Tenant isolation method, tenant isolation device and related equipment

Abstract

The invention relates to the technical field of intelligent calculation centers, in particular to a tenant isolation method and device and related equipment. The method comprises the following steps: determining a target computing server allocated to a target tenant, and determining a tenant network segment allocated to the target tenant; based on the number n of parameter network cards of the target computing servers, splitting the tenant network segment into m server network segments, and allocating a server network segment for each parameter network card of each target computing server accessed to the same Leaf device, m and n being positive integers, and m being greater than or equal to n; for each Leaf device, according to each physical downlink interface used for accessing each target computing server, respectively creating a logic virtual interface corresponding to the target tenant on each Leaf device; and on each logic virtual interface, configuring an access strategy for isolating the target tenant from other tenants based on the tenant network segment.

Description

Technical Field

[0001] The present application relates to the technical field of intelligent computing centers, and in particular to a tenant isolation method, device and related equipment. Background Art

[0002] With the rapid development of AI (Artificial Intelligence) technology, all walks of life have an urgent need to rent AI computing power. For providers of computing power services using RoCE (RDMA over Converged Ethernet) networks, supporting tenant division of computing power resources has become an urgent problem to be solved.

[0003] Currently, to meet the tenant isolation requirements, users can use ACL (Access Control Lists) rules to control traffic. However, in the case of computing servers with multiple network cards and multiple Internet Protocols (Internet Protocols), the huge number of IPs brought by the tenants' multi-track networks will bring huge ACL pressure to the device, and the ACL rule configuration is also relatively cumbersome. Summary of the invention

[0004] The present application provides a tenant isolation method, device and related equipment.

[0005] In a first aspect, the present application provides a tenant isolation method, the method comprising:

[0006] Determine a target computing server assigned to a target tenant, and determine a tenant network segment assigned to the target tenant;

[0007] Based on the number n of parameter network cards of the target computing server, the tenant network segment is split into m server network segments, and a server network segment is allocated to each parameter network card of each target computing server connected to the same Leaf device, where m and n are positive integers and m is greater than or equal to n;

[0008] For each Leaf device, according to each physical downstream interface used to access each target computing server, a logical virtual interface corresponding to the target tenant is created on each Leaf device;

[0009] On each logical virtual interface, an access policy for isolating the target tenant from other tenants is configured based on the tenant network segment.

[0010] Optionally, the step of determining a target computing server allocated to a target tenant and determining a tenant network segment allocated to the target tenant includes:

[0011] Receive target tenant information sent by the cloud, wherein the target tenant information includes the target tenant name, target computing server information allocated to the target tenant, and tenant network segment information allocated to the target tenant;

[0012] Based on the target tenant information, a target computing server and a tenant network segment allocated to the target tenant are determined.

[0013] Optionally, if the target tenant information does not include tenant network segment information allocated to the target tenant, the step of determining the tenant network segment allocated to the target tenant includes:

[0014] An available network segment that meets a preset condition is determined from a preset address pool, and the available network segment is allocated to the target tenant as a tenant network segment.

[0015] Optionally, on each logical virtual interface, the step of configuring an access policy for isolating the target tenant from other tenants based on the tenant network segment includes:

[0016] Assign a VLAN ID to each logical virtual interface and use each logical virtual interface as the gateway interface of the corresponding server network segment;

[0017] An ACL that denies all traffic by default is configured on each logical virtual interface, and an ACL that allows traffic corresponding to the tenant network segment is configured.

[0018] Optionally, the method further comprises:

[0019] When a tenant is detected to be offline, the computing server and tenant network segment allocated to the tenant are reclaimed.

[0020] In a second aspect, the present application provides a tenant isolation device, the device comprising:

[0021] A determination unit, configured to determine a target computing server allocated to a target tenant, and determine a tenant network segment allocated to the target tenant;

[0022] A splitting unit, configured to split the tenant network segment into m server network segments based on the number n of parameter network cards of the target computing server, and allocate a server network segment to each parameter network card of each target computing server connected to the same Leaf device, wherein m and n are positive integers, and m is greater than or equal to n;

[0023] A creating unit, configured to create, for each Leaf device, a logical virtual interface corresponding to the target tenant on each Leaf device according to each physical downstream interface used to access each target computing server;

[0024] A configuration unit is used to configure, on each logical virtual interface, an access policy for isolating the target tenant from other tenants based on the tenant network segment.

[0025] Optionally, when determining the target computing server allocated to the target tenant and determining the tenant network segment allocated to the target tenant, the determining unit is specifically configured to:

[0026] Receive target tenant information sent by the cloud, wherein the target tenant information includes the target tenant name, target computing server information allocated to the target tenant, and tenant network segment information allocated to the target tenant;

[0027] Based on the target tenant information, a target computing server and a tenant network segment allocated to the target tenant are determined.

[0028] Optionally, if the target tenant information does not include tenant network segment information allocated to the target tenant, when determining the tenant network segment allocated to the target tenant, the determining unit is specifically configured to:

[0029] An available network segment that meets a preset condition is determined from a preset address pool, and the available network segment is allocated to the target tenant as a tenant network segment.

[0030] Optionally, on each logical virtual interface, when configuring an access policy for isolating the target tenant from other tenants based on the tenant network segment, the configuration unit is specifically used to:

[0031] Assign a VLAN ID to each logical virtual interface and use each logical virtual interface as the gateway interface of the corresponding server network segment;

[0032] An ACL that denies all traffic by default is configured on each logical virtual interface, and an ACL that allows traffic corresponding to the tenant network segment is configured.

[0033] Optionally, the device further comprises:

[0034] The recycling unit is used to recycle the computing server and tenant network segment allocated to the tenant when it is detected that a tenant is offline.

[0035] In a third aspect, an embodiment of the present application provides a tenant isolation device, the tenant isolation device comprising:

[0036] A memory for storing program instructions;

[0037] The processor is used to call the program instructions stored in the memory, and execute the steps of the method as described in any one of the first aspects above according to the obtained program instructions.

[0038] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the steps of the method described in any one of the first aspects above.

[0039] In summary, the tenant isolation method provided in the embodiment of the present application determines the target computing server assigned to the target tenant, and determines the tenant network segment assigned to the target tenant; based on the number n of parameter network cards of the target computing server, the tenant network segment is split into m server network segments, and for each parameter network card of each target computing server connected to the same Leaf device, a server network segment is allocated, wherein m and n are positive integers, and m is greater than or equal to n; for each Leaf device, according to each physical downstream interface used to access each target computing server, a logical virtual interface corresponding to the target tenant is created on each Leaf device; on each logical virtual interface, an access policy for isolating the target tenant from other tenants is configured based on the tenant network segment.

[0040] By adopting the tenant isolation method provided in the embodiment of the present application, by splitting and managing the tenant network segment and the service network segment, the ACL rule setting based on the network segment is realized under the premise of satisfying the multi-track networking. By using the tenant network segment for ACL traffic control, the ACL pressure on the access device is reduced when the tenant traffic is isolated, and the limitation of the tenant network specifications due to insufficient ACL capabilities of the device is avoided. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments of the present application or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings of the embodiments of the present application.

[0042] Figure 1 A schematic diagram of a network is shown;

[0043] Figure 2 A detailed flow chart of a tenant isolation method provided in an embodiment of the present application;

[0044] Figure 3 A schematic diagram of a logical virtual interface and server network segment allocation provided in an embodiment of the present application;

[0045] Figure 4 A schematic diagram of the structure of a tenant isolation device provided in an embodiment of the present application;

[0046] Figure 5A schematic diagram of the hardware architecture of a tenant isolation device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] The terms used in the embodiments of the present application are only for the purpose of describing specific embodiments, rather than limiting the present application. The singular forms of "a", "said" and "the" used in the present application and claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to any or all possible combinations of one or more associated listed items.

[0048] It should be understood that, although the terms first, second, third, etc. may be used to describe various information in the embodiments of the present application, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, in addition, the word "if" used may be interpreted as "at..." or "when..." or "in response to determination".

[0049] At present, in the intelligent computing center network, there is a communication demand between the computing servers with the same GPU (Graphics Processing Unit), which requires networking in a multi-track communication manner. Below, we take the case where the Leaf device has 128 downlink ports (which can access 128 servers with the same network cards (network cards with the same number access the same GPU)) and the server has 8 network cards as an example. Figure 1 As shown, a Leaf (Leaf-1) is connected to the first network card of 128 servers (only the first network card connected to 4 servers is shown in the figure), and the first network cards of the 128 servers belong to the same network segment 192.168.10.1 / 24 (network segment 1); a Leaf (Leaf-2) is connected to the second network card of 128 servers, and the second network cards of the 128 servers belong to the same network segment 192.168.20.1 / 24 (network segment 2); (only the second network card connected to 4 servers is shown in the figure)...; a Leaf (Leaf-4) is connected to the fourth network card of 128 servers (only the fourth network card connected to 4 servers is shown in the figure), and the fourth network card of the 128 servers belongs to the same network segment 192.168.40.1 / 24 (network segment 4).

[0050] When tenant isolation is performed under the above networking, when tenant 1 is assigned to server 1 (assuming that the server is an 8-NIC server, NIC 1 of server 1 is connected to Leaf-1, NIC 2 is connected to Leaf-2, ..., NIC 8 is connected to Leaf-8), server 2 (NIC 1 of server 2 is connected to Leaf-1, NIC 2 is connected to Leaf-2, ..., NIC 8 is connected to Leaf-8), tenant 2 is assigned to server 3 (NIC 1 of server 3 is connected to Leaf-1, NIC 2 is connected to Leaf-2, ..., NIC 8 is connected to Leaf-8), server 4 (NIC 1 of server 4 is connected to Leaf-1, NIC 2 is connected to Leaf-2, ..., NIC 8 is connected to Leaf-8). 1 is connected to Leaf-1, NIC 2 is connected to Leaf-2, ..., NIC 8 is connected to Leaf-8), if it is necessary to isolate tenant 1 and tenant 2, it is necessary to configure several ACL rules on each Leaf device for each server NIC IP connected to the Leaf device. For example, for NIC 1 of server 1, it is necessary to configure an ACL that allows access to NIC 1 of server 2, and configure ACK that prohibits access to NIC 1 of server 3 and NIC 1 of server 4, or configure an ACL that prohibits access to all IPs, and configure an ACL that allows access to NIC 1 of server 2. Even so, when a large number of computing servers are allocated to tenant 1, a large number of ACLs still need to be configured for each NIC IP of each server, which places high demands on device ACL rules, and the device ACL capacity becomes a limitation on the scale of a single tenant (number of computing servers). In addition, the manual configuration of ACL is cumbersome, prone to configuration errors that lead to business abnormalities, and complex maintenance.

[0051] The embodiment of the present application provides a technology for dynamic network allocation management, which reduces configuration pressure, improves the tenant support specifications of the network, and provides users with operational convenience through the cooperation of the SE controller and the cloud side.

[0052] For example, see Figure 2 FIG. 1 is a detailed flow chart of a tenant isolation method provided in an embodiment of the present application, and the method includes the following steps:

[0053] Step 200: Determine a target computing server allocated to a target tenant, and determine a tenant network segment allocated to the target tenant.

[0054] It should be noted that the tenant isolation method provided in the embodiment of the present application can be applied to the controller of the computing network. The controller performs network planning based on the allocation of each computing server in the computing network to achieve isolation between tenants.

[0055] Specifically, in an embodiment of the present application, when determining a target computing server assigned to a target tenant and determining a tenant network segment assigned to the target tenant, a preferred implementation method is:

[0056] Receive target tenant information sent by the cloud, wherein the target tenant information includes the target tenant name, the target computing server information assigned to the target tenant, and the tenant network segment information assigned to the target tenant; based on the target tenant information, determine the target computing server and tenant network segment assigned to the target tenant.

[0057] That is, when the administrator creates a tenant in the cloud, he can determine the size of the computing resources required by the tenant (that is, the number of computing servers required) based on the tenant's needs, and thus select the target computing server to be allocated to the newly created tenant from the idle computing servers. For example, it is determined that Server 1 and Server 2 are allocated to Tenant A. Server 1 and Server 2 have 8 parameter network cards connected to Leaf devices respectively, that is, the total number of parameter network cards of Server 1 and Server 2 is 16. Then, based on the total number of parameter network cards, a network segment with a number of available IP addresses greater than or equal to the total number of parameter network cards can be allocated to Tenant A as the tenant network segment (tenant network segment A) allocated to Tenant A. The cloud carries the computing server (server 1 and server 2) information and tenant network segment information allocated to the tenant in the tenant information and sends it to the controller. The controller determines the computing server and tenant network segment allocated to Tenant A based on the received tenant information.

[0058] In actual applications, the user may not specify the tenant network segment of the newly created tenant. That is, if the target tenant information does not include the tenant network segment information allocated to the target tenant, a preferred implementation method for determining the tenant network segment allocated to the target tenant is:

[0059] An available network segment that meets a preset condition is determined from a preset address pool, and the available network segment is allocated to the target tenant as a tenant network segment.

[0060] That is to say, an address pool is preset on the controller, including several network segments. When it is determined that no tenant network segment is allocated to the target tenant in the cloud, the number of target computing servers allocated to the target tenant and the number of parameter network cards of each computing server can be determined based on the network topology information, and the size of the tenant network segment required by the target tenant can be determined. In this way, a network segment with an available address that meets the preset requirements is allocated to the target tenant from the address pool as the tenant network segment of the target tenant.

[0061] For example, if the number of addresses required by tenant A is p, the number of available addresses in the tenant network segment allocated to tenant A must be greater than or equal to p.

[0062] Step 210: Based on the number n of parameter network cards of the target computing server, the tenant network segment is split into m server network segments, and a server network segment is allocated to each parameter network card of each target computing server connected to the same Leaf device.

[0063] In the embodiment of the present application, m and n are positive integers, and m is greater than or equal to n. The following description will be made by taking m=n as an example.

[0064] Specifically, after determining the target server assigned to the target tenant (in the embodiment of the present application, the number of parameter network cards of the target server connected to the Leaf is the same), the controller splits the tenant network segment into n server network segments according to the number n of parameter network cards of a target server.

[0065] Take n as 8 as an example, the network segment of tenant 1 is: 192.168.1.0 / 24, and the network segment of tenant 1 is split into 8 server network segments: each subnet mask is / 27, and each subnet contains 32 IP addresses.

[0066] Server network segment 1: 192.168.1.0 / 27 (gw: 192.168.1.30),

[0067] Address range: 192.168.1.0-192.168.1.31;

[0068] Server network segment 2: 192.168.1.32 / 27 (gw: 192.168.1.62),

[0069] Address range: 192.168.1.32-192.168.1.63;

[0070] Server network segment 3: 192.168.1.64 / 27 (gw: 192.168.1.94),

[0071] Address range: 192.168.1.64-192.168.1.95;

[0072] Server network segment 4: 192.168.1.96 / 27 (gw: 192.168.1.126),

[0073] Address range: 192.168.1.96-192.168.1.127;

[0074] Server network segment 5: 192.168.1.128 / 27 (gw: 192.168.1.158),

[0075] Address range: 192.168.1.128-192.168.1.159;

[0076] Server network segment 6: 192.168.1.160 / 27 (gw: 192.168.1.190),

[0077] Address range: 192.168.1.160-192.168.1.191;

[0078] Server network segment 7: 192.168.1.192 / 27 (gw: 192.168.1.222),

[0079] Address range: 192.168.1.192-192.168.1.223;

[0080] Server network segment 8: 192.168.1.224 / 27 (gw: 192.168.1.254)

[0081] Address range: 192.168.1.224-192.168.1.255.

[0082] Next, the controller allocates server network segment 1 to the first network card of Leaf-1 connected to the target computing server (the target computing servers are server 1 and server 2 as an example), allocates server network segment 2 to the second network card of Leaf-2 connected to server 1 and server 2, and ... allocates server network segment 8 to the eighth network card of Leaf-8 connected to server 1 and server 2.

[0083] Step: 220: For each Leaf device, according to each physical downstream interface used to access each target computing server, a logical virtual interface corresponding to the target tenant is created on each Leaf device.

[0084] Based on the network topology, the controller determines the physical downstream port on Leaf-1 for accessing Server 1 and Server 2 (the physical port on which the same tenant (target tenant) accesses the same leaf), creates a logical virtual interface (e.g., a VLAN virtual interface) on Leaf-1, and adds the physical downstream port on which the server 1 and Server 2 are accessed to the VLAN virtual interface. Similarly, the controller determines the physical downstream ports on Leaf-2, ..., Leaf-8 for accessing Server 1 and Server 2 (the physical port on which the same tenant (target tenant) accesses the same leaf), and creates a logical virtual interface on the corresponding Leaf.

[0085] For example, see Figure 3 As shown, a schematic diagram of a logical virtual interface and server network segment allocation provided in an embodiment of the present application, server 1 and server 2 are computing servers allocated to tenant A, the network card 1 of server 1 and server 2 is connected to Leaf-1, and the physical downstream port on Leaf-1 used to access the network card of server 1 and server 2 constitutes a logical virtual interface 1, and the server network segment 1 is allocated to the logical virtual interface 1 and the network card 1 of server 1 and server 2.

[0086] Step 230: On each logical virtual interface, an access policy for isolating the target tenant from other tenants is configured based on the tenant network segment.

[0087] In the embodiment of the present application, when configuring an access policy for isolating the target tenant from other tenants based on the tenant network segment on each logical virtual interface, a preferred implementation method is:

[0088] Assign a Vlan ID to each logical virtual interface, and use each logical virtual interface as the gateway interface of the corresponding server network segment; configure an ACL that denies all traffic by default on each logical virtual interface, and configure an ACL that allows the corresponding traffic of the tenant network segment.

[0089] That is to say, after creating a VLAN virtual interface, assign a VLAN ID to the VLAN virtual interface, and use the VLAN virtual interface as the gateway interface of the assigned server network segment, and configure the gateway address. The IP address of the network card of each target server connected to the virtual interface is another available IP address in the server network segment. At this time, you can configure an ACL on the VLAN virtual interface to isolate the target tenant from other tenants.

[0090] For example, configure ACL rules on the VLAN virtual interfaces corresponding to the target tenants from Leaf-1 to Leaf-8: 1, rule999deny all / / deny all traffic by default; 2, permit source tenant network segment (192.168.1.0 / 24) destination tenant network (192.168.1.0 / 24) / / only allow intranet traffic of this tenant to communicate. In this way, mutual access between the parameter network cards of server 1 and server 2 is realized, and the interaction between the parameter network cards of server 1 and server 2 and the servers of other tenants is restricted, so as to achieve the purpose of tenant isolation.

[0091] Furthermore, in an embodiment of the present application, when it is detected that a tenant is offline, the computing server and tenant network segment allocated to the tenant are reclaimed.

[0092] Based on the same inventive concept as the above-mentioned embodiment of the invention, for example, refer to Figure 4 FIG. 1 is a schematic diagram of a structure of a tenant isolation device provided in an embodiment of the present application, and the device includes:

[0093] A determination unit 40, configured to determine a target computing server allocated to a target tenant, and determine a tenant network segment allocated to the target tenant;

[0094] The splitting unit 41 is used to split the tenant network segment into m server network segments based on the number n of parameter network cards of the target computing server, and allocate a server network segment to each parameter network card of each target computing server connected to the same Leaf device, where m and n are positive integers, and m is greater than or equal to n;

[0095] A creating unit 42 is used to create, for each Leaf device, a logical virtual interface corresponding to the target tenant on each Leaf device according to each physical downstream interface used to access each target computing server;

[0096] The configuration unit 43 is used to configure, on each logical virtual interface, an access policy for isolating the target tenant from other tenants based on the tenant network segment.

[0097] Optionally, when determining the target computing server allocated to the target tenant and determining the tenant network segment allocated to the target tenant, the determining unit 40 is specifically configured to:

[0098] Receive target tenant information sent by the cloud, wherein the target tenant information includes the target tenant name, target computing server information allocated to the target tenant, and tenant network segment information allocated to the target tenant;

[0099] Based on the target tenant information, a target computing server and a tenant network segment allocated to the target tenant are determined.

[0100] Optionally, if the target tenant information does not include tenant network segment information allocated to the target tenant, when determining the tenant network segment allocated to the target tenant, the determining unit 40 is specifically configured to:

[0101] An available network segment that meets a preset condition is determined from a preset address pool, and the available network segment is allocated to the target tenant as a tenant network segment.

[0102] Optionally, on each logical virtual interface, when configuring an access policy for isolating the target tenant from other tenants based on the tenant network segment, the configuration unit 43 is specifically used to:

[0103] Assign a VLAN ID to each logical virtual interface and use each logical virtual interface as the gateway interface of the corresponding server network segment;

[0104] An ACL that denies all traffic by default is configured on each logical virtual interface, and an ACL that allows traffic corresponding to the tenant network segment is configured.

[0105] Optionally, the device further comprises:

[0106] The recycling unit is used to recycle the computing server and tenant network segment allocated to the tenant when it is detected that a tenant is offline.

[0107] The above units may be one or more integrated circuits configured to implement the above methods, such as one or more application specific integrated circuits (ASIC), or one or more digital signal processors (DSP), or one or more field programmable gate arrays (FPGA). For another example, when a certain unit is implemented in the form of a processing element scheduling program code, the processing element may be a general-purpose processor, such as a central processing unit (CPU) or other processor that can call program code. For another example, these units may be integrated together and implemented in the form of a system-on-a-chip (SOC).

[0108] Furthermore, the tenant isolation device provided in the embodiment of the present application, from the hardware level, the hardware architecture diagram of the tenant isolation device can be seen in Figure 5 As shown, the tenant isolation device may include: a memory 50 and a processor 51,

[0109] The memory 50 is used to store program instructions; the processor 51 calls the program instructions stored in the memory 50 and executes the above method embodiment according to the obtained program instructions. The specific implementation method and technical effect are similar and will not be repeated here.

[0110] Optionally, the present application also provides a controller, comprising at least one processing element (or chip) for executing the above method embodiment.

[0111] Optionally, the present application also provides a program product, such as a computer-readable storage medium, which stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the above method embodiments.

[0112] Here, the machine-readable storage medium may be any electronic, magnetic, optical or other physical storage device that may contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium may be: RAM (RadomAccess Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as CD, DVD, etc.), or similar storage medium, or a combination thereof.

[0113] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which may be in the form of a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email transceiver, a game console, a tablet computer, a wearable device or a combination of any of these devices.

[0114] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0115] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the embodiments of the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0116] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0117] Moreover, these computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0118] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0119] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A tenant isolation method, characterized in that: The method comprises: Determine a target computing server assigned to a target tenant, and determine a tenant network segment assigned to the target tenant; Based on the number n of parameter network cards of the target computing server, the tenant network segment is split into m server network segments, and a server network segment is allocated to each parameter network card of each target computing server connected to the same Leaf device, where m and n are positive integers and m is greater than or equal to n; For each Leaf device, according to each physical downstream interface used to access each target computing server, a logical virtual interface corresponding to the target tenant is created on each Leaf device; On each logical virtual interface, an access policy for isolating the target tenant from other tenants is configured based on the tenant network segment.

2. The method according to claim 1, characterized in that The steps of determining a target computing server allocated to a target tenant and determining a tenant network segment allocated to the target tenant include: Receive target tenant information sent by the cloud, wherein the target tenant information includes the target tenant name, target computing server information allocated to the target tenant, and tenant network segment information allocated to the target tenant; Based on the target tenant information, a target computing server and a tenant network segment allocated to the target tenant are determined.

3. The method according to claim 2, characterized in that If the target tenant information does not include tenant network segment information allocated to the target tenant, the step of determining the tenant network segment allocated to the target tenant includes: An available network segment that meets a preset condition is determined from a preset address pool, and the available network segment is allocated to the target tenant as a tenant network segment.

4. The method according to any one of claims 1 to 3, characterized in that: On each logical virtual interface, the step of configuring an access policy for isolating the target tenant from other tenants based on the tenant network segment includes: Assign a VLAN ID to each logical virtual interface and use each logical virtual interface as the gateway interface of the corresponding server network segment; An ACL that denies all traffic by default is configured on each logical virtual interface, and an ACL that allows traffic corresponding to the tenant network segment is configured.

5. The method according to claim 1, characterized in that The method further comprises: When a tenant is detected to be offline, the computing server and tenant network segment allocated to the tenant are reclaimed.

6. A tenant isolation device, characterized in that: The device comprises: A determination unit, configured to determine a target computing server allocated to a target tenant, and determine a tenant network segment allocated to the target tenant; A splitting unit, configured to split the tenant network segment into m server network segments based on the number n of parameter network cards of the target computing server, and allocate a server network segment to each parameter network card of each target computing server connected to the same Leaf device, wherein m and n are positive integers, and m is greater than or equal to n; A creating unit, configured to create, for each Leaf device, a logical virtual interface corresponding to the target tenant on each Leaf device according to each physical downstream interface used to access each target computing server; A configuration unit is used to configure, on each logical virtual interface, an access policy for isolating the target tenant from other tenants based on the tenant network segment.

7. The device according to claim 6, characterized in that When determining the target computing server allocated to the target tenant and determining the tenant network segment allocated to the target tenant, the determining unit is specifically used to: Receive target tenant information sent by the cloud, wherein the target tenant information includes the target tenant name, target computing server information allocated to the target tenant, and tenant network segment information allocated to the target tenant; Based on the target tenant information, a target computing server and a tenant network segment allocated to the target tenant are determined.

8. The device according to claim 6 or 7, characterized in that When configuring, on each logical virtual interface, an access policy for isolating the target tenant from other tenants based on the tenant network segment, the configuration unit is specifically used to: Assign a VLAN ID to each logical virtual interface and use each logical virtual interface as the gateway interface of the corresponding server network segment; An ACL that denies all traffic by default is configured on each logical virtual interface, and an ACL that allows traffic corresponding to the tenant network segment is configured.

9. A tenant isolation device, characterized in that: The tenant isolation device comprises: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the steps of the method according to any one of claims 1 to 5 according to the obtained program instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to enable the computer to execute the steps of the method according to any one of claims 1 to 5.

Images