A method and controller for constructing a virtual-real network range platform

Abstract

The present invention discloses a method and controller for constructing a virtual-real network range platform. The method includes: connecting physical devices to the network range platform through an SDN switch, and connecting the trunk port of the SDN switch to the target physical network card of the network range platform; mounting the target physical network card to a virtual bridge; mapping the port of the physical device to the port of the physical device mapping template; connecting one end of the tap network card to the virtual device and the other end to the integrated bridge; creating a first port on the logical switch, associating the virtual device port to the first port; associating the port of the physical device mapping template to the second port; and connecting the integrated bridge and the virtual bridge together using the physical device mapping template. This solution realizes efficient and large-scale networking of virtual devices and physical devices in the network range platform, and has good network performance. In addition, through port sharing, the sharing requirements of physical devices are realized.

Description

Technical Field

[0001] The present invention relates to the technical field of network range platform construction, and in particular to a method and a controller for constructing a virtual-real network range platform. Background Art

[0002] As an important infrastructure supporting cyberspace security technology verification, cyber weapon equipment testing, attack and defense confrontation exercises, and network risk assessment, the cyber range platform has become an important means of building emerging cyber security strategies and professional talent teams. The cyber range platform is specifically a network physical experimental environment, which is a physical network simulation environment for testing or training purposes. It is designed and provides different scenarios and topologies for experimental operations.

[0003] However, in the construction of network simulation experiment scenarios, it is difficult to realize virtual simulation of complex physical terminals, and physical terminals need to be accessed. However, the existing access methods are complex to deploy and have bottlenecks in network performance, making them difficult to apply to large-scale network scenarios. Summary of the invention

[0004] The present invention aims to at least solve the technical problems existing in the prior art. To this end, the first aspect of the present invention proposes a method for constructing a virtual-real network range platform, which is applied to a controller of the network range platform. The method comprises:

[0005] After detecting that the user connects the port of the physical device and the SDN switch with a network cable, the physical device is connected to the network range platform through the SDN switch, and the trunk port of the SDN switch is connected to the target physical network card of the network range platform;

[0006] Creating a virtual network bridge, and mounting the target physical network card to the virtual network bridge;

[0007] Creating a physical device mapping template, and mapping the port of the physical device to the port of the physical device mapping template;

[0008] Create and start multiple virtual devices and tap network cards, and connect one end of the tap network card to the virtual device and the other end to the integrated network bridge of the pre-created virtual environment;

[0009] Create a logical switch, create a first port on the logical switch, and associate a virtual device port with the first port; the virtual device port is a connection port between the tap network card and the integrated bridge;

[0010] Creating a second port on the logical switch, and associating the port of the physical device mapping template with the second port;

[0011] The integration bridge and the virtual bridge are connected together using the physical device mapping template, so that the physical device communicates with the plurality of virtual devices.

[0012] Optionally, after mapping the port of the physical device to the port of the physical device mapping template, the method further includes:

[0013] Creating a plurality of network namespaces and virtual Ethernet devices, and connecting one end of the virtual Ethernet device to the network namespace and the other end to an integrated bridge of a pre-created virtual environment;

[0014] Create a logical switch, create a third port on the logical switch, and associate a network namespace port with the third port; the network namespace port is a connection port between the virtual Ethernet device and the integrated bridge;

[0015] Creating a fourth port on the logical switch, and associating the port of the physical device mapping template with the fourth port;

[0016] The integrated bridge and the virtual bridge are connected together using the physical device mapping template so that the physical device communicates with the multiple network namespaces.

[0017] Optionally, before connecting the physical device to the network range platform through the SDN switch, the method further includes:

[0018] Deploy SDN virtualization components on a physical server to build a virtual environment; the virtualization components include a virtual switch and an SDN controller;

[0019] Create an integration bridge.

[0020] Optionally, connecting the physical device to the network range platform through the SDN switch includes:

[0021] Plan and configure the virtual LAN of SDN switches through VLAN technology;

[0022] According to the planning and configuration of the virtual local area network, different VLAN tags are configured for the ports of the SDN switch accessing the physical device;

[0023] Connect the TrunK port of the SDN switch to the target physical network card of the server where the network range platform is deployed to connect the physical device to the network range platform.

[0024] Optionally, after the integrated network bridge and the virtual network bridge are connected together by using the physical device mapping template so that the physical device communicates with the plurality of virtual devices, the method further includes:

[0025] The usage of node resources is detected in real time, and the virtual device and the port mapped to the physical device on the physical device mapping template are dynamically adjusted according to the usage.

[0026] A second aspect of the present invention provides a controller for a network range platform, the controller comprising:

[0027] An access module is used to connect the physical device to the network range platform through the SDN switch after detecting that the user connects the port of the physical device to the SDN switch with a network cable, and connect the trunk port of the SDN switch to the target physical network card of the network range platform;

[0028] A first creation module, used for creating a virtual network bridge and mounting the target physical network card to the virtual network bridge;

[0029] A second creation module is used to create a physical device mapping template and map the port of the physical device to the port of the physical device mapping template;

[0030] A third creation module is used to create and start multiple virtual devices and tap network cards, and connect one end of the tap network card to the virtual device and the other end to the integrated network bridge of the pre-created virtual environment;

[0031] A first association module is used to create a logical switch, create a first port on the logical switch, and associate a virtual device port with the first port; the virtual device port is a connection port between the tap network card and the integrated bridge;

[0032] A second associating module, configured to create a second port on the logical switch and associate the port of the physical device mapping template with the second port;

[0033] The first connection module is used to connect the integrated bridge and the virtual bridge together by using the physical device mapping template, so that the physical device can communicate with the multiple virtual devices.

[0034] Optionally, the controller further includes:

[0035] A fourth creation module, used to create a plurality of network namespaces and virtual Ethernet devices, and connect one end of the virtual Ethernet device to the network namespace and the other end to an integrated bridge of a pre-created virtual environment;

[0036] A third association module is used to create a logical switch, create a third port on the logical switch, and associate a network namespace port with the third port; the network namespace port is a connection port between the virtual Ethernet device and the integrated bridge;

[0037] A fourth association module, configured to create a fourth port on the logical switch and associate the port of the physical device mapping template with the fourth port;

[0038] The second connection module is used to connect the integrated bridge and the virtual bridge together by using the physical device mapping template, so that the physical device can communicate with the multiple network namespaces.

[0039] The controller further comprises:

[0040] A deployment module, used to deploy SDN virtualization components on a physical server to build a virtual environment; the virtualization components include a virtual switch and an SDN controller;

[0041] The bridge creation module is used to create an integration bridge.

[0042] A third aspect of the present invention provides an electronic device, comprising a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the method for constructing a virtual-real network target range platform as described in the first aspect.

[0043] A fourth aspect of the present invention proposes a computer-readable storage medium, wherein the storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by a processor to implement the method for constructing a virtual-real network target range platform as described in the first aspect.

[0044] The embodiments of the present invention have the following beneficial effects:

[0045] In an embodiment of the present invention, after detecting that a user connects a port of a physical device and an SDN switch with a network cable, the physical device is connected to a network range platform through the SDN switch, and the trunk port of the SDN switch is connected to a target physical network card of the network range platform; a virtual bridge is created, and the target physical network card is mounted to the virtual bridge; a physical device mapping template is created, and the port of the physical device is mapped to the port of the physical device mapping template; multiple virtual devices and tap network cards are created and started, and one end of the tap network card is connected to the virtual device, and the other end is connected to an integrated bridge of a pre-created virtual environment; a logical switch is created, and a first port is created on the logical switch, and the virtual device port is associated with the first port; the virtual device port is a connection port between the tap network card and the integrated bridge; a second port is created on the logical switch, and the port of the physical device mapping template is associated with the second port; the integrated bridge and the virtual bridge are connected together using the physical device mapping template so that the physical device communicates with the multiple virtual devices. This solution realizes efficient large-scale networking of virtual devices and physical devices in the network range platform, with good network performance. In addition, one physical port allows multiple virtual devices to communicate through the same physical network connection port, reducing the demand for physical ports, so that the same physical device can support multiple users to conduct experiments at the same time, and each user has an independent virtual environment. Through port sharing, the sharing needs of physical devices are realized, the construction and management of the network range are optimized, and the overall efficiency and economy are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a flowchart of the steps of a method for constructing a virtual-real network range platform provided by an embodiment of the present invention;

[0047] Figure 2 It is a schematic diagram of connecting a physical device to a network range platform through an SDN switch provided by an embodiment of the present invention;

[0048] Figure 3 It is an architecture diagram of a network range platform provided by an embodiment of the present invention;

[0049] Figure 4 It is an architecture diagram of another network range platform provided by an embodiment of the present invention;

[0050] Figure 5 It is a structural block diagram of a controller of a network range platform provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present disclosure, unless otherwise specified, "multiple" means two or more. In addition, the use of "based on" or "according to" means openness and inclusiveness, because the process, steps, calculations or other actions "based on" or "according to" one or more of the conditions or values ​​may be based on additional conditions or values ​​beyond the described values ​​in practice.

[0053] The inventors found in the process of studying related technologies that in the construction of network simulation experiment scenarios, it is difficult to realize virtual simulation of complex physical terminals, and physical terminals need to be accessed. However, the existing access methods are complex to deploy and have bottlenecks in network performance, making them difficult to apply to large-scale network scenarios.

[0054] Specifically, the main problems of the existing access methods are as follows:

[0055] (1) Deployment complexity. The combination of virtual environment and physical devices requires precise configuration to ensure seamless communication between the two. Configuration errors may cause the system to fail to operate normally. Different virtualization platforms and physical devices may have compatibility issues, resulting in integration difficulties.

[0056] (2) Low resource utilization. The procurement cost is high, and each experiment or task requires a dedicated physical interface. The number of interfaces is limited and cannot be flexibly expanded according to demand, resulting in limited expansion capabilities. The configuration is inflexible and the interface configuration cannot be flexibly adjusted according to different experimental requirements, resulting in reduced flexibility of the experimental environment.

[0057] In order to effectively solve the above problems, the present disclosure proposes a method for constructing a network range platform that combines virtual and real, which can realize efficient large-scale networking of virtual instances and physical terminals in the cloud platform, has good network performance, and can also save resources and reduce costs. Through port sharing, the sharing needs of physical devices are realized, the construction and management of the network range platform are optimized, and the overall efficiency and economy are improved.

[0058] Figure 1This is a flowchart of the steps of a method for building a virtual-real network range platform provided by an embodiment of the present invention. Figure 1 As shown, the method is applied to the controller of the network range platform, comprising the following steps:

[0059] Step 101: After detecting that a user connects a port of a physical device and an SDN switch with a network cable, connect the trunk port of the SDN switch to a target physical network card of the network range platform.

[0060] Physical equipment mainly includes various physical devices connected to the target range network, such as intrusion detection systems (IDS), firewalls, routers and intrusion prevention systems (IPS).

[0061] SDN switches, also known as virtual-real switches, play a key role in network architecture and are mainly used to connect physical devices and virtual networks to ensure seamless communication between the two. Through virtual local area network (VLAN) technology, virtual-real switches can effectively isolate communications between different physical ports. There are many types of SDN switches, such as physical SDN switches that support the openFlow protocol: H3C, RuiJie; virtual OpenVswitch, etc. This disclosure uses physical SDN switches.

[0062] The cyber range platform is specifically a cyber physical experimental environment, which is a physical network simulation environment used for testing or training purposes. It is designed and provides different scenarios and topologies for experimental operations.

[0063] The physical network interface card (NIC) of a physical server is the interface between the server and the network. Its specific functions include:

[0064] Data transmission: responsible for transmitting data packets between the server and the external network.

[0065] Network connection: Provides a wired (such as Ethernet) or wireless (such as Wi-Fi) network connection.

[0066] Protocol support: Support multiple network protocols, such as TCP / IP, UDP, etc.

[0067] The method of connecting physical devices to SDN switches is the same as the actual networking, which is to connect the physical device port and the SDN switch with a network cable. When the controller of the network range platform detects that the physical device and the SDN switch are connected, the trunk port of the SDN switch is connected to the target physical network card of the network range platform. In this way, the physical device is connected to the network range platform through the SDN switch.

[0068] Figure 2It is a schematic diagram of connecting a physical device to a network range platform through an SDN switch provided by an embodiment of the present invention.

[0069] like Figure 2 As shown, physical device 1, physical device 2, and physical device 3 are connected to the physical SDN switch through network cables, and the trunk port of the physical SDN switch is connected to the eth0 network card of the network target range platform. In this way, physical device 1, physical device 2, and physical device 3 are connected to the network target range platform through the SDN switch.

[0070] Step 102: Create a virtual network bridge, and mount the target physical network card to the virtual network bridge.

[0071] After connecting the physical device to the network range platform, you can implement the steps of connecting the virtual device to the network range platform. First, you need to create a virtual bridge Br-phy and mount the target physical network card to the virtual bridge.

[0072] Specifically, use the ovs basic command to create a virtual bridge. The creation command is: ovs-vsctl add-br br-phy.

[0073] The command to mount the target physical network card to the virtual bridge is: ovs-vsctl add-port br-phy eth0.

[0074] Among them, eth0 is the target physical network card.

[0075] Figure 3 It is an architecture diagram of a network range platform provided in an embodiment of the present invention.

[0076] like Figure 3 As shown, the physical network card of the network range platform is eth0, which is connected to the trunk port of the SDN switch and mounted on the virtual bridge Br-phy.

[0077] Step 103: Create a physical device mapping template, and map the ports of the physical device to the ports of the physical device mapping template.

[0078] The physical device mapping template (patch port) includes multiple virtual network ports, which can map the connected physical device ports and SDN switch ports 1:1 to the corresponding virtual network interfaces. In this way, the physical device ports are virtualized, making it easier to connect to the virtual devices later.

[0079] Assume that the connected physical device is a physical firewall, and the physical firewall is connected to interface 1. A physical device mapping template corresponding to interface 1 will be created inside the physical server.

[0080] The physical device mapping template port is actually the ovs port, and its type is patch-port. Create a physical device mapping template and map the physical device port to the physical device mapping template port. The command example is as follows:

[0081] ovs-vsctl add-port br-phy patch-br-br1 -- set interface patch-br-br1, type=patch options:pair=patch-br-br1-1

[0082] ovs-vsctl add-port br-phy patch-br-br2 -- set interface patch-br-br2, type=patch options:pair=patch-br-br2-2

[0083] Among them, patch-br-br1 and patch-br-br2 are two ports of physical device mapping template 1 and physical device mapping template 2 respectively.

[0084] Reference Figure 3 , the physical device mapping template 1 and the physical device mapping template 2 can both connect to the virtual bridge Br-phy and the integrated bridge Br-int to connect the entire virtual link.

[0085] Step 104: Create and start multiple virtual devices and tap network cards, and connect one end of the tap network card to the virtual device and the other end to the integrated network bridge of the pre-created virtual environment.

[0086] The virtual devices of the cyber range include servers, network devices, and client devices.

[0087] ‌Server:‌ One or more servers are required to establish a network range. These servers can be physical machines or virtual machines, depending on actual needs. ‌ A server can host multiple virtual machines, each of which can run a different operating system and application, allowing the range to simulate a variety of attack scenarios.

[0088] ‌Network equipment: Building a network range requires some network equipment, such as switches, routers, firewalls, etc. ‌These devices can help isolate the range and production environment, ensuring that attacks on the range will not affect the production environment. ‌

[0089] Client Devices: Some client devices (e.g., laptops) are required, which can be used to simulate attackers or victims, allowing students to simulate attack and defense behaviors.

[0090] The user submits a network topology diagram for networking through the management platform, which includes the virtual devices needed. The network range platform creates the required virtual devices based on the network topology diagram.

[0091] A TAP interface is a virtual network interface used to transfer data between user space and kernel space. TAP interfaces are very common in virtual networks and virtualization environments. They are mainly used to simulate network devices and implement network communication between virtual machines or containers.

[0092] Specifically, multiple virtual devices refer to two or more virtual devices. The way to create a virtual device VM is: first, install and load the KVM module: modprobe kvm, and then install the third-party package qemu: yum install qemu-kvm.

[0093] After installing the basic environment, we use the ip command to create a TAP network card. Assume that we create a TAP network card named tap0: sudo ip tuntap add dev tap0 mode tap, sudo ip link settap0 up. Mount one end of the created tap0 network card to the integrated bridge Br-int.

[0094] When starting the virtual device, use the tap0 network card as the network interface of the virtual device. Assuming that the image file of the virtual device is vm-image.qcow2, the way to start the virtual device is:

[0095] sudo qemu-system-x86_64 -m 2048 -smp 2 -hda vm-image.qcow2 \

[0096] -netdev tap,id=net0,ifname=tap0,script=no,downscript=no \

[0097] -device virtio-net-pci,netdev=net0

[0098] -m 2048: Allocate 2GB of memory to the virtual device.

[0099] -smp 2: Allocate 2 CPU cores to the virtual device.

[0100] -hda vm-image.qcow2: specifies the hard disk image file of the virtual device.

[0101] -netdev tap,id=net0,ifname=tap0,script=no,downscript=no: Configure a TAP network device (that is, connect one end of the tap network card to the virtual device). The virtual device is now started successfully.

[0102] Reference Figure 3 , VM1 and VM2 are created virtual devices, Tap0 and Tap2 are created tap network cards. One end of Tap0 is connected to VM1, and the other end is connected to br-int; one end of Tap2 is connected to VM2, and the other end is connected to br-int.

[0103] The integrated bridge br-int is an internal bridge in Open vSwitch (OVS). Generally, br-int is automatically created after ovs is deployed and installed. The basic creation command is: ovs-vsctl add-br br-int.

[0104] For physical devices, we only connected one physical port. After connection, we mapped two virtual ports VM1 and VM2. Then we can build a network topology for these two virtual ports to achieve the effect of sharing the physical interface.

[0105] Step 105: create a logical switch, create a first port on the logical switch, and associate a virtual device port with the first port; the virtual device port is a connection port between the tap network card and the integrated bridge.

[0106] Logical Switch is a core component in virtual network, used to forward data packets between virtual machines (VM), containers or other virtual network devices. It is specifically used to connect interfaces (Tap network cards) of virtual machines (VM), containers (netns) or other virtual network devices. Logical ports play a key role in virtual networks, similar to the ports of physical SDN switches.

[0107] To connect a virtual device to a physical device mapping template port and further communicate with the physical device, you must create logical switch ports corresponding to the respective ports and then communicate through the logical switch.

[0108] Specifically, use the ovn-nbctl command to create a logical switch: ovn-nbctl ls-add ls1. Then, create the first port ISP0 on the logical switch, and associate the virtual device port veth0 with the first port ISP0.

[0109] Reference Figure 3 The virtual device port is the connection port veth0 between the tap network card and the integrated bridge Br-int. The first port on the logical switch is ISP0, and the veth0 port is connected to the ISP0 port.

[0110] Step 106: Create a second port on the logical switch, and associate the port of the physical device mapping template with the second port.

[0111] A physical device mapping template port pair is created: patch-br-br1-1, and the port of the physical device mapping template is associated with the second port, that is, the port patch-br-br1-1 is associated with the second port.

[0112] Reference Figure 3 , the second port is the ISP1 port on the logical switch.

[0113] Step 107: Use the physical device mapping template to connect the integrated bridge and the virtual bridge together, so that the physical device communicates with the multiple virtual devices.

[0114] In Open vSwitch (OVS), physical device mapping template patch ports are a special type of port used to connect two OVS bridges together.

[0115] Reference Figure 3 , physical device mapping template 1 and physical device mapping template 2 connect the virtual bridge Br-phy and the integrated bridge Br-int together.

[0116] Specifically, the following command is used on br-int to connect the integrated bridge and the virtual bridge by using the physical device mapping template: sudo ovs-vsctl add-port br-int patch-br-br1-1 -- setinterface patch-br-br1-1 type=patch options:peer=patch-br-br1.

[0117] Reference Figure 3 , a physical device maps two virtual ports patch-br-br1 and patch-br-br2, and the two virtual ports build corresponding network topologies respectively.

[0118] This solution realizes large-scale networking of virtual devices and physical devices, and has good network performance. In addition, one physical port allows multiple virtual devices to communicate through the same physical network connection port, reducing the demand for physical ports, so that the same physical device can support multiple users to conduct experiments at the same time, and each user has an independent virtual environment. It reduces the cost of purchasing and maintaining a large number of physical devices, and reduces the cost of physical space and power consumption. Through port sharing, the sharing needs of physical devices are realized, the construction and management of the network target range are optimized, and the overall efficiency and economy are improved.

[0119] In summary, in an embodiment of the present invention, after detecting that a user connects the port of a physical device and an SDN switch with a network cable, the physical device is connected to a network range platform through the SDN switch, and the trunk port of the SDN switch is connected to the target physical network card of the network range platform; a virtual bridge is created, and the target physical network card is mounted to the virtual bridge; a physical device mapping template is created, and the port of the physical device is mapped to the port of the physical device mapping template; multiple virtual devices and tap network cards are created and started, and one end of the tap network card is connected to the virtual device, and the other end is connected to an integrated bridge of a pre-created virtual environment; a logical switch is created, and a first port is created on the logical switch, and the virtual device port is associated with the first port; the virtual device port is a connection port between the tap network card and the integrated bridge; a second port is created on the logical switch, and the port of the physical device mapping template is associated with the second port; the integrated bridge and the virtual bridge are connected together using the physical device mapping template so that the physical device can communicate with the multiple virtual devices. This solution realizes efficient large-scale networking of virtual devices and physical devices in the network range platform, with good network performance. In addition, one physical port allows multiple virtual devices to communicate through the same physical network connection port, reducing the demand for physical ports, so that the same physical device can support multiple users to conduct experiments at the same time, and each user has an independent virtual environment. Through port sharing, the sharing needs of physical devices are realized, the construction and management of the network range are optimized, and the overall efficiency and economy are improved.

[0120] In a possible implementation manner, after step 103, the method further includes:

[0121] Step 201: Create multiple network namespaces and virtual Ethernet devices, and connect one end of the virtual Ethernet device to the network namespace and the other end to an integrated bridge of a pre-created virtual environment.

[0122] In the method of building a virtual-real network range platform, the virtual device can be a virtual instance VM or a virtual network netns. The links of the two are the same, but the difference is that the startup methods of vm and netns are different. Netns is a component that comes with the Linux server kernel and can be created using Linux commands. VM needs to use the virtualization engine tool qemu to start.

[0123] Network Namespace (netns) is a network virtualization technology provided by the Linux kernel. It allows users to create multiple independent network stacks on the same host, so that each network namespace has its own network device, IP address, routing table, etc. In this way, multiple independent network devices can be simulated on the same physical host, and it is widely used in scenarios such as containerization, virtualization, and network isolation.

[0124] You can use the ip netns command to create a network namespace. For example, we create a network namespace called ns1: sudo ip netns add ns1.

[0125] Create a pair of virtual Ethernet devices (veth pair). The specific command is: sudo ip link add veth0type veth pair name veth1.

[0126] Move one end of the virtual Ethernet device (veth1) to the network namespace with the command: sudo ip linkset veth1 netns ns1. Configure the veth1 interface in the ns1 network namespace: sudo ip netns execns1 ip link set veth1.

[0127] Add the other end (veth2) interface of the virtual Ethernet device to the OVS bridge br-int with the command: sudoovs-vsctl add-port br-int veth2.

[0128] Figure 4 It is an architecture diagram of another network range platform provided by an embodiment of the present invention.

[0129] Reference Figure 4, netns1 and netns2 are created network namespaces, Veth-pair1 is a virtual Ethernet device, one end of Veth-pair1 is connected to netns1, and the other end is connected to br-int. Veth-pair2 is a virtual Ethernet device, one end of Veth-pair2 is connected to netns2, and the other end is connected to br-int.

[0130] Step 202: create a logical switch, create a third port on the logical switch, and associate a network namespace port with the third port; the network namespace port is a connection port between the virtual Ethernet device and the integrated bridge.

[0131] To connect the network namespace to the physical device mapping template port and further communicate with the physical device, you must create logical switch ports corresponding to the respective ports and then communicate through the logical switch.

[0132] Specifically, use the ovn-nbctl command to create a logical switch: ovn-nbctl ls-add ls1. Then, create a third port ISP3 on the logical switch and associate the network namespace port with the third port ISP3.

[0133] Step 203: Create a fourth port on the logical switch, and associate the port of the physical device mapping template with the fourth port.

[0134] Reference Figure 4 , create a fourth port ISP4 on the logical switch, and associate the physical device mapping template port to the fourth port ISP4.

[0135] Step 204: Use the physical device mapping template to connect the integrated bridge and the virtual bridge together, so that the physical device communicates with the multiple network namespaces.

[0136] Reference Figure 4 , physical device mapping template 1 and physical device mapping template 2 connect the virtual bridge Br-phy and the integrated bridge Br-int together.

[0137] exist Figure 4 In the example, a physical device maps two virtual ports, Patch-br-br1 and Patch-br-br2, and the two virtual ports respectively build corresponding network topologies.

[0138] In a possible implementation manner, before step 101, the method further includes:

[0139] Step 301: Deploy SDN virtualization components on a physical server to build a virtual environment; the virtualization components include a virtual switch and an SDN controller.

[0140] The overall technology of this solution depends on the SDN network. Before implementing this technical solution, it is necessary to build basic environmental dependencies.

[0141] Specifically, deploy SDN virtualization components on the physical server Centos, such as Open vSwitch (OVS) and SDN controller Open Virtual Network (OVN). The specific installation and deployment steps are as follows:

[0142] (1) Install ovs ovn:

[0143] sudo yum install -y https: / / www.rdoproject.org / repos / rdo-release.rpm

[0144] yum install -y openvswitch openvswitch-ovn

[0145] (2) Turn on the controller and start the ovs and ovn controller services

[0146] systemctl start openvswitch ovn-northd ovn-controller

[0147] (3) Configuring northbound and southbound databases

[0148] export master_ip=10.1.1.2ovn-nbctl set-connection ptcp:6641:$master_ip

[0149] ovn-sbctl set-connection ptcp:6642:$master_ip

[0150] Step 302: Create an integrated bridge.

[0151] After the SDN-related virtual environment is deployed and installed, an integrated bridge br-int is created by default.

[0152] br-int is the entry point for a virtual device or container’s virtual interface to connect to the OVN logical network. When a virtual device or container is created, a virtual network interface (such as a veth-pair or tap device) is connected to br-int, using br-int as a bridge between the logical network and the physical network.

[0153] In OVN, logical components such as logical switches and logical routers are connected to the physical network through br-int. Traffic from the physical network can enter the logical network through br-int, and similarly, traffic from the logical network can be sent to the physical network through br-int.

[0154] In a possible implementation, in step 101, connecting the physical device to the network range platform through the SDN switch includes:

[0155] Step 1011: Plan and configure the virtual local area network of the SDN switch through VLAN technology;

[0156] In the embodiment of the present invention, VLAN (Virtual Local Area Network) is a group of logical devices and users. These devices and users are not restricted by physical locations and can be organized according to factors such as functions, departments and applications. The communication between them is the same as if they are in the same network segment.

[0157] The switch port has two VLAN attributes, one is VLANID, and the other is VLANTAG, which correspond to setting VLAN tags for data packets and allowing VLANTAG (tagged) data packets to pass. Ports with different VLANIDs can build VLANs by allowing VLANTAG (VLAN tags) to pass through each other.

[0158] Step 1012: According to the planning and configuration of the virtual local area network, different VLAN tags are configured for the ports of the SDN switch accessing the physical device.

[0159] First, set the switch cascade port to Trunk mode, which allows the port to transmit data frames from multiple VLANs. In order to improve the device's processing efficiency for data frames, all data frames inside the device are tagged with VLAN tags so that the device can process these data frames in a unified manner.

[0160] Step 1013: connect the TrunK port of the SDN switch to the target physical network card of the server where the network range platform is deployed, so as to connect the physical device to the network range platform.

[0161] A Trunk port is used to connect switches or switches to routers. It can transmit data from multiple VLANs and use VLAN tags to distinguish data from different VLANs.

[0162] By connecting the TrunK port to the target physical network card of the server where the network range platform is deployed, the physical device can be connected to the network range platform.

[0163] like Figure 2 As shown, physical device 1, physical device 2, and physical device 3 are connected to the physical SDN switch through different VLAN tags: tag1, tag2, and tag3, and the SDN switch is connected to the network range platform through the target physical network card eth0.

[0164] In this way, at the physical level, port traffic isolation is achieved by configuring the VLAN tag of the SDN switch. At the virtualization level, VLAN tags are configured through the OpenVswitch flow table and the OVN logical switch port LSP. The same physical port can be mapped to multiple virtual LSPs and configured with different tags for isolation to prevent traffic loops between different users and avoid network paralysis.

[0165] In a possible implementation manner, after step 107, the method further includes:

[0166] The usage of node resources is detected in real time, and the virtual device and the port mapped to the physical device on the physical device mapping template are dynamically adjusted according to the usage.

[0167] In the embodiment of the present invention, the specific design process of automatically allocating ports for user networking is as follows:

[0168] a. User application: different users submit network topology through the management platform to build the specified topology nodes; b. Initial resource allocation: the controller dynamically allocates the ports mapped to the physical devices on the virtual device and physical device mapping template to the users according to the node resource usage; c. Create virtual links: according to the allocated devices and ports, the controller will automatically build virtual links according to the network topology submitted by the user to complete the network communication; d. Secondary resource dynamic adjustment: real-time monitoring of resource usage, and dynamic adjustment of resource allocation strategy according to usage. The resources here mainly refer to: ports mapped to the physical devices on the virtual device and physical device mapping template.

[0169] By adopting the strategy of dynamic resource adjustment and optimization, communication performance can be optimized and efficient operation of the system can be ensured.

[0170] In summary, this solution has the following beneficial effects:

[0171] 1. High resource utilization efficiency: Physical port sharing allows multiple virtual devices to communicate through the same physical network interface, reducing the demand for physical ports.

[0172] 2. Cost-effectiveness: Reduces the cost of purchasing and maintaining a large amount of physical equipment, and reduces the cost of physical space and power consumption.

[0173] 3. Multi-user support: The same physical device can support multiple users to conduct experiments at the same time, and each user has an independent virtual environment.

[0174] 4. Dynamic adjustment and optimization: The resource allocation of virtual devices and physical devices can be dynamically adjusted according to actual needs to optimize network performance.

[0175] Figure 5 1 is a block diagram of a controller of a network range platform provided by an embodiment of the present invention. Figure 5 As shown, the controller 400 includes:

[0176] The access module 401 is used to connect the physical device to the network range platform through the SDN switch after detecting that the user connects the port of the physical device to the SDN switch with a network cable, and connect the trunk port of the SDN switch to the target physical network card of the network range platform;

[0177] A first creation module 402, configured to create a virtual network bridge and mount the target physical network card to the virtual network bridge;

[0178] A second creation module 403, used to create a physical device mapping template, and map the port of the physical device to the port of the physical device mapping template;

[0179] The third creation module 404 is used to create and start multiple virtual devices and tap network cards, and connect one end of the tap network card to the virtual device and the other end to the integrated network bridge of the pre-created virtual environment;

[0180] A first association module 405 is used to create a logical switch, create a first port on the logical switch, and associate a virtual device port with the first port; the virtual device port is a connection port between the tap network card and the integrated bridge;

[0181] A second associating module 406, configured to create a second port on the logical switch and associate the port of the physical device mapping template with the second port;

[0182] The first connection module 407 is configured to connect the integrated bridge and the virtual bridge together by using the physical device mapping template, so that the physical device can communicate with the multiple virtual devices.

[0183] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0184] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0185] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that comply with the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0186] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for constructing a virtual-real network range platform, characterized in that: A controller applied to a network range platform, the method comprising: After detecting that the user connects the port of the physical device and the SDN switch with a network cable, the physical device is connected to the network range platform through the SDN switch, and the trunk port of the SDN switch is connected to the target physical network card of the network range platform; Creating a virtual network bridge, and mounting the target physical network card to the virtual network bridge; Creating a physical device mapping template, and mapping the port of the physical device to the port of the physical device mapping template; Create and start multiple virtual devices and tap network cards, and connect one end of the tap network card to the virtual device and the other end to the integrated bridge of the pre-created virtual environment; Create a logical switch, create a first port on the logical switch, and associate a virtual device port with the first port; the virtual device port is a connection port between the tap network card and the integrated bridge; Creating a second port on the logical switch, and associating the port of the physical device mapping template with the second port; The integration bridge and the virtual bridge are connected together using the physical device mapping template, so that the physical device communicates with the plurality of virtual devices.

2. The method according to claim 1, characterized in that After mapping the port of the physical device to the port of the physical device mapping template, the method further includes: Creating a plurality of network namespaces and virtual Ethernet devices, and connecting one end of the virtual Ethernet device to the network namespace and the other end to an integrated bridge of a pre-created virtual environment; Create a logical switch, create a third port on the logical switch, and associate a network namespace port with the third port; the network namespace port is a connection port between the virtual Ethernet device and the integrated bridge; Creating a fourth port on the logical switch, and associating the port of the physical device mapping template with the fourth port; The integrated bridge and the virtual bridge are connected together using the physical device mapping template so that the physical device communicates with the multiple network namespaces.

3. The method according to claim 1, characterized in that: Before the physical device is connected to the network range platform through the SDN switch, the method further includes: Deploy SDN virtualization components on a physical server to build a virtual environment; the virtualization components include a virtual switch and an SDN controller; Create an integration bridge.

4. The method according to claim 1, characterized in that The step of connecting the physical device to the network range platform through the SDN switch includes: Plan and configure the virtual LAN of SDN switches through VLAN technology; According to the planning and configuration of the virtual local area network, different VLAN tags are configured for the ports of the SDN switch accessing the physical device; Connect the TrunK port of the SDN switch to the target physical network card of the server where the network range platform is deployed to connect the physical device to the network range platform.

5. The method according to claim 1, characterized in that After the integration bridge and the virtual bridge are connected together by using the physical device mapping template so that the physical device communicates with the plurality of virtual devices, the method further includes: The usage of node resources is detected in real time, and the virtual device and the port mapped to the physical device on the physical device mapping template are dynamically adjusted according to the usage.

6. A controller for a network range platform, characterized in that: The controller comprises: An access module is used to connect the physical device to the network range platform through the SDN switch after detecting that the user connects the port of the physical device to the SDN switch with a network cable, and connect the trunk port of the SDN switch to the target physical network card of the network range platform; A first creation module, used for creating a virtual network bridge and mounting the target physical network card to the virtual network bridge; A second creation module is used to create a physical device mapping template and map the port of the physical device to the port of the physical device mapping template; A third creation module is used to create and start multiple virtual devices and tap network cards, and connect one end of the tap network card to the virtual device and the other end to the integrated network bridge of the pre-created virtual environment; A first association module is used to create a logical switch, create a first port on the logical switch, and associate a virtual device port with the first port; the virtual device port is a connection port between the tap network card and the integrated bridge; A second associating module, configured to create a second port on the logical switch and associate the port of the physical device mapping template with the second port; The first connection module is used to connect the integrated bridge and the virtual bridge together by using the physical device mapping template, so that the physical device can communicate with the multiple virtual devices.

7. The controller according to claim 6, characterized in that: The controller further comprises: A fourth creation module, used to create a plurality of network namespaces and virtual Ethernet devices, and connect one end of the virtual Ethernet device to the network namespace and the other end to an integrated bridge of a pre-created virtual environment; A third association module is used to create a logical switch, create a third port on the logical switch, and associate a network namespace port with the third port; the network namespace port is a connection port between the virtual Ethernet device and the integrated bridge; A fourth association module, configured to create a fourth port on the logical switch and associate the port of the physical device mapping template with the fourth port; The second connection module is used to connect the integrated bridge and the virtual bridge together by using the physical device mapping template, so that the physical device can communicate with the multiple network namespaces.

8. The controller according to claim 6, characterized in that: The controller further comprises: A deployment module, used to deploy SDN virtualization components on a physical server to build a virtual environment; the virtualization components include a virtual switch and an SDN controller; The bridge creation module is used to create an integration bridge.

9. An electronic device, characterized in that: The electronic device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the method for constructing a virtual-real combined network target range platform as described in any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set are loaded and executed by the processor to implement the method for constructing a virtual-real network target range platform as described in any one of claims 1 to 5.

Images