Cloud edge container network communication and optimization system based on network performance perception

Abstract

The invention discloses a cloud edge container network communication and optimization system based on network performance perception, and the system comprises a control management module which is used for the centralized management and storage of edge node information, also has the function of an STUN server, carries out the real-time evaluation of the cost of a current routing path, and carries out the optimization of the current routing path. Performing dynamic decision and optimization to obtain an optimal cloud edge / edge routing path; and the tunnel Agent module is deployed on each edge node and the cloud node so as to establish a network communication tunnel between the edge nodes, and the tunnel Agent module realizes network communication by using an IPSec or WireGuard network protocol suite in combination with other edge node information acquired from the control management module and the optimal cloud edge / edge routing path. According to the method, the cloud edge / edge routing can be efficiently decided and established in real time, so that edge containers in different regions and different network environments are communicated, and the bandwidth consumption on the cloud is reduced while the communication efficiency is fully improved.

Description

Technical Field

[0001] The present invention relates to the field of cloud-edge container network interconnection technology, and in particular to a cloud-edge container network interconnection and optimization system based on network performance perception. Background Art

[0002] In the digital age, edge computing technology has become an important part of cloud computing, which can more effectively process data in distributed applications and Internet of Things (IoT) scenarios. However, with the rapid development of edge computing, the interconnection and interoperability of edge networks in different regions has become increasingly prominent, especially in achieving seamless connection between edge containers in multiple network environments.

[0003] As for edge network interconnection methods, the main technologies currently used are based on the TURN protocol and the STUN (Session Traversal Utilities for NAT) protocol. The TURN protocol allows the client to communicate with multiple different peers using the same relay server, and the STUN protocol is mainly used to help devices discover their public IP addresses and port numbers in a network address translation (NAT) environment, thereby helping edge devices in different regions to interconnect. However, such methods have shown a series of shortcomings in practical applications.

[0004] First, because different peers must forward data through a public network server as a relay, the performance of the relay server becomes a bottleneck. As network traffic increases and becomes more complex, the ability of the relay server to forward data may be limited. Especially in a high-concurrency, high-traffic network environment, the forwarding performance may drop significantly, affecting the overall network communication quality.

[0005] Secondly, since the communication goes through a layer of forwarding, the network delay will also increase accordingly. At the same time, forwarding will also cause a large amount of bandwidth consumption on the cloud, which is extremely costly.

[0006] In addition, there are also solutions in the industry that use libp2p to connect networks. However, libp2p is designed for peer-to-peer applications, not for cloud-native edge computing scenarios, and its complexity makes it difficult to integrate cloud-native applications. And although libp2p supports encrypted transmission, its security is slightly insufficient compared to network protocol suites such as IPSec and WireGuard, which have specially designed security protocols.

[0007] Most importantly, the current cloud-edge and edge-edge network connectivity solutions in the industry do not take into account the real-time changing network conditions in cloud-edge scenarios. They can neither establish tunnels based on network performance conditions, nor dynamically adjust and switch routes after network performance conditions change.

[0008] In summary, although the method using the TURN protocol and the method using the libp2p modular network stack can achieve the connection of the cloud-edge container network, there are still a series of technical and practical application defects that require further optimization and improvement. This requires finding a new network connection method that is more suitable for the cloud-edge container network scenario.

[0009] In addition, as a lightweight and efficient kernel-level tracing tool, eBPF (Extended Berkeley Packet Filter) technology has been favored by researchers and developers. It can dynamically insert code into the kernel and monitor the operation of the system in real time, without affecting system performance, and can provide rich data support for upper-level applications. In addition, with the help of eBPF technology, you can gain in-depth insights into the details of network traffic. Based on this background, the present invention proposes a cloud-edge container network connection and optimization method based on network performance perception, which is specifically aimed at the interconnection and interoperability of container networks in cloud-native edge computing scenarios. Based on the network performance information collected by eBPF technology, the method can make real-time and efficient decisions and establish cloud-edge and edge-edge routing, thereby connecting edge containers in different regions and different network environments, fully improving communication efficiency while reducing bandwidth consumption on the cloud. Summary of the invention

[0010] The purpose of the present invention is to address the deficiencies of the prior art and propose a cloud-edge container network interconnection and optimization system based on network performance perception. The present invention efficiently and conveniently performs network interconnection in cloud-native edge container network scenarios.

[0011] The object of the present invention is to achieve the following technical solution: a cloud-edge container network connection and optimization system based on network performance perception, comprising:

[0012] The control management module is used to centrally manage and store edge node information. It also has the function of a STUN server, which evaluates the current routing path cost in real time, and dynamically makes decisions and optimizes the optimal cloud-edge / edge-edge routing path; and

[0013] The tunnel agent module is deployed on each edge node and cloud node to establish a network connection tunnel between the edge nodes. The tunnel agent module uses the IPSec or WireGuard network protocol suite, combined with other edge node information obtained from the control management module and the optimal cloud-edge / edge-edge routing path to achieve network connectivity.

[0014] Furthermore, the control management module is implemented by the following steps:

[0015] (1.1) Information reception and storage: The control management module receives edge node information data from each edge node tunnel Agent module through the HTTP protocol; wherein, the edge node information data of each edge node tunnel Agent module is stored in the etcd repository of the Kubernetes cluster, and the edge node information data is stored in a custom resource definition manner, and the control management module receives the edge node information data from each edge node tunnel Agent module from the etcd repository;

[0016] (1.2) STUN server function: The control management module has the function of a STUN server to help edge nodes discover their public IP addresses and port numbers when they start up. Each edge node communicates with the control management module through the STUN protocol to obtain its network access information and registers the network access information back to the control management module, where the network access information includes the public IP address and port number.

[0017] (1.3) Distributed dynamic routing path decision and optimization: The control management module calculates the optimal cloud-edge network routing path decision result based on the collected network performance indicator data, and performs real-time optimization and adjustment according to the status changes of the network performance indicators.

[0018] Furthermore, the edge node information data includes the network status, public IP address, port number and network performance indicators of the edge node, and the network performance indicators include communication delay, bandwidth usage and packet loss rate.

[0019] Furthermore, the step (1.3) includes the following sub-steps:

[0020] (1.3.1) Constructing a routing path cost model: Perform outlier processing and normalization on all network performance indicators, combine historical data of network performance indicators, and construct a routing path cost model based on a decision tree;

[0021] (1.3.2) Cloud-edge network routing path cost calculation: The cloud-edge network is regarded as a graph, where the nodes in the graph represent the cloud nodes or edge nodes in the cloud-edge network, and the edges in the graph represent the cloud-edge / edge-edge tunnels connecting the nodes; the routing path cost, i.e., the weight of each edge, is calculated according to the routing path cost model;

[0022] (1.3.3) Dynamic decision on routing paths in cloud-edge networks: Use the minimum spanning tree algorithm to find the spanning tree with the smallest sum of edge weights in the cloud-edge network to ensure that the total cost of the entire cloud-edge network is minimized. The routing path corresponding to the spanning tree with the smallest sum of edge weights is the optimal routing path decision result; the decision result will be optimized and adjusted in real time according to the status changes of network performance indicators. Once the calculation shows that the original routing path is no longer the optimal solution, the minimum spanning tree algorithm will be re-executed to update the routing path decision result and obtain the optimal routing path decision result again.

[0023] Furthermore, the routing path cost model represents the decision-making process through a tree structure, each node corresponds to a judgment of a network performance indicator, and each leaf node outputs a predicted path cost value; in the routing path cost model, the cost of each path is obtained through a weighted combination of multiple network performance indicators; by learning the historical data of network performance indicators, the routing path cost model identifies the weights of different network performance indicator combinations on the routing path cost, thereby outputting the corresponding routing path cost for the new network performance indicator data.

[0024] Furthermore, the tunnel Agent module is implemented by the following steps:

[0025] (2.1) Interacting with the control and management module: Before establishing the network connection tunnel, the tunnel agent module interacts with the control and management module through the STUN server function of the control and management module to obtain the public IP address and port number of the edge node itself;

[0026] (2.2) Acquisition and upload of network performance indicator data: The tunnel agent module obtains the network access information of the edge node from the control management module, where the network access information includes the public IP address and port number; the tunnel agent module obtains the current optimal cloud-edge network routing path decision result from the control management module; the tunnel agent module obtains network performance indicators through ping and iperf tools; the tunnel agent module collects L2 to L4 events by using eBPF technology; and uploads the network performance indicator data to the control management module in real time, so that the control management module can make dynamic optimization decisions on the routing path based on the latest network performance indicator data;

[0027] (2.3) Tunnel establishment and maintenance: Use IPSec or WireGuard as the underlying technology, establish a network interconnection tunnel based on the acquired edge node information and the optimal cloud-edge network routing path decision results, and follow the tunnel establishment rules; update the network configuration information of the edge node regularly or receive change instructions from the control management module to ensure that the configuration of the network interconnection tunnel is always consistent with the expected network topology, thereby achieving maintenance of the network interconnection tunnel.

[0028] Further, the interaction with the control management module through the STUN server function of the control management module specifically includes the following sub-steps:

[0029] (2.1.1) Initialization request: The tunnel agent module sends a binding request message to the STUN server in the control management module. The binding request message contains the LAN IP address and pre-configured port information of the edge node where the tunnel agent module is located;

[0030] (2.1.2) Receiving response: After the STUN server in the control management module processes the received binding request message, it returns the public IP address and port number of the edge node;

[0031] (2.1.3) Registration information: The tunnel agent module registers the acquired public network IP address and port number to the control management module for updating the network configuration record of the edge node to ensure that other edge nodes can establish a direct connection to the edge node.

[0032] Furthermore, the use of IPSec or WireGuard as the underlying technology, based on the acquired edge node information and the optimal cloud-edge network routing path decision result, establishes a network connection tunnel according to the tunnel establishment rules, specifically including:

[0033] (2.3.1) Prepare connection information: According to the optimal cloud-edge network routing path decision result, prepare the network configuration information of the public IP address, port number, key, and network protocol type of the corresponding edge node to be connected to;

[0034] (2.3.2) For WireGuard: The edge node sets the public key, allowed IP range, and endpoint information of the peer node based on the connection information obtained, where the public key is determined by the key, the allowed IP range is determined by the podCIDR of the edge node, and the endpoint information is determined by the public IP address and port number of the edge node; in addition, the edge node also sets a persistent heartbeat to ensure that the port mapping on the NAT device remains valid;

[0035] (2.3.3) For IPSec: Use the libreswan tool to configure the network tunnel. The configuration information in the libreswan tool includes creating a security policy, setting encryption parameters, and routing configuration, and then starting the network tunnel.

[0036] Compared with the prior art, the present invention has the following beneficial effects:

[0037] (1) The design of the present invention is fully compatible with the cloud-native architecture. All network information is stored in the etcd of the Kubernetes cluster in the form of custom resource definitions (CRDs). This not only ensures high availability and consistency of data, but also makes the entire system easy to expand and maintain, thereby enhancing the cloud-native integration and scalability of STUN.

[0038] (2) The present invention implements a comprehensive evaluation mechanism based on real-time and historical network performance data for dynamic routing decision optimization in cloud-edge scenarios. When network conditions change, the present invention can re-evaluate and adjust existing routing decisions in real time. This flexible re-decision-making capability ensures that the cloud-edge network can maintain optimal performance under various conditions and optimize routing paths based on real-time decision-making based on network performance perception.

[0039] (3) The present invention uses tools such as ping and iperf to obtain common indicators such as latency, packet loss rate and bandwidth, and also uses eBPF technology to collect network performance indicators, that is, collects L2 to L4 events to comprehensively evaluate network performance.

[0040] (4) The present invention makes full use of STUN to optimize edge network interconnection, so that edge containers in different network environments can discover and register their public IP addresses and port information. This method simplifies the traditional network configuration process and improves the interconnection between edge devices, especially in NAT environments.

[0041] (5) The present invention effectively solves the problem of edge container network interconnection in a NAT environment and greatly simplifies the communication process across network devices; it processes the data of each node in real time through the control management module, dynamically optimizes the network topology, and intelligently adjusts the tunnel and routing configuration, thereby reducing latency and improving network performance; through the automatic tunnel management and maintenance function of the tunnel Agent module, combined with the encryption technology of IPSec and WireGuard, it not only ensures the stability and high availability of the network connection, but also enhances the security of data transmission; the cloud-native compatibility of the entire system and the use of CRD for data management improve maintainability and facilitate scale expansion and cross-cluster management; through the above measures, the network operating cost is significantly reduced, providing an efficient, reliable and secure network connectivity solution for the cloud-native distributed edge computing environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is an overall architecture diagram of the cloud-edge container network interconnection and optimization system based on network performance perception of the present invention;

[0043] Figure 2 The diagram is a deployment architecture diagram of the system described in the present invention. DETAILED DESCRIPTION

[0044] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims. It should be understood that the above general description and the detailed description that follows are merely exemplary and explanatory and cannot limit the present application.

[0045] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0046] It should be understood that, although the term first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of..." or "when..." or "in response to determination". Moreover, the term "include", "comprise" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process and method including a series of elements include not only those elements, but also include other elements not clearly listed, or also include elements inherent to such process and method. In the absence of more restrictions, the elements limited by the statement "including one..." do not exclude the existence of other identical elements in the process, method, article or equipment including the elements.

[0047] The present invention is described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the features of the following embodiments and implementations can be combined with each other.

[0048] See also Figure 1 The cloud-edge container network connection and optimization system based on network performance perception of the present invention specifically includes a control management module and a tunnel Agent module.

[0049] In this embodiment, the control management module is used to centrally manage and store edge node information, and also has the function of a STUN server, which evaluates the current routing path cost in real time, and dynamically makes decisions and optimizes to obtain the optimal cloud-edge / edge-edge routing path.

[0050] It should be understood that the control management module plays a vital role in the system. It is not only responsible for centralized management and storage of edge node information, but also has the function of a STUN server and dynamically optimizes the network topology.

[0051] Furthermore, the control management module is implemented through the following steps:

[0052] (1.1) Information reception and storage: The control management module receives edge node information data from each edge node tunnel Agent module through the HTTP protocol; wherein, the edge node information data of each edge node tunnel Agent module is stored in the etcd repository of the Kubernetes cluster, and the edge node information data is stored using a custom resource definition (CRD). The control management module receives edge node information data from each edge node tunnel Agent module from the etcd repository.

[0053] It should be understood that the custom resource definition (CRD) method is an existing well-known method of Kubernetes, which allows users to create custom resource types in the Kubernetes cluster. After defining the data structure of such resources, the corresponding information data can be stored under the corresponding data structure type of the etcd repository. The edge node information data is stored in the etcd repository of the Kubernetes cluster, and the control management module receives the edge node information data from the etcd repository. This method not only takes advantage of the high availability and consistency characteristics of etcd, but also facilitates management and access in the Kubernetes environment.

[0054] Furthermore, the edge node information data includes, but is not limited to: the network status, public IP address, port number and network performance indicators of the edge node, etc. The network performance indicators include communication delay, bandwidth usage and packet loss rate, etc.

[0055] It should be noted that the network status of the edge node specifically refers to whether the edge node can connect to the external network (whether it is a pure intranet environment).

[0056] (1.2) STUN server function: The control management module has the function of a STUN server to help edge nodes discover their public IP addresses and port numbers when they start up. Each edge node communicates with the control management module through the STUN protocol to obtain its network access information and registers the network access information back to the control management module, where the network access information includes the public IP address and port number.

[0057] It should be understood that this STUN server function is the basis for achieving direct communication between nodes, avoiding the delay and bandwidth consumption caused by forwarding through a relay server.

[0058] (1.3) Distributed dynamic routing path decision and optimization: The control management module calculates the optimal cloud-edge network routing path decision result based on the collected network performance indicator data, and performs real-time optimization and adjustment according to the status changes of the network performance indicators.

[0059] (1.3.1) Constructing a routing path cost model: Perform outlier processing and normalization on all network performance indicators (including latency, bandwidth, packet loss rate, etc.), combine historical data of network performance indicators, and construct a routing path cost model based on a decision tree.

[0060] Furthermore, the routing path cost model represents the decision-making process through a tree structure, each node corresponds to a judgment of a network performance indicator, and each leaf node outputs a predicted path cost value; in the routing path cost model, the cost of each path is obtained through a weighted combination of multiple network performance indicators; by learning the historical data of network performance indicators, the routing path cost model identifies the weights of different network performance indicator combinations on the routing path cost, and thus outputs the corresponding routing path cost for the new network performance indicator data.

[0061] (1.3.2) Calculation of routing path cost in cloud-edge network: The cloud-edge network is regarded as a graph, where the nodes in the graph represent the cloud nodes or edge nodes in the cloud-edge network, and the edges in the graph represent the cloud-edge / edge-edge tunnels connecting the nodes; the routing path cost, that is, the weight of each edge, is calculated according to the routing path cost model.

[0062] (1.3.3) Dynamic decision on routing paths in cloud-edge networks: Use the minimum spanning tree algorithm to find the spanning tree with the smallest sum of edge weights in the cloud-edge network to ensure that the total cost of the entire cloud-edge network is minimized. The routing path corresponding to the spanning tree with the smallest sum of edge weights is the optimal routing path decision result; the decision result will be optimized and adjusted in real time according to the status changes of network performance indicators. Once the calculation shows that the original routing path is no longer the optimal solution, the minimum spanning tree algorithm will be re-executed to update the routing path decision result and obtain the optimal routing path decision result again.

[0063] In this embodiment, Figure 2 As shown, the tunnel Agent module is deployed on each edge node and cloud node to establish a network connection tunnel between the edge nodes; the tunnel Agent module uses the IPSec or WireGuard network protocol suite, combined with other edge node information obtained from the control management module and the optimal cloud-edge / edge-edge routing path to achieve efficient network connectivity.

[0064] It should be understood that the tunnel agent module is the core component of this system. Tunnel agent modules are deployed on each edge node and cloud node. Network connection tunnels can be established between edge nodes. They can collect edge node information, collect network performance indicators using eBPF technology, and establish network connection tunnels based on the real-time decision results of the control management module.

[0065] It should be noted that IPSec is a complete network protocol suite, while WireGuard is not a complete network protocol suite, but a single protocol focused on VPN. The Network Protocol Suite refers to a set of network protocols designed to work together, that is, IPSec and WireGuard are combined, each protocol is responsible for a specific task, and together they realize comprehensive network communication functions from the application layer to the physical layer.

[0066] Furthermore, the tunnel agent module is implemented through the following steps:

[0067] (2.1) Interacting with the control management module: Before establishing the network connection tunnel, the tunnel agent module interacts with the control management module through the STUN server function of the control management module to obtain the public IP address and port number of the edge node itself. This step is the prerequisite for establishing the network tunnel, because only by correctly identifying the public network access point of the edge node can the cross-network connection be ensured.

[0068] Further, the STUN server function of the control management module interacts with the control management module, specifically including the following sub-steps:

[0069] (2.1.1) Initialization request: The tunnel agent module sends a binding request message to the STUN server in the control management module. The binding request message includes the LAN IP address of the edge node where the tunnel agent module is located and the pre-configured port information.

[0070] (2.1.2) Receiving Response: After the STUN server in the control management module processes the received binding request message, it returns the public IP address and port number of the edge node. This information reflects the network identity of the edge node through the NAT device (such as a router).

[0071] (2.1.3) Registration information: The tunnel agent module registers the acquired public network IP address and port number to the control management module for updating the network configuration record of the edge node to ensure that other edge nodes can establish a direct connection to the edge node.

[0072] (2.2) Acquisition and upload of network performance indicator data: The tunnel agent module obtains the network access information of the edge node from the control management module, where the network access information includes the public IP address and port number; the tunnel agent module obtains the current optimal cloud-edge network routing path decision result from the control management module. This information can help the tunnel agent module to establish a tunnel; the tunnel agent module obtains network performance indicators (including communication delay, packet loss rate, and bandwidth usage, etc.) through tools such as ping and iperf; the tunnel agent module uses eBPF technology to collect L2 to L4 events (the time spent on key events in layers 2 to 4 in the network protocol stack) and uploads the network performance indicator data to the control management module in real time, so that the control management module can make dynamic optimization decisions on the routing path based on the latest network performance indicator data.

[0073] It should be understood that the ping tool and the iperf tool are both commonly used network diagnosis and testing tools in the operating system, and will not be described in detail here.

[0074] It should be noted that L2 to L4 events refer to key events in L2 (data link layer), L3 (network layer) and L4 (transport layer) in the network protocol stack. eBPF technology can capture network activities at all levels from the kernel level without modifying the kernel code.

[0075] (2.3) Tunnel establishment and maintenance: Use IPSec or WireGuard as the underlying technology, establish a network interconnection tunnel based on the acquired edge node information and the optimal cloud-edge network routing path decision results, and follow the tunnel establishment rules; update the network configuration information of the edge node regularly (e.g., every 30 minutes) or upon receiving change instructions from the control management module to ensure that the configuration of the network interconnection tunnel is always consistent with the expected network topology, thereby achieving maintenance of the network interconnection tunnel.

[0076] Furthermore, using IPSec or WireGuard as the underlying technology, based on the acquired edge node information and the optimal cloud-edge network routing path decision result, a network connection tunnel is established according to the tunnel establishment rules, specifically including:

[0077] (2.3.1) Prepare connection information: Based on the optimal cloud-edge network routing path decision result, prepare the public IP address, port number, key, network protocol type and other relevant network configuration information of the corresponding edge node to be connected.

[0078] (2.3.2) For WireGuard: The edge node sets the public key, allowed IP range, and endpoint information of the peer node based on the connection information obtained, where the public key is determined by the secret key, the allowed IP range is determined by the podCIDR of the edge node, and the endpoint information is determined by the public IP address and port number of the edge node; in addition, the edge node also sets a persistent heartbeat (persistent-keepalive) to ensure that the port mapping on the NAT device remains valid.

[0079] It should be noted that CIDR can be understood as a way to assign IP addresses. We can use the CIDR representation method to represent the range of IP addresses. For example, the IP address range represented by the CIDR block 192.168.1.0 / 24 is 192.168.1.0 to 192.168.1.255. The Pod CIDR is used to define the IP address range of the Pod in the Kubernetes cluster. For example, we may use 10.244.0.0 / 16 to represent the IP address space of the Pod in a cluster. Each node in Kubernetes usually obtains a subnet range from the Pod CIDR. For example, if the Pod CIDR is 10.244.0.0 / 16, a node may be assigned 10.244.1.0 / 24, and the IP address of the Pod on the node is assigned in this subnet range. So the Pod CIDR here actually refers to a subnet range assigned to the Pod of the node.

[0080] (2.3.3) For IPSec: Use the libreswan tool to configure the network tunnel. The configuration information in the libreswan tool includes creating security policies, setting encryption parameters, routing configuration, etc., and then starting the network tunnel.

[0081] It should be understood that the libreswan tool is an open source software package that specifically implements IPSec. Correspondingly, WireGuard not only defines the protocol for VPN tunnels, but also provides actual VPN software tools.

[0082] For example, in a cloud vendor's edge computing product, before using the cloud-edge container network connection and optimization system based on network performance perception described in the present invention, it can only be relayed based on the TURN protocol, with low communication performance and large cloud bandwidth. After applying the cloud-edge container network connection and optimization system based on network performance perception described in the present invention, a direct communication tunnel between edge containers can be established in appropriate scenarios, which improves communication performance while reducing the company's cloud bandwidth consumption and reduces costs.

[0083] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A cloud-edge container network connection and optimization system based on network performance perception, characterized in that: include: The control management module is used to centrally manage and store edge node information. It also has the function of a STUN server, which evaluates the current routing path cost in real time, and dynamically makes decisions and optimizes to obtain the optimal cloud-edge / edge-edge routing path. and The tunnel agent module is deployed on each edge node and cloud node to establish a network connection tunnel between the edge nodes. The tunnel agent module uses the IPSec or WireGuard network protocol suite, combined with other edge node information obtained from the control management module and the optimal cloud-edge / edge-edge routing path to achieve network connectivity.

2. According to the network performance-aware cloud-edge container network connection and optimization system according to claim 1, it is characterized in that: The control management module is implemented by the following steps: (1.1) Information reception and storage: The control management module receives edge node information data from each edge node tunnel Agent module through the HTTP protocol; wherein, the edge node information data of each edge node tunnel Agent module is stored in the etcd repository of the Kubernetes cluster, and the edge node information data is stored in a custom resource definition manner, and the control management module receives the edge node information data from each edge node tunnel Agent module from the etcd repository; (1.2) STUN server function: The control management module has the function of a STUN server to help edge nodes discover their public IP addresses and port numbers when they start up. Each edge node communicates with the control management module through the STUN protocol to obtain its network access information and registers the network access information back to the control management module, where the network access information includes the public IP address and port number. (1.3) Distributed dynamic routing path decision and optimization: The control management module calculates the optimal cloud-edge network routing path decision result based on the collected network performance indicator data, and performs real-time optimization and adjustment according to the status changes of the network performance indicators.

3. According to the network performance-aware cloud-edge container network connection and optimization system according to claim 2, it is characterized in that: The edge node information data includes the network status, public IP address, port number and network performance indicators of the edge node, and the network performance indicators include communication delay, bandwidth usage and packet loss rate.

4. According to claim 2, the cloud-edge container network connection and optimization system based on network performance perception is characterized in that: The step (1.3) includes the following sub-steps: (1.3.1) Constructing a routing path cost model: Perform outlier processing and normalization on all network performance indicators, combine historical data of network performance indicators, and construct a routing path cost model based on a decision tree; (1.3.2) Cloud-edge network routing path cost calculation: The cloud-edge network is considered as a graph, where the nodes in the graph represent the cloud nodes or edge nodes in the cloud-edge network, and the edges in the graph represent the cloud-edge / edge-edge tunnels connecting the nodes; Calculate the routing path cost, i.e. the weight of each edge, based on the routing path cost model; (1.3.3) Dynamic decision on routing paths in cloud-edge networks: Use the minimum spanning tree algorithm to find the spanning tree with the smallest sum of edge weights in the cloud-edge network to ensure that the total cost of the entire cloud-edge network is minimized. The routing path corresponding to the spanning tree with the smallest sum of edge weights is the optimal routing path decision result; the decision result will be optimized and adjusted in real time according to the status changes of network performance indicators. Once the calculation shows that the original routing path is no longer the optimal solution, the minimum spanning tree algorithm will be re-executed to update the routing path decision result and obtain the optimal routing path decision result again.

5. According to the network performance-aware cloud-edge container network connection and optimization system according to claim 4, it is characterized in that: The routing path cost model represents the decision-making process through a tree structure, each node corresponds to a judgment of a network performance indicator, and each leaf node outputs a predicted path cost value; in the routing path cost model, the cost of each path is obtained through a weighted combination of multiple network performance indicators; by learning the historical data of network performance indicators, the routing path cost model identifies the weights of different network performance indicator combinations on the routing path cost, thereby outputting the corresponding routing path cost for the new network performance indicator data.

6. According to the network performance-aware cloud-edge container network connection and optimization system according to claim 1, it is characterized in that: The tunnel Agent module is implemented through the following steps: (2.1) Interacting with the control and management module: Before establishing the network connection tunnel, the tunnel agent module interacts with the control and management module through the STUN server function of the control and management module to obtain the public IP address and port number of the edge node itself; (2.2) Acquisition and upload of network performance indicator data: The tunnel agent module obtains the network access information of the edge node from the control management module, where the network access information includes the public IP address and port number; the tunnel agent module obtains the current optimal cloud-edge network routing path decision result from the control management module; the tunnel agent module obtains network performance indicators through ping and iperf tools; the tunnel agent module collects L2 to L4 events by using eBPF technology; and uploads the network performance indicator data to the control management module in real time, so that the control management module can make dynamic optimization decisions on the routing path based on the latest network performance indicator data; (2.3) Tunnel establishment and maintenance: Use IPSec or WireGuard as the underlying technology, establish a network interconnection tunnel based on the acquired edge node information and the optimal cloud-edge network routing path decision results, and follow the tunnel establishment rules; update the network configuration information of the edge node regularly or receive change instructions from the control management module to ensure that the configuration of the network interconnection tunnel is always consistent with the expected network topology, thereby achieving maintenance of the network interconnection tunnel.

7. The cloud-edge container network connection and optimization system based on network performance perception according to claim 6 is characterized in that: The interaction with the control management module through the STUN server function of the control management module specifically includes the following sub-steps: (2.1.1) Initialization request: The tunnel agent module sends a binding request message to the STUN server in the control management module. The binding request message contains the LAN IP address and pre-configured port information of the edge node where the tunnel agent module is located; (2.1.2) Receiving response: After the STUN server in the control management module processes the received binding request message, it returns the public IP address and port number of the edge node; (2.1.3) Registration information: The tunnel agent module registers the acquired public network IP address and port number to the control management module for updating the network configuration record of the edge node to ensure that other edge nodes can establish a direct connection to the edge node.

8. The cloud-edge container network connection and optimization system based on network performance perception according to claim 6 is characterized in that: The method uses IPSec or WireGuard as the underlying technology, establishes a network connection tunnel according to the obtained edge node information and the optimal cloud-edge network routing path decision result, and the rules for establishing the tunnel, specifically including: (2.3.1) Prepare connection information: According to the optimal cloud-edge network routing path decision result, prepare the network configuration information of the public IP address, port number, key, and network protocol type of the corresponding edge node to be connected to; (2.3.2) For WireGuard: The edge node sets the public key, allowed IP range, and endpoint information of the peer node based on the connection information obtained, where the public key is determined by the key, the allowed IP range is determined by the pod CIDR of the edge node, and the endpoint information is determined by the public IP address and port number of the edge node; in addition, the edge node also sets a persistent heartbeat to ensure that the port mapping on the NAT device remains valid; (2.3.3) For IPSec: Use the libreswan tool to configure the network tunnel. The configuration information in the libreswan tool includes creating a security policy, setting encryption parameters, and routing configuration, and then starting the network tunnel.

Images