VPN implementation method, system and device based on ovn architecture and medium

Abstract

The application discloses a VPN implementation method, system, device and medium based on an OVN architecture, relates to the technical field of networks, and is applied to a VPN gateway node in an OpenStack cloud platform, judges whether a VPN creation instruction sent by an ovn-vpnaas is received, the VPN creation instruction comprising an instruction generated by the ovn-vpnaas after detecting a VPN fault; in response to receiving the VPN creation instruction, acquires VPN configuration data and VPN transmission network data from an ovn-nb, the VPN configuration data and the VPN transmission network data being generated by the ovn-vpnaas; creates a transmission link corresponding to an IPSec-VPN according to the VPN transmission network data; and creates the IPSec-VPN according to the VPN configuration data. The application guarantees that the IPSec-VPN function under the OVN architecture can be recovered in time after a fault, and guarantees high availability.

Description

Technical Field

[0001] This application relates to the field of network technology, and more specifically, to VPN implementation methods, systems, devices, and media based on the OVN architecture. Background Technology

[0002] OpenStack is an open-source cloud computing management platform project, a collection of open-source software projects that provides scalable and elastic cloud computing services for both private and public clouds. For networking solutions on the OpenStack cloud platform, the recommended architecture is OVN (Open Virtual Network).

[0003] However, while OVS (Open Vswitch) flow tables provide Layer 3 forwarding functionality in the OVN architecture, OVS cannot provide IPSec (Internet Protocol Security)-VPN (Virtual Private Network) functionality. Furthermore, the physical separation of IPSec-VPN functionality from Layer 3 forwarding further complicates the high availability of IPSec-VPN functionality under the OVN architecture.

[0004] In conclusion, ensuring the high availability of IPSec-VPN functionality under the OVN architecture is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] The purpose of this application is to provide a VPN implementation method based on the OVN architecture, which can, to some extent, solve the technical problem of how to ensure the high availability of IPSec-VPN functions under the OVN architecture. This application also provides a VPN implementation system, electronic device, and computer-readable storage medium based on the OVN architecture.

[0006] To achieve the above objectives, this application provides the following technical solution:

[0007] A VPN implementation method based on OVN architecture, applied to VPN gateway nodes in an OpenStack cloud platform, includes:

[0008] Determine whether a VPN creation command sent by ovn-vpnaas has been received, the VPN creation command including the command generated by ovn-vpnaas after detecting a VPN failure;

[0009] In response to receiving the VPN creation instruction, VPN configuration data and VPN transport network data are obtained from ovn-nb, which are generated by ovn-vpnaas.

[0010] Create a transmission link corresponding to IPSec-VPN based on the VPN transmission network data;

[0011] Create an IPSec-VPN based on the VPN configuration data.

[0012] In an exemplary embodiment, the step of creating a transport link corresponding to the IPSec-VPN based on the VPN transport network data and creating the IPSec-VPN based on the VPN configuration data includes:

[0013] The VPN gateway port and transmission port in the VPN transmission network data are parsed out;

[0014] Create the target tap devices corresponding to the VPN gateway port and the transport port;

[0015] Bind the target tap device to the OVS of the VPN gateway node;

[0016] An ip-table is created based on the VPN configuration data. The ip-table is used for Layer 3 forwarding and IPSec encryption / decryption, as well as encryption / decryption encapsulation processing.

[0017] Create a host-tap device corresponding to the target tap device;

[0018] Configure the host-tap device in the ip-table and connect the host-tap device to the target tap device;

[0019] Configure IKE and start IKE negotiation;

[0020] Based on the IKE negotiation results, an IPsec-SA is generated. The IPsec-SA is used to transmit encrypted and decrypted data for VPN traffic packets.

[0021] An IPIP tunnel interface is generated based on the IKE negotiation results. The IPIP tunnel interface is used to send and receive VPN traffic packets and to encapsulate and decapsulate the packets.

[0022] Bind the IPIP tunnel interface to the host-tap device;

[0023] Based on the VPN configuration data, a routing route is issued in the ip-table to transmit cloud host packets through the transmission port and the IPIP tunnel interface.

[0024] In an exemplary embodiment, before determining whether a VPN creation instruction sent by ovn-vpnaas has been received, the method further includes:

[0025] The status of the VPN gateway node is detected, and the detection result is obtained;

[0026] The detection results are stored in ovn-sb so that ovn-vpnaas can determine whether to send the VPN creation command to the VPN gateway node based on the detection results.

[0027] In an exemplary embodiment, after detecting the state of the VPN gateway node and obtaining the detection result, the method further includes:

[0028] Determine the timestamp of the generation of the detection result;

[0029] The generated timestamp is stored in ovn-sb.

[0030] A VPN implementation method based on the OVN architecture, applied to the ovn-vpnaas in the OpenStack cloud platform, includes:

[0031] Detect whether the VPN in the OpenStack cloud platform is faulty;

[0032] If a VPN failure is detected, VPN configuration data and VPN transport network data are generated.

[0033] Write the VPN configuration data and the VPN transmission network data into ovn-nb;

[0034] Generate VPN creation instructions;

[0035] Select one VPN gateway node from among multiple VPN gateway nodes in the OpenStack cloud platform and send the VPN creation command to the selected VPN gateway node, so that the VPN gateway node obtains the VPN configuration data and the VPN transmission network data from ovn-nb, creates the transmission link corresponding to IPSec-VPN according to the VPN transmission network data, and creates IPSec-VPN according to the VPN configuration data.

[0036] In an exemplary embodiment, selecting one VPN gateway node from a plurality of VPN gateway nodes in the OpenStack cloud platform and sending the VPN creation instruction to the selected VPN gateway node includes:

[0037] Read the detection results stored in each VPN gateway node from ovn-sb;

[0038] Based on the test results, VPN gateway nodes that are not faulty are selected;

[0039] Select one of the non-faulty VPN gateway nodes and send the VPN creation command to the selected VPN gateway node.

[0040] In one exemplary embodiment, generating VPN configuration data and VPN transport network data includes:

[0041] Use the ml2 plugin to create the VPN gateway port, transport network, transport subnet, and transport port;

[0042] The VPN gateway port, the transmission network, the transmission subnet, and the transmission port are used as the VPN transmission network data;

[0043] Call ovn-router to associate the transmission subnet with the router where the cloud host is located, and create a router interface;

[0044] Based on the router interface, determine the routing route to divert cloud host traffic from the compute node to the selected VPN gateway node;

[0045] Add the redirection route to the VPN configuration data.

[0046] A VPN implementation system based on the OVN architecture, applied to VPN gateway nodes in an OpenStack cloud platform, including...

[0047] The first judgment module is used to determine whether a VPN creation instruction sent by ovn-vpnaas has been received. The VPN creation instruction includes the instruction generated by ovn-vpnaas after detecting a VPN failure.

[0048] The first processing module is configured to, in response to receiving the VPN creation instruction, obtain VPN configuration data and VPN transmission network data from ovn-nb, wherein the VPN configuration data and the VPN transmission network data are generated by ovn-vpnaas;

[0049] The first creation module is used to create a transmission link corresponding to the IPSec-VPN based on the VPN transmission network data; and to create the IPSec-VPN based on the VPN configuration data.

[0050] An electronic device, comprising:

[0051] Memory, used to store computer programs;

[0052] A processor, used to implement the steps of any of the above-described OVN-based VPN implementation methods when executing the computer program.

[0053] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of any of the above-described OVN-based VPN implementation methods.

[0054] This application provides a VPN implementation method based on the OVN architecture, applied to a VPN gateway node in an OpenStack cloud platform. The method determines whether a VPN creation command sent by ovn-vpnaas has been received. The VPN creation command includes instructions generated by ovn-vpnaas after detecting a VPN failure. In response to receiving the VPN creation command, the method obtains VPN configuration data and VPN transport network data from ovn-nb, which are generated by ovn-vpnaas. The method then creates a transport link corresponding to the IPSec-VPN based on the VPN transport network data and finally creates the IPSec-VPN based on the VPN configuration data. In this application, after detecting a VPN failure, ovn-vpnaas sends a VPN creation command to the VPN gateway node. This allows the VPN gateway node to create an IPSec-VPN based on the command, enabling rapid recovery after an IPSec-VPN failure and ensuring high availability of the IPSec-VPN function. Furthermore, the VPN configuration data and VPN transmission network data required for the VPN gateway node to create the IPSec-VPN are generated by ovn-vpnaas and stored in ovn-nb. Since both ovn-vpnaas and ovn-nb are components of the OVN architecture, this application achieves IPSec-VPN creation solely based on the OVN architecture, ultimately ensuring high availability of the IPSec-VPN function under the OVN architecture without relying on other architectures. The VPN implementation system, electronic device, and computer-readable storage medium based on the OVN architecture provided in this application also solve the corresponding technical problems. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0056] Figure 1 A first flowchart illustrating a VPN implementation method based on the OVN architecture provided in this application embodiment;

[0057] Figure 2 A second flowchart illustrating a VPN implementation method based on the OVN architecture provided in this application embodiment;

[0058] Figure 3 This is a schematic diagram of the OpenStack cloud platform based on the OVN architecture in this application;

[0059] Figure 4A third flowchart illustrating a VPN implementation method based on an OVN architecture provided in this application embodiment;

[0060] Figure 5 This is a schematic diagram of a VPN implementation method based on the OVN architecture under two VPN gateway nodes;

[0061] Figure 6 A schematic diagram of the structure of a VPN implementation system based on the OVN architecture provided in this application embodiment;

[0062] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application;

[0063] Figure 8 This is another structural schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0064] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0065] Please see Figure 1 , Figure 1 This is a first flowchart of a VPN implementation method based on the OVN architecture provided in an embodiment of this application.

[0066] This application provides a VPN implementation method based on the OVN architecture, applied to a VPN gateway node in an OpenStack cloud platform, which may include the following steps:

[0067] Step S101: Determine whether a VPN creation command sent by ovn-vpnaas has been received. If a VPN creation command has been received, proceed to step S102.

[0068] In practical applications, the OpenStack cloud platform is built on the OVN architecture. Within the OVN architecture, ovn-vpnaas detects VPN failures on the cloud platform. If a VPN failure is detected, a VPN creation command is generated and sent to the VPN gateway node on the cloud platform. Since there are multiple VPN gateway nodes on the cloud platform, and only one VPN gateway node needs to respond to the VPN creation command, ovn-vpnaas only needs to send the command to one VPN gateway node. Correspondingly, the VPN gateway node needs to determine whether it has received the VPN creation command from ovn-vpnaas. If it has, it executes the subsequent IPSec-VPN creation process to promptly restore the IPSec-VPN in case of a failure on the cloud platform, ensuring high availability of the IPSec-VPN.

[0069] Step S102: Obtain VPN configuration data and VPN transport network data from ovn-nb. The VPN configuration data and VPN transport network data are generated by ovn-vpnaas.

[0070] Step S103: Create the transmission link corresponding to IPSec-VPN based on the VPN transmission network data.

[0071] Step S104: Create an IPSec-VPN based on the VPN configuration data.

[0072] In practical applications, after generating the VPN creation command, ovn-vpnaas generates VPN configuration data and VPN transport network data to guide the IPSec-VPN creation process. Furthermore, ovn-vpnaas stores this VPN configuration data and transport network data in ovn-nb, specifically in the VPN gateway port data of the Logical_Switch_Port table within ovn-nb. Therefore, after receiving the VPN creation command, the VPN gateway node needs to retrieve the VPN configuration data and transport network data from ovn-nb, then create the corresponding transport link for the IPSec-VPN based on the transport network data to ensure the data transmission capability of the IPSec-VPN, and finally create the IPSec-VPN based on the VPN configuration data.

[0073] It should be noted that VPN configuration data is used to configure the encryption and decryption functions of IPSec-VPN, while VPN transmission network data is used to configure the data transmission path of IPSec-VPN. The specific content of VPN configuration data and VPN transmission network data can be determined according to the application scenario.

[0074] This application provides a VPN implementation method based on the OVN architecture, applied to a VPN gateway node in an OpenStack cloud platform. The method determines whether a VPN creation command sent by ovn-vpnaas has been received. The VPN creation command includes instructions generated by ovn-vpnaas after detecting a VPN failure. In response to receiving the VPN creation command, the method obtains VPN configuration data and VPN transport network data from ovn-nb, which are generated by ovn-vpnaas. The method then creates a transport link corresponding to the IPSec-VPN based on the VPN transport network data and finally creates the IPSec-VPN based on the VPN configuration data. In this application, after detecting a VPN failure, ovn-vpnaas sends a VPN creation command to the VPN gateway node, enabling the VPN gateway node to create an IPSec-VPN based on this command. This allows for rapid recovery after an IPSec-VPN failure, ensuring high availability of the IPSec-VPN function. Furthermore, the VPN configuration data and VPN transmission network data required by the VPN gateway node to create the IPSec-VPN are generated by ovn-vpnaas and stored in ovn-nb. Since both ovn-vpnaas and ovn-nb are components of the OVN architecture, this application achieves the creation of an IPSec-VPN solely based on the OVN architecture, ultimately ensuring high availability of the IPSec-VPN function under the OVN architecture without relying on other architectures.

[0075] Please see Figure 2 and Figure 3 , Figure 2 This is a second flowchart illustrating a VPN implementation method based on the OVN architecture provided in an embodiment of this application. Figure 3 This is a schematic diagram of the OpenStack cloud platform based on the OVN architecture in this application. In this diagram, ovn-vpnaas represents the plugin in the OVN architecture that supports vpnaas, and ovn-nb and ovn-sb represent the database in the OVN architecture.

[0076] This application provides a VPN implementation method based on the OVN architecture, applied to a VPN gateway node in an OpenStack cloud platform, which may include the following steps:

[0077] Step S201: Determine whether a VPN creation command sent by ovn-vpnaas has been received. If a VPN creation command has been received, proceed to step S202.

[0078] Step S202: Obtain VPN configuration data and VPN transport network data from ovn-nb. The VPN configuration data and VPN transport network data are generated by ovn-vpnaas.

[0079] Step S203: Parse the VPN gateway port and transmission port in the VPN transmission network data.

[0080] Step S204: Create the target tap device corresponding to the VPN gateway port and the transport port.

[0081] Step S205: Bind the target tap device to the OVS of the VPN gateway node.

[0082] In practical applications, when creating the corresponding transmission link for IPSec-VPN based on VPN transmission network data and creating IPSec-VPN based on VPN configuration data, the VPN gateway port and transmission port in the VPN transmission network data can be parsed first; then the target tap device corresponding to the VPN gateway port and transmission port can be created; the target tap device can be bound to the OVS of the VPN gateway node to adapt the IPSec-VPN function to the OVS of the VPN gateway node and remove the isolation between the IPSec-VPN function and the OVS.

[0083] Step S206: Create an ip-table based on the VPN configuration data. The ip-table is used for Layer 3 forwarding and IPSec encryption / decryption / encapsulation processing.

[0084] Step S207: Create the host-tap device corresponding to the target tap device.

[0085] Step S208: Configure the host-tap device in the ip-table and connect the host-tap device to the target tap device.

[0086] In practical applications, after binding the target tap device to the OVS of the VPN gateway node, an ip-table can be created based on the VPN configuration data. The ip-table is used for Layer 3 forwarding and IPSec encryption / decryption / encapsulation processing. A host-tap device corresponding to the target tap device is also created, set in the ip-table, and connected to the target tap device. This allows the ip-table to exchange encryption / decryption and encapsulation data with OVS through the host-tap device, the target tap device, and the OVS.

[0087] Step S209: Configure IKE and start IKE negotiation.

[0088] Step S210: Generate ipsec-sa based on the IKE negotiation result. ipsec-sa is used to transmit encryption and decryption data for VPN traffic packets.

[0089] Step S211: Generate an IPIP tunnel interface based on the IKE negotiation result. The IPIP tunnel interface is used to send and receive VPN traffic packets and to encapsulate and decapsulate the packets.

[0090] Step S212: Bind the ipip tunnel interface to the host-tap device.

[0091] Step S213: Issue traffic routing routes in ip-table based on VPN configuration data to transmit cloud host packets through the transmission port and ipip tunnel interface.

[0092] In practical applications, after connecting the host-tap device to the target tap device, it is also necessary to configure the data transmission process of the IPSec-VPN function, that is, to configure IKE and start IKE negotiation; generate ipsec-sa based on the IKE negotiation result, which is used to transmit the encryption and decryption data of VPN traffic packets; generate an ipip tunnel interface based on the IKE negotiation result, which is used to send and receive VPN traffic packets and to encapsulate and decrypt the packets; bind the ipip tunnel interface to the host-tap device; and issue a traffic routing route in the ip-table according to the VPN configuration data to transmit cloud host packets through the transmission port and the ipip tunnel interface.

[0093] As described above, in this application, during the creation of an IPSec-VPN instance, the VPN gateway node creates a target tap device through the VPN gateway port and transport port, and binds the target tap device to the VPN gateway node's OVS to adapt the IPSec-VPN function to the VPN gateway node's OVS, thus removing the isolation between the IPSec-VPN function and the OVS. Then, through the configuration of ip-tables, host-tap devices, and the target tap device, the IPSec-VPN can interact with the OVS for encryption / decryption and data encapsulation / decryption, integrating the IPSec-VPN function into the OVN architecture. Finally, through IKE negotiation and routing, the traffic of the cloud host can utilize the IPSec-VPN function. Ultimately, this achieves the integration of the IPSec-VPN function into the OVN architecture without relying on other architectures.

[0094] In practical applications, before determining whether to receive the VPN creation command sent by ovn-vpnaas, the VPN gateway node can also detect the status of the VPN gateway node and obtain the detection result. The detection result is stored in ovn-sb, for example, in the Chassis_Private table of ovn-sb, so that ovn-vpnaas can determine whether to send the VPN creation command to the VPN gateway node based on the detection result.

[0095] In specific application scenarios, after detecting the status of the VPN gateway node and obtaining the detection result, the ovn-sb can determine the generation timestamp of the detection result and store it in the ovn-vpnaas. This allows ovn-vpnaas to comprehensively determine whether to send a VPN creation command to the VPN gateway node based on both the detection result and the generation timestamp. For example, if the detection results of two VPN gateway nodes both indicate that the VPN gateway node is normal, ovn-vpnaas can choose to send the VPN creation command to the VPN gateway node with the latest generation timestamp, because the VPN gateway node with the latest generation timestamp is less likely to fail, thus ensuring the normal creation of the IPSec-VPN.

[0096] Please see Figure 4 , Figure 4 The third flowchart illustrates a VPN implementation method based on the OVN architecture provided in this application embodiment.

[0097] This application provides a VPN implementation method based on the OVN architecture, applied to ovn-vpnaas in the OpenStack cloud platform, which may include the following steps:

[0098] Step S301: Check if the VPN in the OpenStack cloud platform is faulty.

[0099] Step S302: If a VPN failure is detected, generate VPN configuration data and VPN transport network data.

[0100] Step S303: Write the VPN configuration data and VPN transport network data to ovn-nb.

[0101] Step S304: Generate VPN creation instructions.

[0102] Step S305: Select one VPN gateway node from the multiple VPN gateway nodes in the OpenStack cloud platform and send a VPN creation command to the selected VPN gateway node so that the VPN gateway node obtains VPN configuration data and VPN transmission network data from ovn-nb, creates the transmission link corresponding to IPSec-VPN according to the VPN transmission network data, and creates IPSec-VPN according to the VPN configuration data.

[0103] The description of the VPN implementation method based on OVN architecture for ovn-vpnaas applied to the OpenStack cloud platform provided in this application embodiment can be found in the above embodiments, and will not be repeated here.

[0104] In practical applications, during the process of ovn-vpnaas selecting one VPN gateway node from multiple VPN gateway nodes in the OpenStack cloud platform and sending a VPN creation command to the selected VPN gateway node, it can read the detection results stored in each VPN gateway node from ovn-sb; filter out the non-faulty VPN gateway nodes based on the detection results; select one of the non-faulty VPN gateway nodes and send a VPN creation command to the selected VPN gateway node.

[0105] In specific application scenarios, there may be multiple VPN gateway nodes that are not experiencing problems. Therefore, effectively selecting one VPN gateway to create an IPSec-VPN becomes a challenge. To address this, we can determine the performance data of each non-faulty VPN gateway node and sort the performance data in ascending order to obtain a ranking number for each performance data point. Next, we determine the number of existing VPNs on each non-faulty VPN gateway node and sort the existing VPN counts in descending order to obtain a ranking number for each existing VPN count. Then, we perform a weighted sum of the ranking numbers of the performance data and the ranking numbers of the existing VPN counts for each VPN gateway node to obtain a node score. The ranking number is positively correlated with the weight value. Finally, the VPN gateway node with the highest node score is selected. In this way, we can select a VPN gateway node with suitable performance and a suitable number of existing VPNs to create an IPSec-VPN, essentially choosing the best-performing VPN gateway node. This avoids performance fluctuations of the VPN gateway node affecting the IPSec-VPN creation process and ensures the stability of the IPSec-VPN creation.

[0106] In practical applications, during the generation of VPN configuration data and VPN transport network data, ovn-vpnaas can call the ml2 plugin to create VPN gateway ports, transport networks, transport subnets, and transport ports; use the VPN gateway ports, transport networks, transport subnets, and transport ports as VPN transport network data; call ovn-router to associate the transport subnet with the router where the cloud host is located, creating a router interface; determine the routing route to divert cloud host traffic from the compute node to the selected VPN gateway node based on the router interface; and add the routing route to the VPN configuration data.

[0107] To facilitate understanding of the VPN implementation method based on the OVN architecture provided in this application, the following is combined with... Figure 5The following describes the IPSec-VPN creation process under two VPN gateway nodes, where VPN controller 1 is the controller in the first VPN gateway node and VPN controller 2 is the controller in the second VPN gateway node. The entire process can be described as follows:

[0108] VPN Controller 1 and VPN Controller 2 start a task to periodically report their own status to ovn-sb;

[0109] ovn-vpnaas initiates a task to periodically check the status of the VPN controller in ovn-sb;

[0110] ovn-vpnaas detects a VPN failure and obtains the controller status data from ovn-sb; assuming the VPN is first scheduled to VPN controller 1;

[0111] The ovn-vpnaas command creates a VPN external gateway and a VPN gateway port on the ovn-nb; it also creates transport networks, subnets, and router interfaces for the subnets on the ovn-nb and translates them into the ovn-sb database; and it creates transport ports on the ovn-nb.

[0112] ovn-vpnaas updates the VPN gateway results, transmits network and other data to the VPN external gateway; it also distributes traffic routing to ovn-nb and translates it into the ovn-sb database.

[0113] ovn-vpnaas stores VPN and transmits network data to the VPN gateway port;

[0114] ovn-nb notifies VPN controller 1 of data changes;

[0115] VPN controller 1 creates ip-tables, tap, and host-tap devices, configures IKE and starts negotiation, waits for successful negotiation, establishes an IPSec connection, and distributes traffic routing routes.

[0116] VPN controller 1 writes the IPSec connection status to ovn-nb, and ovn-nb reports the IPSec status changes to ovn-vpnaas;

[0117] VPN controller 1 fails and stops reporting status; VPN controller triggers status reporting task.

[0118] ovn-vpnaas triggers a task to check the VPN controller status;

[0119] ovn-vpnaas obtains the controller status data from ovn-sb, finds that VPN controller 1 is inactive, and schedules the VPN to VPN controller 2; it also modifies the host bound to the transport port to ovn-nb and modifies the host bound to the VPN gateway port to ovn-nb.

[0120] ovn-nb notifies VPN controller 2 of data changes;

[0121] VPN controller 2 creates ip-tables, tap, and host-tap devices, configures IKE and starts negotiation, waits for successful negotiation, establishes an IPSec connection, and distributes traffic routing routes.

[0122] VPN controller 2 writes the IPSec connection status to ovn-nb, and ovn-nb reports the IPSec status changes to ovn-vpnaas.

[0123] Please see Figure 6 , Figure 6 This is a schematic diagram of a VPN implementation system based on the OVN architecture provided in an embodiment of this application.

[0124] This application provides a VPN implementation system based on the OVN architecture, applied to a VPN gateway node in an OpenStack cloud platform, which may include...

[0125] The first judgment module 101 is used to determine whether a VPN creation instruction sent by ovn-vpnaas has been received. The VPN creation instruction includes the instruction generated by ovn-vpnaas after detecting a VPN failure.

[0126] The first processing module 102 is used to obtain VPN configuration data and VPN transmission network data from ovn-nb in response to receiving a VPN creation instruction. The VPN configuration data and VPN transmission network data are generated by ovn-vpnaas.

[0127] The first creation module 103 is used to create the transmission link corresponding to IPSec-VPN based on VPN transmission network data; and to create IPSec-VPN based on VPN configuration data.

[0128] This application provides a VPN implementation system based on the OVN architecture, applied to a VPN gateway node in an OpenStack cloud platform. The first creation module may include:

[0129] The first parsing unit is used to parse out the VPN gateway port and transmission port in the VPN transmission network data;

[0130] The first creation unit is used to create the target tap device corresponding to the VPN gateway port and the transmission port;

[0131] The first binding unit is used to bind the target tap device to the OVS of the VPN gateway node;

[0132] The second creation unit is used to create an ip-table based on VPN configuration data. The ip-table is used for Layer 3 forwarding and IPSec encryption / decryption and encapsulation processing.

[0133] The third creation unit is used to create the host-tap device corresponding to the target tap device;

[0134] The first configuration unit is used to configure the host-tap device in the ip-table and connect the host-tap device to the target tap device;

[0135] The first configuration unit is used to configure IKE and initiate IKE negotiation;

[0136] The first generation unit is used to generate ipsec-sa based on the IKE negotiation result. The ipsec-sa is used to transmit encryption and decryption data for VPN traffic packets.

[0137] The second generation unit is used to generate an IPIP tunnel interface based on the IIKE negotiation result. The IPIP tunnel interface is used to send and receive VPN traffic packets and to encapsulate and decapsulate the packets.

[0138] The second binding unit is used to bind the IPIP tunnel interface to the host-tap device;

[0139] The first distribution unit is used to distribute routing routes in the ip-table according to the VPN configuration data, so as to transmit cloud host packets through the transmission port and the ipip tunnel interface.

[0140] This application provides a VPN implementation system based on the OVN architecture, applied to a VPN gateway node in an OpenStack cloud platform, which may further include:

[0141] The first detection module is used to detect the status of the VPN gateway node before the first judgment module determines whether it has received the VPN creation command sent by ovn-vpnaas, and obtain the detection result; the detection result is stored in ovn-sb so that ovn-vpnaas can determine whether to send the VPN creation command to the VPN gateway node based on the detection result.

[0142] This application provides a VPN implementation system based on the OVN architecture, applied to a VPN gateway node in an OpenStack cloud platform, which may further include:

[0143] The first generation module is used by the first detection module to detect the status of the VPN gateway node, and after obtaining the detection result, to determine the generation timestamp of the detection result and store the generation timestamp in ovn-sb.

[0144] This application provides a VPN implementation system based on the OVN architecture, applied to the ovn-vpnaas in the OpenStack cloud platform, which may include:

[0145] The second detection module is used to detect whether the VPN in the OpenStack cloud platform is faulty; if a VPN fault is detected, VPN configuration data and VPN transmission network data are generated.

[0146] The first writing module is used to write VPN configuration data and VPN transmission network data to ovn-nb;

[0147] The second generation module is used to generate VPN creation instructions;

[0148] The first sending module is used to select one VPN gateway node from multiple VPN gateway nodes in the OpenStack cloud platform and send a VPN creation command to the selected VPN gateway node, so that the VPN gateway node can obtain VPN configuration data and VPN transmission network data from ovn-nb, create the transmission link corresponding to IPSec-VPN according to the VPN transmission network data, and create IPSec-VPN according to the VPN configuration data.

[0149] This application provides a VPN implementation system based on the OVN architecture, applied to a VPN gateway node in an OpenStack cloud platform. The first sending module may include:

[0150] The first reading unit is used to read the detection results stored in each VPN gateway node from ovn-sb;

[0151] The first filtering unit is used to filter out non-faulty VPN gateway nodes based on the detection results; select one of the non-faulty VPN gateway nodes and send a VPN creation command to the selected VPN gateway node.

[0152] This application provides a VPN implementation system based on the OVN architecture, applied to a VPN gateway node in an OpenStack cloud platform. The second detection module may include:

[0153] The fourth creation unit is used to call the ml2 plugin to create the VPN gateway port, transport network, transport subnet, and transport port;

[0154] The second configuration unit is used to set the VPN gateway port, transmission network, transmission subnet and transmission port as VPN transmission network data;

[0155] The first association unit is used to call ovn-router to associate the transmission subnet with the router where the cloud host is located and to create a router interface.

[0156] The first determining unit is used to determine, based on the router interface, the routing route for diverting cloud host traffic from the compute node to the selected VPN gateway node;

[0157] The first addition unit is used to add traffic routing routes to the VPN configuration data.

[0158] This application also provides an electronic device and a computer-readable storage medium, both of which have the corresponding effects of the VPN implementation method based on the OVN architecture provided in the embodiments of this application. Please refer to... Figure 7 , Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0159] An electronic device provided in this application includes a memory 201 and a processor 202. The memory 201 stores a computer program, and when the processor 202 executes the computer program, it implements the steps of the VPN implementation method based on the OVN architecture as described in any of the above embodiments.

[0160] Please see Figure 8 Another electronic device provided in this application embodiment may further include: an input port 203 connected to the processor 202 for transmitting commands input from the outside to the processor 202; a display unit 204 connected to the processor 202 for displaying the processing results of the processor 202 to the outside; and a communication module 205 connected to the processor 202 for enabling communication between the electronic device and the outside. The display unit 204 may be a display panel, a laser scanner, or the like; the communication method used by the communication module 205 includes, but is not limited to, Mobile High-Definition Link (MHL), Universal Serial Bus (USB), High-Definition Multimedia Interface (HDMI), wireless connectivity: Wireless Fidelity (WiFi), Bluetooth communication technology, Bluetooth Low Energy communication technology, and communication technology based on IEEE 802.11s.

[0161] This application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the steps of the VPN implementation method based on the OVN architecture described in any of the above embodiments.

[0162] The computer-readable storage media involved in this application include random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs (Compact Disc Read-Only Memory), or any other form of storage media known in the art.

[0163] For descriptions of relevant parts of the VPN implementation system, electronic device, and computer-readable storage medium based on the OVN architecture provided in this application, please refer to the detailed description of the corresponding parts in the VPN implementation method based on the OVN architecture provided in this application, which will not be repeated here. Furthermore, parts of the technical solutions provided in this application that are consistent with the implementation principles of corresponding technical solutions in the prior art have not been described in detail to avoid excessive elaboration.

[0164] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0165] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A VPN implementation method based on OVN architecture, characterized in that, VPN gateway nodes used in OpenStack cloud platforms include: Determine whether a VPN creation command sent by ovn-vpnaas has been received, the VPN creation command including the command generated by ovn-vpnaas after detecting a VPN failure; In response to receiving the VPN creation instruction, VPN configuration data and VPN transport network data are obtained from ovn-nb, which are generated by ovn-vpnaas. Create a transmission link corresponding to IPSec-VPN based on the VPN transmission network data; Create an IPSec-VPN based on the VPN configuration data.

2. The method according to claim 1, characterized in that, The step of creating the transmission link corresponding to the IPSec-VPN based on the VPN transmission network data and creating the IPSec-VPN based on the VPN configuration data includes: The VPN gateway port and transmission port in the VPN transmission network data are parsed out; Create the target tap devices corresponding to the VPN gateway port and the transport port; Bind the target tap device to the OVS of the VPN gateway node; An ip-table is created based on the VPN configuration data. The ip-table is used for Layer 3 forwarding and IPSec encryption / decryption, as well as encryption / decryption encapsulation processing. Create a host-tap device corresponding to the target tap device; Configure the host-tap device in the ip-table and connect the host-tap device to the target tap device; Configure IKE and start IKE negotiation; Based on the IKE negotiation results, an IPsec-SA is generated. The IPsec-SA is used to transmit encrypted and decrypted data for VPN traffic packets. An IPIP tunnel interface is generated based on the IKE negotiation results. The IPIP tunnel interface is used to send and receive VPN traffic packets and to encapsulate and decapsulate the packets. Bind the IPIP tunnel interface to the host-tap device; Based on the VPN configuration data, a routing route is issued in the ip-table to transmit cloud host packets through the transmission port and the IPIP tunnel interface.

3. The method according to claim 1, characterized in that, Before determining whether a VPN creation command sent by ovn-vpnaas has been received, the process also includes: The status of the VPN gateway node is detected, and the detection result is obtained; The detection results are stored in ovn-sb so that ovn-vpnaas can determine whether to send the VPN creation command to the VPN gateway node based on the detection results.

4. The method according to claim 3, characterized in that, After detecting the status of the VPN gateway node and obtaining the detection result, the process further includes: Determine the timestamp of the generation of the detection result; The generated timestamp is stored in ovn-sb.

5. A VPN implementation method based on OVN architecture, characterized in that, The ovn-vpnaas application in the OpenStack cloud platform includes: Detect whether the VPN in the OpenStack cloud platform is faulty; If a VPN failure is detected, VPN configuration data and VPN transport network data are generated. Write the VPN configuration data and the VPN transmission network data into ovn-nb; Generate VPN creation instructions; Select one VPN gateway node from among multiple VPN gateway nodes in the OpenStack cloud platform and send the VPN creation command to the selected VPN gateway node, so that the VPN gateway node obtains the VPN configuration data and the VPN transmission network data from ovn-nb, creates the transmission link corresponding to IPSec-VPN according to the VPN transmission network data, and creates IPSec-VPN according to the VPN configuration data.

6. The method according to claim 5, characterized in that, The step of selecting one VPN gateway node from multiple VPN gateway nodes in the OpenStack cloud platform and sending the VPN creation command to the selected VPN gateway node includes: Read the detection results stored in each VPN gateway node from ovn-sb; Based on the test results, VPN gateway nodes that are not faulty are selected; Select one of the non-faulty VPN gateway nodes and send the VPN creation command to the selected VPN gateway node.

7. The method according to claim 5, characterized in that, The generation of VPN configuration data and VPN transport network data includes: Use the ml2 plugin to create the VPN gateway port, transport network, transport subnet, and transport port; The VPN gateway port, the transmission network, the transmission subnet, and the transmission port are used as the VPN transmission network data; Call ovn-router to associate the transmission subnet with the router where the cloud host is located, and create a router interface; Based on the router interface, determine the routing route to divert cloud host traffic from the compute node to the selected VPN gateway node; Add the redirection route to the VPN configuration data.

8. A VPN implementation system based on the OVN architecture, characterized in that, VPN gateway nodes used in OpenStack cloud platforms, including The first judgment module is used to determine whether a VPN creation instruction sent by ovn-vpnaas has been received. The VPN creation instruction includes the instruction generated by ovn-vpnaas after detecting a VPN failure. The first processing module is configured to, in response to receiving the VPN creation instruction, obtain VPN configuration data and VPN transmission network data from ovn-nb, wherein the VPN configuration data and the VPN transmission network data are generated by ovn-vpnaas; The first creation module is used to create a transmission link corresponding to the IPSec-VPN based on the VPN transmission network data; and to create the IPSec-VPN based on the VPN configuration data.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the VPN implementation method based on the OVN architecture as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the VPN implementation method based on the OVN architecture as described in any one of claims 1 to 7.

Images