Multi-tenant VPC private network configuration method

Abstract

The invention provides a multi-tenant VPC private network configuration method, which comprises the following steps that: a configuration management platform acquires a VPC configuration request, and according to the VPC configuration request, a corresponding regional controller configures an internal logic switch, a logic router and a gateway router to be connected with each other; the gateway router is connected with a preset exit network in the configuration request, creates an NAT rule and forms a VPC network environment corresponding to the request, the VPC network is high in isolation, each tenant can have special private network resources, and there is no need to worry about conflicts with other tenants or safety problems; kVM and Docker service requests are obtained through a VPC network environment, and a corresponding control area controller creates a logic port according to the requests and binds request address information; all the physical servers in the corresponding areas create KVM and Docker services and bind corresponding logic port information, and the network deployment and maintenance are simplified through standardized and automatic network configuration and logic interfaces.

Description

Technical Field

[0001] The present invention relates to the field of network and virtualization technology, and in particular to a multi-tenant VPC private network configuration method. Background Art

[0002] Network Function Virtualization (NFV) and Software Defined Network (SDN) are key factors driving the development of multi-tenant network technologies. NFV allows network functions (such as firewalls, load balancers) to run in software rather than relying on traditional hardware devices. SDN provides a more flexible way to manage and configure networks by separating the network control layer from the data forwarding layer. These two technologies enable cloud service providers to provide highly customized and isolated network environments for different tenants. With the rise of cloud-native applications, traditional network function virtualization (NFV) is transforming into cloud-native network functions (CNF). CNF uses containerization, microservices architecture, continuous integration / continuous deployment (CI / CD) and declarative APIs to improve the flexibility, scalability and maintainability of network services. This transformation enables network services to better adapt to dynamically changing cloud environments and improves the speed and efficiency of deploying network functions.

[0003] Traditional network configuration often relies on manual operations, which is not only inefficient but also prone to errors. Although some modern network technologies (such as SDN) provide more advanced automation capabilities, in some cases they still lack seamless integration with cloud-native environments and container orchestration tools. In a multi-tenant environment, it is critical to ensure network isolation and security. Traditional network technologies may rely on complex VLAN configurations or physical isolation methods to achieve isolation between tenants. These methods are not only cumbersome to configure, but also difficult to scale, especially in cloud environments and large-scale deployment scenarios. Traditional network virtualization technology may introduce additional processing overhead, affecting the forwarding efficiency of data packets. In high-density deployments or high-throughput scenarios, this may become a performance bottleneck and is highly dependent on hardware devices. Summary of the invention

[0004] In order to overcome the deficiencies of the prior art, the present invention provides a multi-tenant VPC private network configuration method.

[0005] In order to achieve the above object, the present invention provides a multi-tenant VPC private network configuration method, the specific steps include:

[0006] The configuration management platform obtains the VPC configuration request. According to the VPC configuration request, the corresponding regional controller configures the internal logical switches, logical routers, and gateway routers to connect with each other.

[0007] The gateway router connects to the egress network preset in the configuration request, creates NAT rules, and forms the VPC network environment corresponding to the request;

[0008] The KVM and Docker service requests are obtained through the VPC network environment. The corresponding control area controller creates a logical port based on the request and binds the request address information. All physical servers in the corresponding area create KVM and Docker services and bind the corresponding logical port information.

[0009] Preferably, the NAT rule is to convert the private network address in the request into a public network address.

[0010] Preferably, when the configuration management platform obtains a VPC configuration request, it obtains the address of the tenant in the request and sends the tenant address to the corresponding regional controller. After the corresponding regional controller obtains the tenant address, it executes a script command to create a VPC network corresponding to the tenant.

[0011] Preferably, the request address information includes a tenant ID and a MAC address.

[0012] Preferably, when a tenant accesses KVM or Docker services, the configuration management platform obtains the tenant's access request and initiates a dynamic address binding request to the corresponding regional controller. The corresponding regional controller allocates a preset address according to the instruction control node and binds the corresponding service. The regional controller feeds back the binding result to the configuration management platform.

[0013] Preferably, the physical server allocates the preset address in the following manner:

[0014] The physical server verifies the private address information generated by the tenant when purchasing the designated area through the database;

[0015] When the tenant purchases services again in the designated area, the physical server searches the database through the API script and selects unused addresses to allocate to the newly purchased services.

[0016] Compared with the prior art, the multi-tenant VPC private network configuration method provided by the present invention has the following beneficial effects:

[0017] 1. According to tenant needs, build a tenant-specific virtual network environment formed by logical switches, logical routers, and gateway router devices. The functions in the virtual network environment are implemented in a software-defined manner without relying on dedicated hardware, which improves the flexibility and configurability of network services.

[0018] 2. Each virtual network environment is isolated from each other, which can ensure that the network traffic between different tenants in a multi-tenant environment is completely isolated, and can meet the high security and isolation requirements of cloud service providers and large enterprises.

[0019] 3. The virtual network environment is implemented using open source OVN network technology and can be deployed and used under any Linux system without being restricted by the platform.

[0020] 4. By creating standard logical ports and protocols, it can be seamlessly integrated with existing network management tools and automation frameworks, supporting automated network configuration, deployment and maintenance, greatly improving the efficiency and accuracy of network management. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 A flowchart of creating a tenant VPC network environment provided by the present invention;

[0022] Figure 2 A flowchart of creating KVM and Docker services provided by the present invention;

[0023] Figure 3 A flowchart of binding tenant dynamic IP provided by the present invention. DETAILED DESCRIPTION

[0024] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0025] like Figures 1 to 3 As shown, the present invention provides a multi-tenant VPC private network configuration method, the specific steps include:

[0026] The configuration management platform obtains the VPC configuration request. According to the VPC configuration request, the corresponding regional controller configures the internal logical switches, logical routers, and gateway routers to connect with each other.

[0027] The gateway router connects to the egress network preset in the configuration request, creates NAT rules, and forms the VPC network environment corresponding to the request;

[0028] The KVM and Docker service requests are obtained through the VPC network environment. The corresponding control area controller creates a logical port based on the request and binds the request address information. All physical servers in the corresponding area create KVM and Docker services and bind the corresponding logical port information.

[0029] Specifically, when the tenant configures the network environment, the tenant first activates and purchases the network of the specified area through the configuration management platform. After the purchase is completed, the tenant enters the customized VPC configuration information on the configuration management platform, such as IP address, mac address (network device address) and export network information. The configuration management platform then sends the tenant's configuration information to the regional controller of the specified area for environmental network configuration. The regional controller configures the VPC network environment according to the configuration request, that is, initializes the creation of virtual logical switches, logical routers and gateway routers. The logical switches, logical routers and gateway routers are interconnected to form a tenant-exclusive network environment. This network environment can be completely isolated from other tenants and does not affect each other. In the created gateway router, it connects to the preset export network according to the configuration request information, and creates the NAT rules corresponding to the tenant, thereby realizing the construction of a tenant-exclusive network environment.

[0030] After the VPC network environment is built, create a KVM or Docker service in the specified area. The configuration management platform sends a service creation request to the regional controller based on the tenant's request. The regional controller creates a logical port in the tenant's logical switch based on the instruction and binds the tenant's IP address and MAC address. The logical interface is a standard interface, which simplifies the deployment and maintenance of the VPC network.

[0031] In this embodiment, OVN (Open Virtual Network) is used to define and implement virtual networks. Among them, OVN uses standard network protocols and models (such as OpenFlow) to define and implement virtual networks. This standardization not only makes OVN compatible with a variety of network devices and software, but also facilitates integration with modern container orchestration systems, because these systems usually follow or support these standards, and adopts a centralized network configuration and management mode. All network policies and configurations are managed through a central controller (OVN Northbound). This design allows the update and application of network policies to be automated and can be quickly promoted throughout the data center, which is particularly important for the rapidly changing environment in the container orchestration system, because the creation and destruction of container instances are very frequent. Therefore, the present invention enables the tenant network to be closely integrated with the modern container orchestration system through the logical interface, and also supports automated network policies and micro-segmentation. Among them, micro-segmentation, that is, dividing the network segment at a finer granularity, provides an isolated network environment for each container or virtual machine instance, and this capability enables OVN to implement fine-grained network policies for each container application, including access control, traffic restriction and isolation.

[0032] In this embodiment, when the configuration management platform obtains a VPC configuration request, it obtains the address of the tenant in the request and sends the tenant address to the corresponding regional controller. After the corresponding regional controller obtains the tenant address, it executes the script command to create a VPC network corresponding to the tenant.

[0033] Specifically, after the tenant activates the VPC service in the required area through the configuration management platform, the configuration management platform performs the initialization operation of activating the service. The initialization operation is to call the API script to automatically obtain the tenant ID, so that the controller of the area selected by the tenant can obtain the tenant ID, and execute the script command while transmitting the ID data to create the tenant's private network. The configuration management platform provides tenants with cloud service procurement and network management functions, and can also display information about purchased services and network information.

[0034] In this embodiment, the logical switch simulates the function of a physical switch and provides a Layer 2 (data link layer) switching function in a virtual network, which allows virtual machines (VMs) or containers connected to it to communicate within the same logical network. The logical router provides a Layer 3 (network layer) routing function, allowing data packets to be forwarded between different logical switches or different networks. The logical router implements advanced network functions such as network address translation (NAT), routing policies, and firewall rules. A gateway router is a special type of logical router that connects a virtual network (through a logical switch and a logical router) and an external network (such as a physical network or the Internet). The logical switch provides NAT (network address translation) and external network access functions.

[0035] In this embodiment, the NAT rule is to convert the private network address in the request into a public network address.

[0036] Specifically, the specific rules of NAT rules are to NAT the user's private network to the public network through the gateway router so that the tenant can obtain a private network. Through NAT rules, tenants can configure the network according to their needs and generate a dedicated VPC network independent of other network environments with strong isolation.

[0037] In this embodiment, when creating a KVM or Docker service, in the OVN network, the network of the KVM or Docker container is virtualized by software defined network (SDN) technology. As part of SDN, OVN provides advanced network abstractions, such as logical switches and logical routers, to simulate the behavior of physical networks. Among them, advanced network abstraction refers to a method of implementing network functions and services in a software defined network (SDN) environment through software rather than traditional hardware configuration and management. Advanced network abstraction allows network administrators and applications to define, manage and operate network resources in a simpler and more flexible way without having to worry about the underlying physical details. In a traditional physical network environment, the network configuration and management of virtual machines (such as KVM virtual machines) or containers (such as Docker containers) are based on actual physical network devices and architectures. This means that in order to enable virtual machines or containers in these virtualization technologies to correctly communicate over the network, network administrators need to directly configure and manage network devices such as switches and routers at the physical level. When constructing KVM or Docker services, the present invention directly configures in the physical network, providing a guarantee for the accuracy of network communication.

[0038] In this embodiment, when a tenant obtains a KVM or Docker service request through the VPC network environment, the KVM or Docker service in the specified area is started, and a startup instruction is sent to the corresponding regional controller. After receiving the instruction, the corresponding regional controller creates a logical port on the logical switch of the corresponding tenant and binds the request address information. The request address information includes the tenant ID and MAC address. All physical servers in the area create KVM and Docker through OVN network technology, and bind the created logical port information, so as to enhance network security, prevent MAC and IP address spoofing, and accurately control network traffic. The tenant ID is bound to ensure the uniqueness of all components of the tenant's VPC private network.

[0039] In this embodiment, the reason why MAC and IP address spoofing can be prevented by using logical ports is that:

[0040] 1. Address binding: In the OVN network, each logical port is assigned one or more static IP addresses and a MAC address. These addresses are unique in the context of the logical switch, and the OVN controller is responsible for maintaining these binding relationships.

[0041] 2. Policy enforcement: When network traffic passes through the network managed by OVN, OVN verifies the legitimacy of the traffic based on these predefined binding relationships; if the source IP or MAC address of a packet does not match the binding it is sent from the logical port, OVN can reject the traffic, thereby preventing IP or MAC address spoofing attempts.

[0042] 3. Isolation and security policies: OVN allows the definition of fine-grained security policies that can be applied to specific logical ports or entire logical switches. Through these policies, administrators can further restrict communication between different virtual networks or ports to enhance network security.

[0043] In this embodiment, the reason why network traffic can be accurately controlled through logical ports is that:

[0044] 1. Flow tables and matching rules: OVN uses OpenFlow or similar technologies to set up flow tables on the underlying physical or virtual switches. These flow tables contain a series of matching rules and corresponding actions to accurately control each data packet passing through the switch.

[0045] 2. Logical topology: By defining logical switches, logical routers, and the connections between them, OVN can build complex network topologies at the logical level. This logical topology is decoupled from the physical network devices and layout, making the control of network traffic more flexible and efficient.

[0046] In this embodiment, the logical port is a virtual port of the KVM or Docker service connected to the logical switch, which is used to simulate the physical network connection in the virtual environment. By setting the logical port, the tenant's customized logical function can be used in the virtual network environment, breaking the dependence on hardware network devices in the existing network environment, realizing data interaction between cloud virtual environments, and improving the work efficiency of tenants.

[0047] The difference from existing ports and devices is that the existing logical ports are costly, the devices and manufacturers are diverse, and the network environment is usually composed of a variety of devices from different manufacturers, each of which may use its own proprietary protocols and management interfaces. Unlike traditional network devices, the OVN network and other SDN solutions in the present invention adopt a modern software architecture, which makes it easier for them to integrate new standards and protocols, and by separating the control plane (determining how data flows) from the data plane (actually forwarding data), network management is more flexible and centralized, and no longer dependent on physical network devices. Among them, other SDN solutions refer to OpenDaylight (ODL), ONOS, Cisco ACI, VMware NSX and other solutions. Therefore, the present invention can be seamlessly integrated with existing network management tools and automation frameworks through standardized logical interfaces and protocols, supports automated network configuration, deployment and maintenance, and greatly improves the efficiency and accuracy of network management.

[0048] like Figure 3As shown, when a tenant accesses KVM and Docker services, the configuration management platform obtains the tenant's access request and initiates a dynamic address binding request to the corresponding regional controller. The corresponding regional controller allocates a preset address according to the instruction control node and binds the corresponding service. The regional controller feeds back the binding result to the configuration management platform.

[0049] Specifically, the tenant initiates a dynamic IP binding request for the KVM or Docker service in the specified area on the configuration management platform. After receiving the instruction, the regional controller of the specified area automatically allocates the preset allocable IP at the control node and binds the specified service. After the binding of the specified area is completed, the configuration management platform returns the result. By dynamically binding the user IP, network communication (access to the Internet) and management (user connection control) can be achieved. The control node refers to the control node (physical server) of the VPC network in the area.

[0050] In this embodiment, the physical server allocates the preset address in the following manner:

[0051] The physical server verifies the private address information generated by the tenant when purchasing the designated area through the database;

[0052] When the tenant purchases services again in the designated area, the physical server searches the database through the API script and selects unused addresses to allocate to the newly purchased services.

[0053] Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

Claims

1. A multi-tenant VPC private network configuration method, characterized in that: The specific steps include: The configuration management platform obtains the VPC configuration request. According to the VPC configuration request, the corresponding regional controller configures the internal logical switches, logical routers, and gateway routers to connect with each other. The gateway router connects to the egress network preset in the configuration request, creates NAT rules, and forms the VPC network environment corresponding to the request; The KVM and Docker service requests are obtained through the VPC network environment. The corresponding control area controller creates a logical port based on the request and binds the request address information. All physical servers in the corresponding area create KVM and Docker services and bind the corresponding logical port information.

2. The multi-tenant VPC private network configuration method according to claim 1, characterized in that: The NAT rule is to convert the private network address in the request into a public network address.

3. The multi-tenant VPC private network configuration method according to claim 1, characterized in that: When the configuration management platform obtains a VPC configuration request, it obtains the address of the tenant in the request and sends the tenant address to the corresponding regional controller. After the corresponding regional controller obtains the tenant address, it executes a script command to create a VPC network corresponding to the tenant.

4. The multi-tenant VPC private network configuration method according to claim 1, characterized in that: The request address information includes a tenant ID and a MAC address.

5. The multi-tenant VPC private network configuration method according to claim 1, characterized in that: When a tenant accesses KVM or Docker services, the configuration management platform obtains the tenant's access request and initiates a dynamic address binding request to the corresponding regional controller. The corresponding regional controller allocates a preset address according to the instruction control node and binds the corresponding service. The regional controller then feeds back the binding result to the configuration management platform.

6. The multi-tenant VPC private network configuration method according to claim 5, characterized in that: The physical server allocates the preset address in the following manner: The physical server verifies the private address information generated by the tenant when purchasing the designated area through the database; When the tenant purchases services again in the designated area, the physical server searches the database through the API script and selects unused addresses to allocate to the newly purchased services.

Images