End-to-end large-scale RDMA network interconnection method

Abstract

The invention discloses an end-to-end large-scale RDMA (Remote Direct Memory Access) network interconnection method, which comprises the following steps of: establishing a plurality of virtual networks in an RDMA area of a sending end and a receiving end by adopting a virtualization technology, marking each virtual network, enabling each virtual network to correspond to a group of virtual links, identifying different virtual networks through virtual network identifiers, and establishing a plurality of RDMA network identifiers. An isolation mechanism is adopted between the virtual networks, each virtual network is allocated with independent resources including bandwidth and a buffer area, according to task requirements of different virtual networks, data on an RDMA link is encrypted, an access control strategy is established, access authority is limited, and an end-to-end flow control mechanism is established between a sending end and a receiving end. The SDN controller is used for programming the route, dynamically adjusting resource allocation in the virtual network, establishing a fault recovery mechanism, and quickly switching to a standby virtual link when the network has a fault, so that the problems of resource competition and virtual link performance reduction caused by the fact that a plurality of virtual links share one RDMA link resource can be solved.

Description

Technical Field

[0001] The present invention relates to the technical field of communication networks, and in particular to an end-to-end large-scale RDMA network interconnection method. Background Art

[0002] With the rapid development of technologies such as cloud computing, big data, and artificial intelligence, the requirements for the data transmission performance of computer networks are becoming increasingly higher. As a high-performance computer network communication technology, RDMA can achieve direct memory access to data, reduce CPU intervention, and significantly improve data transmission throughput and reduce latency.

[0003] The Chinese patent publication number: CN115623057A discloses a method, device, equipment and storage medium for establishing a connection based on RDMA. In the core technical solution of the invention, for the scenario where multiple communication links need to be established between upper-layer applications on both sides of the client and the server, a virtual link is abstracted on the RDMA link, allowing multiple virtual connections to be created on one RDMA link. Multiple virtual links share the resources of one RDMA link, so that the upper-layer applications on both sides can realize multi-channel data transmission through multiple virtual links carried on the same RDMA link. This can not only solve the problem of multiple communication links required between the upper-layer applications on both sides, but also reduce the number of RDMA links because the same RDMA link will carry multiple virtual links. To a certain extent, the problem of slow RDMA connection establishment is avoided, especially when the number of required links is large, the overall connection establishment speed can be significantly improved. In the prior art, multiple virtual links share the resources of one RDMA link. When multiple virtual links request resources at the same time, it will cause resource competition during the transmission process. Under high load conditions, the virtual link will have a performance degradation problem.

[0004] The present invention proposes a solution to the above shortcomings: using virtualization technology to establish multiple virtual networks in the RDMA area of ​​the sending end and the receiving end, and marking each virtual network with a unique identifier tag, each virtual network corresponds to a group of virtual links, and an isolation mechanism is used between virtual networks to allocate independent resources to each virtual network. According to the task requirements of different virtual networks, data on the RDMA link is encrypted, an access control policy is established, access rights are restricted, an end-to-end flow control mechanism is established between the sending end and the receiving end, the routing is programmed through the SDN controller, the flow resource allocation in the virtual network is dynamically adjusted, and a fault recovery mechanism is established to quickly switch to a backup virtual link when a network fault occurs, so as to solve the problem that multiple virtual links share one RDMA link resource, resource competition occurs, and the performance of the virtual link is degraded. Summary of the invention

[0005] In order to solve the above-mentioned technical problems, the present invention provides an end-to-end large-scale RDMA network interconnection method.

[0006] The technical solution of the present invention is implemented as follows: an end-to-end large-scale RDMA network interconnection method, comprising:

[0007] S1. Use virtualization technology to establish multiple virtual networks in the RDMA area of ​​the sending end and the receiving end, mark each virtual network, and each virtual network corresponds to a group of virtual links;

[0008] S2. Different virtual networks are identified by virtual network identifiers. An isolation mechanism is used between virtual networks. Each virtual network is allocated independent resources, including bandwidth and buffer.

[0009] S3. Encrypt data on the RDMA link according to the task requirements of different virtual networks, establish access control policies, and restrict access rights;

[0010] S4, establish an end-to-end flow control mechanism between the sender and the receiver, program the routing through the SDN controller, and dynamically adjust the resource allocation in the virtual network;

[0011] S5. Establish a fault recovery mechanism to quickly switch to a backup virtual link when a network failure occurs.

[0012] Furthermore, in the step S1, the virtualization technology is used to establish multiple virtual networks in the RDMA area of ​​the sending end and the receiving end, and a connection establishment request is sent from the sending end to the receiving end, a virtual network is established on the RDMA link, and the RDMA context of the virtual network is configured, including configuring an independent queue QP and an independent completion queue CP. In the RDMA area of ​​the sending end and the receiving end, the RDMA protocol RoCE is used to connect each independent queue QP to the queue QP corresponding to the remote node. When establishing a virtual network on the RDMA link, a unique identifier VNI label is assigned to mark each virtual network, each virtual network corresponds to a group of virtual links, and a group of virtual links includes a configured primary virtual link and a backup virtual link. VTEP is configured for the virtual network, and a VXLAN tunnel is established. Data packets are transmitted in the VTEP and the VXLAN tunnel through the unique identifier;

[0013] Furthermore, each virtual network corresponds to a set of virtual links set up as follows: Create a virtual network and select bridge mode for configuration, connect the virtual machine directly to the network interface card of the physical machine, assign a unique name and IP address to each virtual network, and on each virtual machine, use the ping command or other network tools to check connectivity with the external network.

[0014] Furthermore, in the S2 step, different virtual networks are identified by virtual network identifiers, an isolation mechanism is adopted between virtual networks, different subnets are identified according to the unique identifier VNI tag of each virtual network, the isolation mechanism selects a bridge isolation mechanism, a virtual bridge is created on the physical machine, and when a virtual machine is created, the network interface of the virtual machine is configured to connect to the previously created virtual bridge, an independent IP address is configured for each virtual machine in the same subnet, multiple independent virtual bridges are created, different virtual machines are connected to different virtual bridges, and independent broadband and buffer resources are allocated according to the bandwidth requirements and buffer usage of each virtual network.

[0015] Furthermore, in the step S3, according to the task requirements of different virtual networks, data on the RDMA link is encrypted, an access control policy is established, and according to the task requirements of different virtual networks, a symmetric encryption algorithm is implemented, and the data is converted into ciphertext using the encryption algorithm and encryption key. The encrypted data is transmitted in the VTEP and VXLAN tunnels through a unique identifier;

[0016] The sender uses the AES symmetric encryption algorithm and key to encrypt the data. The key is encrypting the data through permutation, substitution, and XOR operations. The encrypted data is transmitted to the receiver through the VTEP and VXLAN tunnel via the unique identifier of the RDMA link.

[0017] The receiving end uses the same AES symmetric encryption algorithm and key to decrypt the data, and the decrypted data is restored to the plaintext data;

[0018] The access control strategy is established by establishing a role-based access control (RBAC) model, defining users, roles, and permissions in the model, assigning users to corresponding roles based on their permission requirements, establishing a mapping between users and roles in the model, assigning permissions to corresponding roles based on permission scopes, establishing a mapping between roles and permissions, formulating an access control strategy based on the relationship mapping of the RBAC model, and limiting different access permissions based on the access control strategy to improve data security.

[0019] Furthermore, in the step S4, an end-to-end flow control mechanism is established between the transmitting end and the receiving end, the routing is programmed through the SDN controller, and the flow resources are allocated using the SDN controller according to the data transmission rate, delay requirements, and reliability requirements of the end-to-end flow control. The specific steps are:

[0020] S401, configure the SDN controller to collect network status information. The SDN controller interacts with the network device router (SND switch) through the southbound interface to integrate the load information on the link.

[0021] S402, traffic identification, SDN performs fine-grained identification and classification of traffic in the virtual network. Traffic types include interactive traffic and batch transmission traffic. Interactive traffic is small data packets and is transmitted frequently, while batch transmission traffic is large data packets and has a long transmission interval. Based on the programming capabilities of the SDN controller, flow tables are deployed on the network to identify and mark different types of traffic.

[0022] S403, traffic control, based on the identification of traffic, obtain the type and priority of traffic to classify and schedule the traffic. Traffic classification uses the identification port number, and traffic scheduling is performed through big data analysis. The priority of traffic is divided into standard priority and high priority. SDN implements traffic control strategy through centralized controller and programming capabilities;

[0023] S404, traffic optimization, the SDN controller dynamically adjusts the network topology according to the traffic load and delay by optimizing the network structure and traffic path.

[0024] Furthermore, the fault recovery mechanism is established in the step S5. When a network fault occurs, the network quickly switches to the backup virtual link. The BFD fast detection technology is established to monitor the status of the network virtual link in real time. When the main virtual link of the network is detected to fail, the switching mechanism is triggered to quickly switch to the backup virtual link to promptly respond to the occurrence of network failures.

[0025] Furthermore, the establishment of the fault recovery mechanism is specifically as follows: manually adding the peer neighbor information through static configuration to create a static BFD session. When the peer interface also turns on BFD and makes a correct response to the BFD message of the local end, the static BFD configuration is completed, and BFD control messages are periodically sent to each other to determine the session status. When multiple consecutive messages are not received, the virtual link fails, triggering the switching mechanism. Through the configured network equipment, it automatically switches to the backup virtual link when the main virtual link fails. If the automatic switching cannot meet the requirements, the administrator manually triggers the switching mechanism through an easy-to-operate switching interface or tool to quickly switch to the backup virtual link when the main virtual link fails.

[0026] Beneficial Effects

[0027] The present invention aims at the disadvantage that multiple virtual links in the prior art share the resources of one RDMA link, but when multiple virtual links request resources at the same time, resource competition occurs in the transmission process. By adopting virtualization technology, multiple virtual networks are established in the RDMA area of ​​the sending end and the receiving end, and each virtual network is marked with a unique identifier, each virtual network corresponds to a group of virtual links, and the problem of resource competition in the prior art is solved. The virtual network is isolated by an isolation mechanism, and data is encrypted by an encryption algorithm to ensure the security of data transmission. An access control policy is established to limit the access rights of users and improve the security of data. An end-to-end flow control mechanism is established between the sending end and the receiving end, and an SDN controller is used to dynamically adjust the resource allocation in the virtual network. By establishing a fault recovery mechanism, a switching mechanism is triggered when a network fault occurs, and the network is quickly switched to a backup virtual link, which solves the problem of performance degradation of the virtual link under high load. In the present invention, each virtual network corresponds to a group of virtual links, and a backup virtual link is established in each group of virtual links. Routing is programmed by the SDN controller to dynamically adjust the resource allocation problem in the virtual network, and the problem of resource competition and performance degradation of the virtual link is effectively solved. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A structural block diagram of an end-to-end large-scale RDMA network interconnection method in an embodiment of the present invention;

[0029] Figure 2 This is a flowchart of the steps of an end-to-end large-scale RDMA network interconnection method in an embodiment of the present invention;

[0030] Figure 3 A flowchart of encryption steps of a symmetric encryption algorithm for an end-to-end large-scale RDMA network interconnection method according to an embodiment of the present invention;

[0031] Figure 4 The present invention provides a flowchart of the steps of allocating traffic resources by an SDN controller in an end-to-end large-scale RDMA network interconnection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0033] The preferred implementation methods of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these implementation methods are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0034] It can be understood that the terms "first", "second", etc. used in the present application can be used in this article to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from another element.

[0035] When used herein, the singular forms "a", "an", and "said / the" may also include plural forms, unless the context clearly indicates otherwise. It should also be understood that the terms "include / comprise" or "have" and the like specify the presence of stated features, wholes, steps, operations, components, parts, or combinations thereof, but do not exclude the possibility of the presence or addition of one or more other features, wholes, steps, operations, components, parts, or combinations thereof. At the same time, the term "and / or" used in this specification includes any and all combinations of the relevant listed items.

[0036] See also Figure 1-Figure 4 As shown, an end-to-end large-scale RDMA network interconnection method includes:

[0037] S1. Use virtualization technology to establish multiple virtual networks in the RDMA area of ​​the sending end and the receiving end, mark each virtual network, and each virtual network corresponds to a group of virtual links;

[0038] S2. Different virtual networks are identified by virtual network identifiers. An isolation mechanism is used between virtual networks. Each virtual network is allocated independent resources, including bandwidth and buffer.

[0039] S3. Encrypt data on the RDMA link according to the task requirements of different virtual networks, establish access control policies, and restrict access rights;

[0040] S4, establish an end-to-end flow control mechanism between the sender and the receiver, program the routing through the SDN controller, and dynamically adjust the resource allocation in the virtual network;

[0041] S5. Establish a fault recovery mechanism to quickly switch to a backup virtual link when a network failure occurs.

[0042] like Figure 1-Figure 2 As shown, in the step S1, virtualization technology is used to establish multiple virtual networks in the RDMA area of ​​the sending end and the receiving end, and each virtual network is marked, and each virtual network corresponds to a group of virtual links;

[0043] Specifically, in step S1, multiple virtual networks are established in the RDMA area of ​​the sending end and the receiving end by using virtualization technology, a connection establishment request is sent from the sending end to the receiving end, a virtual network is established on the RDMA link, and the RDMA context of the virtual network is configured, including configuring an independent queue QP and an independent completion queue CP, and each independent queue QP is connected to the queue QP corresponding to the remote node by using the RDMA protocol RoCE in the RDMA area of ​​the sending end and the receiving end. When establishing a virtual network on the RDMA link, a unique identifier VNI label is assigned to mark each virtual network, each virtual network corresponds to a group of virtual links, and a group of virtual links includes a configured primary virtual link and a backup virtual link, and VTEP is configured for the virtual network, and a VXLAN tunnel is established. The data packet is transmitted in the VTEP and the VXLAN tunnel through the unique identifier;

[0044] Each virtual network corresponds to a set of virtual links: create a virtual network, select the bridge mode for configuration, directly connect the virtual machine to the network interface card of the physical machine, assign a unique name and IP address to each virtual network, and on each virtual machine, use the ping command or other network tools to check the connectivity with the external network.

[0045] like Figure 1-Figure 2 As shown, in the step S2, different virtual networks are identified by virtual network identifiers, an isolation mechanism is adopted between virtual networks, and each virtual network is allocated independent resources, including bandwidth and buffer;

[0046] Specifically, in step S2, different virtual networks are identified by virtual network identifiers, an isolation mechanism is adopted between virtual networks, different subnets are identified according to the unique identifier VNI tag of each virtual network, the isolation mechanism selects a bridge isolation mechanism, a virtual bridge is created on the physical machine, and when creating a virtual machine, the network interface of the virtual machine is configured to connect to the previously created virtual bridge, an independent IP address is configured for each virtual machine in the same subnet, multiple independent virtual bridges are created, different virtual machines are connected to different virtual bridges, and independent broadband and buffer resources are allocated according to the bandwidth requirements and buffer usage of each virtual network.

[0047] like Figure 1-Figure 3 As shown, in the step S3, data on the RDMA link is encrypted according to the task requirements of different virtual networks, an access control policy is established, and access rights are restricted;

[0048] Specifically, in step S3, according to the task requirements of different virtual networks, the data on the RDMA link is encrypted, an access control policy is established, and according to the task requirements of different virtual networks, a symmetric encryption algorithm is implemented to convert the data into ciphertext using the encryption algorithm and encryption key. The encrypted data is transmitted in the VTEP and VXLAN tunnels through a unique identifier;

[0049] The sender uses the AES symmetric encryption algorithm and key to encrypt the data. The key is encrypting the data through permutation, substitution, and XOR operations. The encrypted data is transmitted to the receiver through the VTEP and VXLAN tunnels through the unique identifier of the RDMA link. The symmetric encryption algorithm AES uses the ECB mode. The encryption steps are as follows:

[0050] S301, key and plaintext preparation, prepare the initial key and plaintext, if the plaintext is less than byte, use PKCS#7 to fill it;

[0051] S302, key expansion, expanding the initial key into multiple sub-keys;

[0052] S303, in the initial round, perform a round key addition operation, perform an XOR operation on the plaintext and the first subkey after expansion, and obtain a state matrix;

[0053] S304, main round, perform 10, 12 or 14 rounds of iterations according to the key length, each round includes 4 steps, according to byte substitution, row shift, column confusion, and round key addition;

[0054] S305, final round, the last round executes 3 steps, according to byte substitution, row shift, and round key addition;

[0055] The receiving end uses the same AES symmetric encryption algorithm and key to decrypt the data, and the decrypted data restores the plaintext data. The decryption process is the inverse process of the encryption process, specifically:

[0056] Initial round: perform round key addition operation;

[0057] Main rounds: reverse execution of round key addition, reverse column confusion, reverse row shift, and reverse byte substitution operations;

[0058] Final round: perform reverse shift, reverse byte substitution, and reverse round key addition operations;

[0059] Establish an access control strategy by establishing a role-based access control (RBAC) model, define users, roles, and permissions in the model, assign users to corresponding roles based on their permission requirements, establish a mapping between users and roles in the model, assign permissions to corresponding roles based on the scope of permissions, establish a mapping between roles and permissions, and formulate an access control strategy based on the relationship mapping of the RBAC model. The access strategy is that when a user attempts to access system resources, the system determines whether the user has access rights based on the role and permissions the user has. If the user has the corresponding permissions, the access request is allowed, otherwise, the access request is denied. By restricting different access rights, data security is improved. Among them, all user information of users, roles, and permissions involved in this manual has been legally authorized.

[0060] like Figure 1-Figure 4 As shown, in the step S4, an end-to-end flow control mechanism is established between the sending end and the receiving end, and the routing is programmed through the SDN controller to dynamically adjust the resource allocation in the virtual network;

[0061] Specifically, in step S4, an end-to-end flow control mechanism is established between the sending end and the receiving end, the routing is programmed through the SDN controller, and the flow resources are allocated using the SDN controller according to the data transmission rate, delay requirements, and reliability requirements of the end-to-end flow control. The specific steps are as follows:

[0062] S401, configure the SDN controller to collect network status information. The SDN controller interacts with the network device router (SND switch) through the southbound interface to integrate the load information on the link.

[0063] S402, traffic identification, SDN performs fine-grained identification and classification of traffic in the virtual network. Traffic types include interactive traffic and batch transmission traffic. Interactive traffic is small data packets and is transmitted frequently, while batch transmission traffic is large data packets and has a long transmission interval. Based on the programming capabilities of the SDN controller, flow tables are deployed on the network to identify and mark different types of traffic.

[0064] S403, traffic control, based on the identification of traffic, obtain the type and priority of traffic to classify and schedule the traffic. Traffic classification uses the identification port number, and traffic scheduling is performed through big data analysis. The priority of traffic is divided into standard priority and high priority. SDN implements traffic control strategy through centralized controller and programming capabilities;

[0065] S404, traffic optimization, the SDN controller dynamically adjusts the network topology according to the traffic load and delay by optimizing the network structure and traffic path;

[0066] In step S404, the network topology is dynamically adjusted by using the shortest path Dijkstra algorithm:

[0067] Two sets P and Q are introduced. The data of sets P and Q include traffic load and delay. Set P records the vertices whose shortest paths have been found, and set Q records the vertices whose shortest paths have not yet been found.

[0068] Initialization: The distance of the starting point is set to 0, and the distances of other vertices are set to infinity (indicating that the point has not been found). During initialization, the set P only contains the starting point p, and the set Q contains all vertices except the starting point p;

[0069] Execution process: Select the vertex k with the shortest distance to the starting point p from the set Q, and add the vertex k to the set P. At the same time, remove the vertex k from the set Q, update the distance from each vertex in the set Q to the starting point p, update the vertices in the set Q and the paths corresponding to the vertices, and then find the vertex with the shortest path from the set Q;

[0070] The steps of the initialization and execution process are repeated until all vertices have been visited, and the traffic resources are transmitted through the shortest vertex found in the set Q until they can be transmitted throughout the entire network topology.

[0071] like Figure 1-Figure 4 As shown, in the step S5, a fault recovery mechanism is established to quickly switch to a backup virtual link when a network failure occurs;

[0072] Specifically, in step S5, a fault recovery mechanism is established. When a network fault occurs, the backup virtual link is quickly switched to. By establishing a BFD fast detection technology, the status of the network virtual link is monitored in real time. When a fault occurs in the main virtual link of the detected network, the switching mechanism is triggered to quickly switch to the backup virtual link to respond to the occurrence of network faults in a timely manner.

[0073] In step S5, the establishment of the fault recovery mechanism is specifically as follows: manually adding the peer neighbor information through static configuration to create a static BFD session. When the peer interface also turns on BFD and correctly responds to the BFD message of the local end, the static BFD configuration is completed, and BFD control messages are periodically sent to each other to determine the session status. When multiple consecutive messages are not received, the virtual link fails, triggering the switching mechanism. Through the configured network equipment, it automatically switches to the backup virtual link when the main virtual link fails. If the automatic switching cannot be met, the administrator manually triggers the switching mechanism through an easy-to-operate switching interface or tool, and quickly switches to the backup virtual link when the main virtual link fails.

[0074] In step S5, the configuration of the backup virtual link is specifically as follows: the path of the backup virtual link selects a shorter path and avoids network bottlenecks, and reserves sufficient network broadband resources to ensure that when the main virtual link fails, the backup virtual link can be started in time, and the availability of the backup virtual link is regularly tested by sending test data packets and simulating network main virtual link failures. By setting an alarm mechanism, when a failure of the backup virtual link is detected, an alarm notification is sent to promptly notify the administrator, and the alarm is sent in the form of emails and text messages.

[0075] like Figure 1-Figure 4 As shown, the present invention solves the problem that multiple virtual links share one RDMA link resource in the prior art, and when resources are requested at the same time, resource competition occurs during the transmission process, and the performance of the virtual link is degraded. The present invention works as follows:

[0076] Use virtualization technology to establish multiple virtual networks in the RDMA area of ​​the sender and receiver, mark each virtual network, and each virtual network corresponds to a group of virtual links;

[0077] Different virtual networks are identified by virtual network identifiers. An isolation mechanism is used between virtual networks, and each virtual network is allocated independent resources, including bandwidth and buffer.

[0078] According to the task requirements of different virtual networks, encrypt the data on the RDMA link, establish access control policies, and restrict access rights;

[0079] Establish an end-to-end flow control mechanism between the sender and the receiver, program the routing through the SDN controller, and dynamically adjust the resource allocation in the virtual network;

[0080] Establish a fault recovery mechanism to quickly switch to a backup virtual link when a network failure occurs.

[0081] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0082] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and rules of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for end-to-end large-scale RDMA network interconnection, characterized by: S1. Use virtualization technology to establish multiple virtual networks in the RDMA area of ​​the sending end and the receiving end, mark each virtual network, and each virtual network corresponds to a group of virtual links; S2. Different virtual networks are identified by virtual network identifiers. An isolation mechanism is used between virtual networks. Each virtual network is allocated independent resources, including bandwidth and buffer. S3. Encrypt data on the RDMA link according to the task requirements of different virtual networks, establish access control policies, and restrict access rights; According to the task requirements of different virtual networks, data on the RDMA link is encrypted, access control policies are established, and symmetric encryption algorithms are implemented according to the task requirements of different virtual networks. The data is converted into ciphertext using encryption algorithms and encryption keys, and the encrypted data is transmitted in VTEP and VXLAN tunnels through unique identifiers; The sender uses the AES symmetric encryption algorithm and key to encrypt the data. The key is encrypting the data through permutation, substitution, and XOR operations. The encrypted data is transmitted to the receiver through the VTEP and VXLAN tunnel via the unique identifier of the RDMA link. The receiving end uses the same AES symmetric encryption algorithm and key to decrypt the data, and the decrypted data is restored to the plaintext data; S4, establish an end-to-end flow control mechanism between the sender and the receiver, program the routing through the SDN controller, and dynamically adjust the resource allocation in the virtual network; S5. Establish a fault recovery mechanism to quickly switch to a backup virtual link when a network failure occurs.

2. The end-to-end large-scale RDMA network interconnection method according to claim 1, characterized in that: The method adopts virtualization technology to establish multiple virtual networks in the RDMA area of ​​the sending end and the receiving end, sends a connection request from the sending end to the receiving end, establishes a virtual network on the RDMA link, configures the RDMA context of the virtual network, including configuring an independent queue QP and an independent completion queue CP, uses the RDMA protocol RoCE in the RDMA area of ​​the sending end and the receiving end to connect each independent queue QP to the queue QP corresponding to the remote node, and when establishing a virtual network on the RDMA link, allocates a unique identifier VNI label to mark each virtual network, each virtual network corresponds to a group of virtual links, a group of virtual links includes a configured main virtual link and a backup virtual link, and configures VTEP for the virtual network, establishes a VXLAN tunnel, and data packets are transmitted in the VTEP and VXLAN tunnel through the unique identifier.

3. The end-to-end large-scale RDMA network interconnection method according to claim 1, characterized in that: Different virtual networks are identified through virtual network identifiers, and an isolation mechanism is adopted between virtual networks. Different subnets are identified according to the unique identifier VNI tag of each virtual network. The isolation mechanism selects a bridge isolation mechanism, and a virtual bridge is created on the physical machine. When creating a virtual machine, the network interface of the virtual machine is configured to connect to the previously created virtual bridge, and an independent IP address is configured for each virtual machine in the same subnet. Multiple independent virtual bridges are created, and different virtual machines are connected to different virtual bridges. Independent broadband and buffer resources are allocated according to the broadband requirements and buffer usage of each virtual network.

4. The end-to-end large-scale RDMA network interconnection method according to claim 1, characterized in that: The end-to-end flow control mechanism is established between the sending end and the receiving end, the routing is programmed through the SDN controller, and the flow resources are allocated by the SDN controller according to the data transmission rate, delay requirements, and reliability requirements of the end-to-end flow control.

5. The end-to-end large-scale RDMA network interconnection method according to claim 4, characterized in that: The specific steps of allocating traffic resources by using the SDN controller include: S401, configure the SDN controller to collect network status information. The SDN controller interacts with the network device router through the southbound interface to integrate the load information on the link; S402, traffic identification, SDN performs fine-grained identification and classification of traffic in the virtual network. Traffic types include interactive traffic and batch transmission traffic. Interactive traffic is small data packets and is transmitted frequently, while batch transmission traffic is large data packets and has a long transmission interval. Based on the programming capabilities of the SDN controller, flow tables are deployed on the network to identify and mark different types of traffic. S403, traffic control, based on the identification of traffic, obtain the type and priority of traffic to classify and schedule the traffic. Traffic classification uses the identification port number, and traffic scheduling is performed through big data analysis. The priority of traffic is divided into standard priority and high priority. SDN implements traffic control strategy through centralized controller and programming capabilities; S404, traffic optimization, the SDN controller dynamically adjusts the network topology according to the traffic load and delay by optimizing the network structure and traffic path.

6. The end-to-end large-scale RDMA network interconnection method according to claim 1, characterized in that: The fault recovery mechanism is established to quickly switch to the backup virtual link when a network failure occurs. By establishing the BFD fast detection technology, the status of the network virtual link is monitored in real time. When the main virtual link of the network is detected to fail, the switching mechanism is triggered to quickly switch to the backup virtual link.

7. The end-to-end large-scale RDMA network interconnection method according to claim 6, characterized in that: The fault recovery mechanism is established by manually adding the neighbor information of the other end through static configuration to create a static BFD session. When the interface of the other end also turns on BFD and correctly responds to the BFD message of the local end, the static BFD configuration is completed, and BFD control messages are periodically sent to each other to determine the session status. When multiple consecutive messages are not received, the virtual link fails, triggering the switching mechanism. Through the configured network equipment, it automatically switches to the backup virtual link when the main virtual link fails. When the automatic switching cannot meet the requirements, the administrator manually triggers the switching mechanism through an easy-to-operate switching interface or tool, and quickly switches to the backup virtual link when the main virtual link fails.

Images