft table in the user-space protocol stack 222 is used to store tunnels offloaded in software; the IPSec hard table in the IP core 223 is used to store tunnels offloaded in hardware; the encryption / decryption module in the user-space protocol stack 222 and the encryption / decryption core in the IP core 223 are used to perform encryption / decryption operations on the data stream flowing through the DPU.

[0056] It is understood that the tunnel dynamic unloading method provided in this disclosure can also be applied in other scenarios.

[0057] The following is combined with Figure 2 The application scenarios shown are for Figure 1 The tunnel dynamic unloading method shown is described below, and the specific steps of this method are as follows:

[0058] S101. In response to the tunnel unloading requirement, the tunnel to be unloaded is unloaded to the DPU in hardware unloading mode.

[0059] Tunnel offloading involves implementing IPSec tunnels through the DPU. Offloading IPSec tunnels to the DPU can effectively save the computing resources required for tunnel data transmission on the host.

[0060] Hardware offloading mode offloads the IPSec tunnel to the policy library in the DPU, such as... Figure 2 The IPSec hardware table entries (referred to as IPSec hard table in the diagram) in the IP core shown are used to specifically offload the IPSec tunnel configuration and negotiation results to the DPU's IP core and back them up to the protocol stack's IPSec soft table.

[0061] S102. Perform traffic monitoring on each tunnel in the hardware table of the DPU to obtain the traffic status of each tunnel. The tunnel in the hardware table is a tunnel that is offloaded to the DPU using the hardware offload mode.

[0062] As mentioned above, the DPU's hardware entries store all tunnels that are offloaded in hardware mode. For each tunnel in the hardware entry, the DPU monitors its traffic in real time to assess the load of each tunnel and obtain the traffic status of each tunnel.

[0063] S103. In response to the newly added tunnel offloading requirement, if the number of tunnels in the hardware entry is not less than the specification number of the hardware entry, the target tunnel in the hardware entry whose traffic status meets the first preset rule is switched to software offloading mode.

[0064] In some embodiments, by default, all newly negotiated tunnels employ a hardware offload mode.

[0065] The number of tunnels that a hardware entry can support is limited. The specification number of a hardware entry represents the maximum number of tunnels that the hardware entry can support. When a new tunnel offloading requirement arises, that is, when a newly negotiated tunnel needs to be handed over to the DPU side for implementation, the first step is to determine whether the number of tunnels in the hardware entry is not less than the specification number of the hardware entry.

[0066] When the number of tunnels in the hardware table is not less than (or equal to) the number of specifications in the hardware table, it means that the hardware table is full. In order to accommodate the new tunnels to be unloaded corresponding to the new tunnel unloading requirements, at least one tunnel in the hardware table will be converted to software unloading mode.

[0067] Specifically, based on the traffic status of each tunnel in the hardware entry, the target tunnel whose traffic status meets the first preset rule is switched to software unloading mode. At this time, the number of tunnels in the hardware entry is less than the number of specifications in the hardware entry.

[0068] In some embodiments, the first preset rule includes: within a first preset time period, both the average and maximum number of packets passed per unit time in the tunnel are lower than a preset threshold. If the number of packets passed in the target tunnel that meets the first preset rule is small, the data transmission of the target tunnel can be realized using the software offloading mode, freeing up the position in the hardware entry for the newly added tunnel to be offloaded.

[0069] Software offloading mode involves offloading the IPSec configuration and negotiation results to the protocol stack software table of the DPU SoC. For example... Figure 2 As shown, the user-space protocol stack of the DPU contains IPSec software entries (abbreviated as IPSec software table in the figure). Unloading the IPSec configuration and negotiation results into the IPSec software entries is the software unloading mode of the IPSec tunnel.

[0070] S104. Unload the newly added tunnel to be uninstalled into the DPU in hardware uninstallation mode.

[0071] After converting the target tunnel in the hardware entry to software uninstallation mode, if the number of tunnels in the hardware entry is less than the number of specifications in the hardware entry, the hardware entry is not full. In this case, the newly added tunnel to be uninstalled will be uninstalled into the DPU in hardware uninstallation mode.

[0072] This embodiment monitors the traffic status of each tunnel in the hardware table and dynamically adjusts the tunnel offloading method according to the traffic status. It takes into account scenarios with high tunnel throughput, high concurrency and complex traffic changes, solves the high concurrency requirements of IPSec tunnels due to tenant growth, and maximizes the DPU's offloading capability for IPSec tunnels.

[0073] Based on the above embodiments, if there is no target tunnel in the hardware table whose traffic status meets the first preset rule, then in response to the newly added tunnel unloading requirement, the newly added tunnel to be unloaded is unloaded to the DPU in software unloading mode.

[0074] Based on the above embodiments, the hardware offloading mode is to offload the tunnel configuration and negotiation results to the hardware table of the DPU and back them up to the software table; the software offloading mode is to offload the tunnel configuration and negotiation results to the software table of the DPU.

[0075] In some embodiments, the first preset rule includes: within a first preset time period, both the average and maximum number of packets passing through the tunnel per unit time are lower than a preset threshold.

[0076] Figure 3 Here is a flowchart of a tunnel dynamic unloading method according to another embodiment of this disclosure, as shown below. Figure 3 As shown, the method includes the following steps:

[0077] S301, In response to the tunnel unloading requirement, the tunnel to be unloaded is unloaded to the DPU in hardware unloading mode.

[0078] Specifically, the tunnel configuration information is distributed through the DPU SDK (Software Development Kit) in the host, and it is determined whether the current number of tunnels is greater than the specification number of DPU software entries.

[0079] In some embodiments, if the number of tunnels exceeds the number of DPU software entries specified, it indicates that the current DPU cannot handle more tunnel offloading, the configuration fails, and an error code is returned to the user.

[0080] S302. Perform traffic monitoring on each tunnel in the hardware table of the DPU to obtain the traffic status of each tunnel.

[0081] Specifically, traffic monitoring for each tunnel includes counting the number of packets passed through each tunnel and calculating pps (Packets Per Second). pps represents the transmission rate in units of network packets. For each tunnel, the highest, lowest, and average pps values ​​within a first preset time period are recorded. The first preset time period can be adjusted according to the user's actual needs, and this embodiment does not limit it.

[0082] For example, for each tunnel, record the highest, lowest, and average values ​​of pps within 5 minutes and 10 minutes.

[0083] S303. In response to a new tunnel offloading request, determine whether the number of tunnels in the hardware table is less than the specified number in the hardware table. If yes, proceed to S307; otherwise, proceed to S304.

[0084] S304. Determine at least one candidate tunnel in the hardware entry whose traffic status conforms to the first preset rule.

[0085] S305. Select the at least one candidate tunnel with the lowest maximum number of packets passing per unit time within a first preset time period as the target tunnel.

[0086] S306. Switch the target tunnel to software uninstallation mode.

[0087] When there is a tunnel in the hardware table whose average and maximum PPS values ​​are both lower than a preset threshold within a first preset time period, the tunnel with the lowest maximum PPS value is selected as the target tunnel, and the soft unload mode is switched.

[0088] Specifically, the target tunnel is switched to software uninstallation mode and removed from the hardware table.

[0089] S307. Unload the newly added tunnel to be uninstalled into the DPU using hardware uninstallation mode.

[0090] In other embodiments, if there is no target tunnel in the hardware entry whose traffic status matches the first preset rule, then in response to the newly added tunnel unloading requirement, the newly added tunnel to be unloaded is unloaded to the DPU in software unloading mode.

[0091] For example, when there is a tunnel in the hardware table whose maximum or average pps value in the past 5 minutes is higher than a preset threshold, the newly negotiated tunnel will be switched to software uninstallation mode, that is, the newly added tunnel to be uninstalled will be uninstalled into the DPU in software uninstallation mode.

[0092] This embodiment monitors the number of packets passing through each tunnel per unit time and dynamically adjusts the tunnel offloading method according to the algorithm. This method takes into account scenarios with high tunnel throughput, high concurrency and complex traffic changes, solves the high concurrency requirements of IPSec tunnels due to tenant growth, and maximizes the DPU's offloading capability for IPSec tunnels by dynamically adjusting the tunnel offloading mode.

[0093] In some embodiments, the method further includes: every second preset time interval, if the number of tunnels in the hardware entry is not less than the number of specifications in the hardware entry, obtaining the number N of tunnels in the hardware entry whose traffic status conforms to a first preset rule and the number M of tunnels in the software entry whose traffic status conforms to a second preset rule, wherein N and M are integers not less than 0, and the tunnels in the software entry are tunnels that are unloaded to the DPU using the software unloading mode; if N and M are both not 0, and N is greater than or equal to M, then switching the M tunnels in the hardware entry with the lowest average number of packets per unit time to the software unloading mode, and switching the M tunnels in the software entry whose traffic status conforms to the second preset rule to the hardware unloading mode; if N and M are both not 0, and N is less than M, then switching the N tunnels in the hardware entry with the lowest average number of packets per unit time to the software unloading mode, and switching the N tunnels in the software entry with the highest average number of packets per unit time to the hardware unloading mode.

[0094] Figure 4 Here is a flowchart of a tunnel dynamic unloading method according to another embodiment of this disclosure, as shown below. Figure 4 As shown, the method includes the following steps:

[0095] S401, Tunnel unloading mode switching wait.

[0096] S402. Determine whether the timer has exceeded the second preset time. If yes, execute S403; if no, execute S401.

[0097] The tunnel offloading mode in the DPU needs to be adjusted periodically. This period can be controlled by the second preset time of a timer. When the timer exceeds the second preset time, the tunnel offloading mode in the DPU is maintained according to the following procedure; when the timer does not exceed the second preset time, the tunnel offloading mode switching wait continues.

[0098] S403. Determine whether the number of tunnels in the hardware table entry is not less than the specified number of tunnels in the hardware table entry. If yes, proceed to S404; otherwise, proceed to S409.

[0099] S404. Obtain the number N of tunnels whose traffic status conforms to the first preset rule in the hardware table entry and the number M of tunnels whose traffic status conforms to the second preset rule in the software table entry, where N and M are integers not less than 0.

[0100] The second preset rule includes: within a second preset time period, both the average and maximum number of packets passing through the tunnel per unit time are higher than a preset threshold.

[0101] When the number of tunnels in a hardware entry is not less than (or equal to) the number of specifications in the hardware entry, the hardware entry is full. At this time, the offloading mode of the tunnels in the software entry and the hardware entry is adjusted, and the offloading mode of the tunnel with lower traffic in the hardware entry is swapped with that of the tunnel with higher traffic in the software entry.

[0102] Specifically, the number of tunnels N satisfying the first preset rule in the hardware table and the number of tunnels M satisfying the second preset rule in the software table are obtained respectively, where N and M are integers not less than 0.

[0103] S405. Determine if N and M are both non-zero. If yes, proceed to S406; otherwise, proceed to S410.

[0104] S406. Determine if N is greater than or equal to M. If yes, proceed to S407; otherwise, proceed to S408.

[0105] When both N and M are not 0, it is initially assumed that the conditions for tunnel offloading mode adjustment exist in the DPU. Further determination of the specific offloading mode adjustment scheme is based on the values ​​of N and M.

[0106] S407. Switch the M tunnels with the lowest average number of packets per unit time in the hardware entries to software offload mode, and switch the M tunnels in the software entries whose traffic status conforms to the second preset rule to hardware offload mode.

[0107] When N is greater than or equal to M, that is, the number of tunnels in the hardware table that meet the first preset rule is greater than or equal to the number of tunnels in the software table that meet the second preset rule, the condition of switching all tunnels in the software table that meet the second preset rule to hardware unloading mode is met. Then, M tunnels are selected from the hardware table and switched to software unloading mode, and M tunnels in the software table that meet the second preset rule are switched to hardware unloading mode.

[0108] Specifically, the M tunnels selected from the hardware entries are the M tunnels with the lowest average number of packets per unit time in the hardware entries, which are then switched to software offload mode. In other words, the M tunnels with the lowest traffic in the hardware entries are switched to software offload mode.

[0109] S408. Switch the N tunnels with the lowest average number of packets per unit time in the hardware table to software unloading mode, and switch the N tunnels with the highest average number of packets per unit time in the software table to hardware unloading mode.

[0110] When N is less than M, meaning the number of tunnels in the hardware entry that satisfy the first preset rule is less than the number of tunnels in the software entry that satisfy the second preset rule, only a portion of the tunnels in the software entry that satisfy the second preset rule (at most N tunnels) can be switched to hardware unloading mode. Therefore, N tunnels are selected from the hardware entry to switch to software unloading mode, and N tunnels in the software entry are also switched to hardware unloading mode.

[0111] Specifically, the N tunnels with the lowest average number of packets per unit time from the hardware entries are switched to software offload mode, i.e., the N tunnels with the lowest traffic are switched to software offload mode. Conversely, the N tunnels with the highest average number of packets per unit time from the software entries are switched to hardware offload mode, i.e., the N tunnels with the highest traffic are switched to hardware offload mode.

[0112] In some embodiments, after the tunnel offloading mode is switched, if there are MN tunnels with high traffic in the software offloading mode in the software entry, an alarm is sent to the user side to remind the user that there may be packet loss.

[0113] S409. If there is at least one tunnel in the software entry, then switch at least one tunnel in the software entry to hardware unloading mode.

[0114] When the number of tunnels in a hardware entry is less than the number of specifications in the hardware entry, the hardware entry is not full. If there are tunnels in a software entry that have not been hardware uninstalled, the tunnels in the software entry are directly switched to hardware uninstallation mode. It can be understood that the number of tunnels switched to hardware uninstallation in this step is determined by the number of tunnels in the hardware entry before the uninstallation mode switch and the number of specifications in the hardware entry. The number of tunnels switched to hardware uninstallation should be less than or equal to the difference between the number of specifications in the hardware entry and the number of tunnels in the hardware entry before the uninstallation mode switch.

[0115] S410, End.

[0116] When both N and M are 0, the traffic status of each tunnel in the software and hardware offloading modes in the DPU is relatively good, and the switching of tunnel offloading mode does not need to be performed.

[0117] Alternatively, if the number of tunnels in the hardware table is less than the number of specifications in the hardware table (i.e., the hardware table is not full) and there are no tunnels in the software table, then all tunnels are in hardware unloading mode, and there is no need to switch the tunnel unloading mode.

[0118] Alternatively, if the number of tunnels in the hardware entry is not less than the number of specifications in the hardware entry (i.e., the hardware entry is full), and there are no tunnels in the hardware entry whose traffic status meets the first preset rule, while there are M tunnels in the software entry whose traffic status meets the second preset rule, then the traffic of each tunnel in the hardware entry is relatively high. Although there are tunnels in the software entry whose traffic status meets the second preset rule, the conditions for tunnel switching are not yet met. There are M tunnels in the software entry in the software uninstallation mode with high traffic. At this time, an alarm is sent to the user side to remind the user that there may be packet loss.

[0119] This embodiment of the disclosure periodically checks the traffic status of each tunnel. When the conditions for switching tunnel offloading modes are met, tunnels with both maximum and average PPS values ​​above a threshold are prioritized for hardware offloading, while tunnels with both maximum and average PPS values ​​below the threshold are prioritized for software offloading. When the number of available resources in the hardware table is less than the number of resources required for switching software tables, tunnels with higher average PPS values ​​in the software table are prioritized for switching to hardware offloading mode. By dynamically adjusting the tunnel offloading method according to the tunnel traffic, the problem of low tunnel traffic after hardware offloading and high tunnel traffic after software offloading, which wastes DPU resources, is solved under the static configuration method.

[0120] Figure 5 This is a schematic diagram of the structure of the tunnel dynamic unloading device provided in the embodiments of this disclosure. The tunnel dynamic unloading device can be the DPU as described in the above embodiments, or it can be a component or assembly within the DPU. The tunnel dynamic unloading device provided in the embodiments of this disclosure can execute the processing flow provided in the embodiments of the tunnel dynamic unloading method, such as... Figure 5 As shown, the tunnel dynamic unloading device 50 includes: a first unloading module 51, a traffic monitoring module 52, a switching module 53, and a second unloading module 54; wherein, the first unloading module 51 is used to unload the tunnel to be unloaded into the DPU in hardware unloading mode in response to the tunnel unloading request; the traffic monitoring module 52 is used to monitor the traffic of each tunnel in the hardware table of the DPU to obtain the traffic status of each tunnel, and the tunnel in the hardware table is the tunnel unloaded into the DPU in hardware unloading mode; the switching module 53 is used to switch the target tunnel in the hardware table whose traffic status meets the first preset rule to software unloading mode in response to the newly added tunnel unloading request, if the number of tunnels in the hardware table is not less than the specification number of the hardware table; the second unloading module 54 is used to unload the newly added tunnel to be unloaded into the DPU in hardware unloading mode.

[0121] Optionally, the second unloading module 54 is further configured to, in response to the newly added tunnel unloading requirement, unload the newly added tunnel to be unloaded into the DPU in software unloading mode if there is no target tunnel in the hardware entry whose traffic status meets the first preset rule.

[0122] Optionally, the first preset rule includes: within a first preset time period, the average and maximum values ​​of the number of packets per unit time in the tunnel are both lower than a preset threshold; the switching module 53 includes a first determining unit 531, a second determining unit 532, and a switching unit 533; the first determining unit 531 is used to determine at least one candidate tunnel in the hardware entry whose traffic status conforms to the first preset rule; the second determining unit 532 is used to select at least one candidate tunnel with the lowest maximum value of the number of packets per unit time in the first preset time period as the target tunnel; the switching unit 533 is used to switch the target tunnel to software uninstallation mode.

[0123] Optionally, the tunnel dynamic unloading device 50 further includes an acquisition module 55, configured to acquire, at every second preset time interval, the number N of tunnels in the hardware entry whose traffic status conforms to a first preset rule and the number M of tunnels in the software entry whose traffic status conforms to a second preset rule, if the number of tunnels in the hardware entry is not less than the number of specifications in the hardware entry, where N and M are integers not less than 0, and the tunnels in the software entry are tunnels unloaded to the DPU using the software unloading mode; the switching unit 533 is further configured to, if N and M are not 0, and N is greater than or equal to M, switch the M tunnels in the hardware entry with the lowest average number of packets per unit time to the software unloading mode, and switch the M tunnels in the software entry whose traffic status conforms to the second preset rule to the hardware unloading mode.

[0124] Optionally, the switching unit 533 is further configured to, if N and M are both non-zero and N is less than M, switch the N tunnels with the lowest average number of packets per unit time in the hardware entry to software unloading mode, and switch the N tunnels with the highest average number of packets per unit time in the software entry to hardware unloading mode.

[0125] Optionally, the switching unit 533 is also used to switch at least one tunnel in the software entry to hardware unloading mode every second preset time interval if the number of tunnels in the hardware entry is less than the specification number of the hardware entry, and there is at least one tunnel in the software entry.

[0126] Optionally, the hardware offloading mode is to offload the tunnel configuration and negotiation results to the hardware entry of the DPU and back them up to the software entry; the software offloading mode is to offload the tunnel configuration and negotiation results to the software entry of the DPU.

[0127] Figure 5 The tunnel dynamic unloading device shown in the embodiment can be used to execute the technical solution of the above method embodiment. Its implementation principle and technical effect are similar, and will not be repeated here.

[0128] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. The electronic device may be a DPU as described in the above embodiment. The electronic device provided in this embodiment of the disclosure can execute the processing flow provided in the tunnel dynamic offloading method embodiment, such as... Figure 6 As shown, the electronic device 60 includes: a memory 61, a processor 62, a computer program, and a communication interface 63; wherein the computer program is stored in the memory 61 and configured to be executed by the processor 62 as described above in the tunnel dynamic offloading method.

[0129] In addition, this disclosure also provides a computer-readable storage medium having a computer program stored thereon, the computer program being executed by a processor to implement the tunnel dynamic offloading method described in the above embodiments.

[0130] Furthermore, this disclosure also provides a computer program product, which includes a computer program or instructions that, when executed by a processor, implement the tunnel dynamic offloading method as described above.

[0131] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0132] The above description is merely a specific embodiment of this disclosure, enabling those skilled in the art to understand or implement it. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for dynamic unloading in a tunnel, characterized in that, The method includes: In response to the tunnel unloading requirement, the tunnel to be unloaded is unloaded to the DPU in hardware unloading mode; Traffic monitoring is performed on each tunnel in the hardware table of the DPU to obtain the traffic status of each tunnel. The tunnel in the hardware table is the tunnel that is offloaded to the DPU using the hardware offload mode. In response to the new tunnel offloading requirement, if the number of tunnels in the hardware entry is not less than the number of specifications in the hardware entry, the target tunnel in the hardware entry whose traffic status meets the first preset rule is switched to software offloading mode; wherein, the first preset rule includes: within a first preset time period, the average and maximum number of packets per unit time of the tunnel are both lower than a preset threshold. The newly added tunnel to be uninstalled will be uninstalled into the DPU using hardware uninstallation mode.

2. The method according to claim 1, characterized in that, The method further includes: If there is no target tunnel in the hardware table whose traffic status matches the first preset rule, then in response to the newly added tunnel unloading requirement, the newly added tunnel to be unloaded will be unloaded into the DPU in software unloading mode.

3. The method according to claim 1, characterized in that, The step of switching the target tunnel whose traffic status in the hardware entry matches the first preset rule to software uninstallation mode includes: Determine at least one candidate tunnel whose traffic status in the hardware entry conforms to a first preset rule; The tunnel with the lowest maximum number of packets passing per unit time within a first preset time period among the at least one candidate tunnel is selected as the target tunnel. Switch the target tunnel to software uninstallation mode.

4. The method according to claim 1, characterized in that, The method further includes: Every second preset time interval, if the number of tunnels in the hardware entry is not less than the number of specifications in the hardware entry, obtain the number N of tunnels in the hardware entry whose traffic status conforms to the first preset rule and the number M of tunnels in the software entry whose traffic status conforms to the second preset rule, where N and M are integers not less than 0, and the tunnels in the software entry are tunnels that are uninstalled to the DPU using the software uninstallation mode. If N and M are both non-zero, and N is greater than or equal to M, then the M tunnels with the lowest average number of packets per unit time in the hardware entries are switched to software offload mode, and the M tunnels in the software entries whose traffic status conforms to the second preset rule are switched to hardware offload mode.

5. The method according to claim 4, characterized in that, The method further includes: If both N and M are not 0, and N is less than M, then the N tunnels with the lowest average number of packets per unit time in the hardware entries are switched to software unloading mode, and the N tunnels with the highest average number of packets per unit time in the software entries are switched to hardware unloading mode.

6. The method according to claim 4, characterized in that, The method further includes: Every second preset time interval, if the number of tunnels in the hardware entry is less than the number of specifications in the hardware entry, and there is at least one tunnel in the software entry, then at least one tunnel in the software entry will be switched to hardware unloading mode.

7. The method according to claim 1, characterized in that, The hardware offloading mode involves offloading the tunnel configuration and negotiation results to the hardware entry of the DPU and backing them up to the software entry. The software uninstallation mode involves uninstalling the tunnel configuration and negotiation results into the DPU's software entries.

8. A tunnel dynamic unloading device, characterized in that, include: The first unloading module is used to unload the tunnel to be unloaded into the DPU in hardware unloading mode in response to the tunnel unloading request. The traffic monitoring module is used to monitor the traffic of each tunnel in the hardware table of the DPU and obtain the traffic status of each tunnel. The tunnel in the hardware table is a tunnel that is offloaded to the DPU using the hardware offload mode. The switching module is used to respond to new tunnel offloading requirements. If the number of tunnels in the hardware entry is not less than the number of specifications in the hardware entry, the target tunnel in the hardware entry whose traffic status meets the first preset rule is switched to software offloading mode. The first preset rule includes: within a first preset time period, the average and maximum number of packets per unit time of the tunnel are both lower than a preset threshold. The second unloading module is used to unload newly added tunnels to be unloaded into the DPU in hardware unloading mode.

9. An electronic device, characterized in that, include: Memory; processor; as well as Computer programs; The computer program is stored in the memory and configured to be executed by the processor to implement the method as described in any one of claims 1-7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-7.

Images