Cross-virtual private network communication method, device, equipment and medium

Abstract

The invention discloses a cross-virtual private network communication method and device, equipment and a medium, and relates to the technical field of cloud networks, and the method comprises the steps: sending a network connector creation request to a back-end processing system, so that the back-end processing system verifies parameters, and if the verification is passed, obtaining a virtual network equipment ip; creating a network connector based on the virtual network equipment ip, creating a network bridge and a hook function, and connecting the network connector and the router namespace, so that the network connector obtains a target message; determining the type of cross-virtual private network communication based on the target message, if the type is cross-virtual private network communication of the same host machine, creating a virtual device interface, and transmitting the target message to a target virtual machine based on the virtual device interface, a router namespace and a network bridge; and if the type is cross-host cross-virtual private network communication, transmitting the target message to the target virtual machine based on the network connector to complete cross-virtual private network communication. And the communication requirements of virtual machines in different scenes are met.

Description

Technical Field

[0001] The present invention relates to the field of cloud network technology, and in particular to a method, device, equipment and medium for cross-virtual private network communication. Background Art

[0002] Cloud data center network is a new type of data center based on cloud computing architecture. Its computing, storage and network resources are loosely coupled, and various IT (Information Technology) equipment is fully virtualized. It has a high degree of modularization, automation and green energy saving. The characteristics of cloud data center network are, first of all, high virtualization, including server, storage, application and other virtualization, and users can call various resources on demand; secondly, high degree of automated management, including automated management of physical servers and virtual servers, automated process management of related businesses, and automated management of customer service charges. Virtual Private Cloud (VPC) is a cloud virtual network environment provided by cloud data center network, providing users with a secure and isolated private resource deployment platform. Users can plan IP address ranges and network segments, configure security groups, network ACL (Access Control List), and routing tables to achieve all-round management of private networks. Virtual private networks provide network services such as VPC, subnets, routing tables, and access control to achieve management of network resources. Virtual private network VPC is a user-defined private network. Different virtual private networks are logically isolated at the second layer. Users can create and manage cloud product instances in their own virtual private networks, such as cloud servers, cloud databases, and load balancing. The underlying virtual private network uses a VPC corresponding to a router, which can contain multiple subnets, each corresponding to a subnet, and has the characteristics of high availability, flexibility, and security.

[0003] At present, the communication methods across virtual private networks in cloud data center networks include: communication through floating IP (Internet Protocol) addresses, peer-to-peer connections, enterprise routers, etc. The floating IP method requires binding a floating IP to the virtual machine, and the message needs to flow back to the destination virtual machine through the external network, which undoubtedly reduces the security of the data and increases the pressure on the external gateway; the peer-to-peer connection method can only realize communication between two virtual private networks, and it is necessary to occupy computing resources to start a routing proxy server. At the same time, it is necessary to configure a special network segment for the proxy server to guide the traffic across virtual private networks to the proxy server and divert it through static routing. Although this method increases security, it consumes computing resources and network address resources, and at the same time, the traffic pressure is given to the proxy server, and the abnormal risk increases; the enterprise router can realize communication between two or more virtual private networks, and the routing configuration is more flexible, but the enterprise router also needs to divert traffic through the proxy server, consuming computing resources in exchange for flexible use of services.

[0004] In summary, how to increase the flexibility of routing selection, reduce the consumption of computing resources, and improve the reliability of cross-VPN communications are issues that need to be addressed urgently. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a method, device, equipment and medium for cross-virtual private network communication, which can increase the flexibility of route selection, reduce the consumption of computing resources, and improve the reliability of cross-virtual private network communication. The specific scheme is as follows:

[0006] In a first aspect, the present application provides a method for cross-virtual private network communication, comprising:

[0007] Sending a network connector creation request generated based on the cloud data center to a backend processing system of the cloud data center controller so that the backend processing system verifies the parameters corresponding to the network connector creation request, and if the verification passes, obtains the virtual network device IP from the virtual private network;

[0008] Creating a network connector of a computing node based on the virtual network device IP, creating a network bridge of all host machines, creating a hook function in a router namespace corresponding to a virtual private network on the current host machine, and connecting the network connector with the router namespace so that the network connector obtains a target message captured by the hook function;

[0009] Determine the type of cross-virtual private network communication based on the target message, and if the type is cross-virtual private network communication within the same host machine, create a virtual device interface, and transmit the target message to the destination virtual machine based on the virtual device interface, the router namespace, and the bridge;

[0010] If the type is cross-host machine and cross-virtual private network communication, the target message is transmitted to the destination virtual machine based on the network connector to complete the cross-virtual private network communication.

[0011] Optionally, the step of creating a network bridge for all host machines includes:

[0012] Based on the backend processing system, the virtual machine corresponding to the virtual private network is queried to determine the corresponding relationship between the host machine, the virtual private network and the virtual machine, and a network bridge of all the host machines is created based on the corresponding relationship.

[0013] Optionally, determining the type of cross-virtual private network communication based on the target message includes:

[0014] Parsing the target message through the network connector to obtain a destination media access control address and an IP address;

[0015] The port information of the virtual machine in the database is queried according to the destination media access control address and the IP address, and the type of cross-virtual private network communication is determined based on the port information.

[0016] Optionally, the creating a virtual device interface, and transmitting the target message to the destination virtual machine based on the virtual device interface, the router namespace, and the bridge, includes:

[0017] Based on the virtual private network, configure the target virtual network device ip for the virtual device interface corresponding to the router namespace;

[0018] Create the virtual device interface according to the target virtual network device IP, and connect the router namespace and the bridge through the virtual device interface;

[0019] After the router namespace and the bridge are connected, the target message is directed to the bridge based on the diversion route issued by the router namespace, so that the bridge transmits the target message to the destination virtual machine.

[0020] Optionally, before transmitting the target message to the destination virtual machine based on the virtual device interface, the router namespace and the bridge, the method further includes:

[0021] Determining, by the backend processing system, whether the number of the virtual private networks in the current host machine is greater than or equal to a preset threshold;

[0022] If so, a new diversion route is created based on the router namespace according to the number of the virtual private networks in the current host machine, so as to utilize the new diversion route to transmit the target message.

[0023] Optionally, transmitting the target message to the destination virtual machine based on the network connector includes:

[0024] The target message is encapsulated based on the network connector, and the corresponding encapsulated message is sent to the target computing node so that the target computing node parses the encapsulated message to obtain the target message, and the target message is sent to the target router namespace corresponding to the target virtual private network, and the target message is transmitted to the destination virtual machine through the target router namespace.

[0025] Optionally, the method further includes:

[0026] If the virtual machine corresponding to the virtual private network under the network connector is destroyed or migrated, determining whether the virtual machine corresponding to the virtual private network exists in the host machine corresponding to the network connector;

[0027] If it does not exist, deleting the hook function and the virtual device interface;

[0028] If it exists, the hook function and the virtual device interface are not processed.

[0029] In a second aspect, the present application provides a cross-virtual private network communication device, comprising:

[0030] A virtual network device IP acquisition module, used to send a network connector creation request generated based on a cloud data center to a backend processing system of a cloud data center controller, so that the backend processing system verifies the parameters corresponding to the network connector creation request, and if the verification passes, obtains the virtual network device IP from a virtual private network;

[0031] A target message acquisition module is used to create a network connector of a computing node based on the virtual network device IP, create a network bridge of all host machines, create a hook function in the router namespace corresponding to the virtual private network on the current host machine, and connect the network connector with the router namespace so that the network connector can obtain the target message captured by the hook function;

[0032] A first target message transmission module is used to determine the type of cross-virtual private network communication based on the target message, and if the type is cross-virtual private network communication within the same host machine, create a virtual device interface, and transmit the target message to a destination virtual machine based on the virtual device interface, the router namespace, and the bridge;

[0033] The second target message transmission module is used to transmit the target message to the destination virtual machine based on the network connector to complete the cross-virtual private network communication if the type is cross-host machine and cross-virtual private network communication.

[0034] In a third aspect, the present application provides an electronic device, including:

[0035] Memory, used to store computer programs;

[0036] The processor is used to execute the computer program to implement the cross-virtual private network communication method as described above.

[0037] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the cross-virtual private network communication method as described above is implemented.

[0038] In summary, the present application first sends a network connector creation request generated based on a cloud data center to a back-end processing system of a cloud data center controller, so that the back-end processing system verifies the parameters corresponding to the network connector creation request, and if the verification passes, obtains a virtual network device IP from a virtual private network; creates a network connector for a target computing node based on the virtual network device IP, creates a bridge for all the host machines, creates a hook function in a router namespace corresponding to the virtual private network on the current host machine, connects the network connector with the router namespace, so that the network connector obtains a target message captured by the hook function; determines the type of cross-virtual private network communication based on the target message, and if the type is cross-virtual private network communication on the same host machine, creates a virtual device interface, and transmits the target message to a destination virtual machine based on the virtual device interface, the router namespace, and the bridge; if the type is cross-host cross-virtual private network communication, transmits the target message to the destination virtual machine based on the network connector and the router namespace to complete the cross-virtual private network communication. It can be seen that the present application first sends the network connector creation request generated based on the cloud data center to the back-end processing system of the cloud data center controller, and the back-end system verifies the request parameters. After the verification is passed, the virtual network device IP is obtained from the virtual private network, and the network connector is created based on the virtual network device IP. Then, the bridge of all host machines is created, and the hook function is created in the router namespace corresponding to the virtual private network on the current host machine and the network connector is connected to the router namespace, so that the network connector obtains the target message captured by the hook function, and the cross-virtual private network communication type is determined based on the target message. If it is a cross-virtual private network communication between the same host machine, a virtual device interface is created, and the target message is transmitted to the destination virtual machine based on the virtual device interface, the router namespace and the bridge. If it is a cross-virtual private network communication between cross-host machines, the target message is transmitted to the destination virtual machine through the network connector and the router namespace to complete the cross-virtual private network communication. In this way, by adopting different communication methods for different cross-virtual private network communication types, the smooth completion of cross-virtual private network communication is guaranteed, the communication needs between virtual machines in different scenarios are met, and the flexible routing configuration of cross-virtual private network communication is realized, and the consumption of computing resources is reduced. The network connector and hook function are used at the same time to report the message to the network connector for processing, thereby enhancing the security and reliability of network communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0040] Figure 1 A flow chart of a cross-virtual private network communication method disclosed in the present invention;

[0041] Figure 2 A schematic diagram of communication between the same host machine and a virtual private network disclosed in the present invention;

[0042] Figure 3 A schematic diagram of communication between multiple virtual private networks on the same host machine disclosed in the present invention;

[0043] Figure 4 A schematic diagram of cross-host and cross-virtual private network communication disclosed in the present invention;

[0044] Figure 5 A schematic diagram of the structure of a cross-virtual private network communication device disclosed in the present invention;

[0045] Figure 6 The present invention is a structural diagram of an electronic device disclosed in the present invention. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] At present, the communication methods across virtual private networks in cloud data center networks include: communication through floating IP addresses, peer-to-peer connections, enterprise routers, etc. The floating IP method requires binding a floating IP to the virtual machine, and the message needs to flow back to the virtual machine at the destination through the external network, which undoubtedly reduces the security of the data and increases the pressure on the external gateway; the peer-to-peer connection method can only realize communication between two virtual private networks, and it is necessary to occupy computing resources to start a routing proxy server, and at the same time, it is necessary to configure a special network segment for the proxy server to guide the traffic across the virtual private network to the proxy server, and divert it through static routing. Although this method increases security, it consumes computing resources and network address resources, and at the same time, the traffic pressure is given to the proxy server, and the abnormal risk increases; the enterprise router can realize communication between two or more virtual private networks, and the routing configuration is more flexible, but the enterprise router also needs to divert through the proxy server, and consume computing resources in exchange for the flexible use of services. In order to solve the above technical problems, the present application provides a method, device, equipment and medium for cross-virtual private network communication, which can increase the flexibility of routing selection, reduce the consumption of computing resources, and improve the reliability of cross-virtual private network communication.

[0048] In a specific embodiment, the implementation basic environment of the method of the present application is a cloud data center deployed with a container cluster, the container used is Kubernates, the cloud platform is openstack, and the present application provides a cloud data center controller and a network connector, which are deployed in the container in the form of microservices and communicate with the computing node through the management data network. The cloud data center controller provides a unified management platform for computing, storage, network, monitoring and other information, and the network connector processes and encapsulates messages to achieve communication across virtual private networks. Specifically, the cloud data center includes a configuration interface for cross-virtual private network communication and a back-end processing system of the cloud data center controller. One or more virtual private networks can be added to the network connector through the configuration interface for cross-virtual private network communication, and more refined routing communication control rules can be divided according to the network segments within the virtual private network; the validity of the parameters is verified according to the back-end processing system of the cloud data center console, and the virtual private network information and connection network segment information of the network connector are stored in the database after the verification is passed, and a virtual device ip is allocated from the virtual private network. The network connector can process and encapsulate messages for communication between virtual private networks, receive cross-virtual private network traffic reported from the router namespace of the virtual private network, and encapsulate messages and send them to the router namespace of the destination end through the destination virtual machine data stored in the database. The virtual device interface is a virtual network device pair. The port IP address of the virtual device interface is allocated from the virtual private network. One end of the virtual device interface is added to the router namespace of the virtual private network, and the other end is added to the bridge. In this way, the traffic between the router namespaces of the two virtual private networks is connected, and communication across virtual private networks on the same host is realized. The bridge is created on the computing node where the virtual machine under the virtual private network is located. It plays the role of connecting the virtual device interface, so that the traffic between different virtual private networks in the same host can be forwarded at the data link layer. It is an important component of cross-virtual private network communication on the same host. The hook function is used to capture messages for cross-VPN communication and send them to the network connector through the online communication protocol. The network connector receives the message and parses the original destination IP / MAC (Media Access Control) for judgment. If the message is for access to the same host, it will not be processed. If it is for access across hosts, the message will be encapsulated and sent to the destination computing node. After receiving the message, the destination computing node parses the message and gives it to the corresponding router namespace, which then sends the message to the corresponding destination virtual machine. Finally, different communication methods are used for different types of cross-VPN communication.

[0049] See also Figure 1 As shown, an embodiment of the present invention discloses a method for cross-virtual private network communication, including:

[0050] Step S11: Send the network connector creation request generated based on the cloud data center to the back-end processing system of the cloud data center controller so that the back-end processing system verifies the parameters corresponding to the network connector creation request. If the verification passes, the virtual network device IP is obtained from the virtual private network.

[0051] In this embodiment, the user requests to create a network connector in the cloud data center console. First, the virtual private network to be connected in the network connector is selected. The subnet segments of the virtual private network in the network connector cannot overlap. If there is overlap, an error reminder will be directly reported. This is to ensure the uniqueness of network address allocation and the accuracy of network communication, and to avoid problems such as IP address conflicts and network communication confusion caused by overlapping segments. At the same time, the request to create a network connector is sent to the back-end processing system of the cloud data center controller. The back-end processing system verifies the validity of the parameters. After the verification, the virtual private network information and connection segment information of the network connector are stored in the database, and a veth IP is allocated from the virtual private network. The back-end processing system is responsible for verifying the various parameters corresponding to the received network connector creation request. These parameters cover multiple aspects, including the type of network connector, the identifier of the virtual private network to be connected, the expected communication bandwidth requirements, security configuration parameters, etc. The back-end processing system will verify the parameters one by one according to the pre-set rules and standards to ensure that these parameters meet the overall requirements of the cloud data center network architecture and related security policies. If the verification passes, the virtual private network information and connection segment information of the network connector are completely and accurately stored in the database. This information is helpful for subsequent network management, monitoring, and troubleshooting. Next, obtain the virtual network device IP from the virtual private network, so that a network connector can be created based on the virtual network device IP. In addition, the cloud data center controller provides a configuration interface for cross-virtual private network communication. Users can add one or more virtual private networks to the network connector as needed. For the virtual private networks in the network connector, more detailed routing communication control rules can also be divided according to the network segments within the virtual private network.

[0052] Step S12: Create a network connector for the computing node based on the virtual network device IP, create a bridge for all host machines, create a hook function in the router namespace corresponding to the virtual private network on the current host machine, and connect the network connector to the router namespace so that the network connector can obtain the target message captured by the hook function.

[0053] In this embodiment, after the backend processing system completes the parameter verification of the request to create a network connector, successfully stores the virtual private network information and connection segment information of the network connector in the database, and allocates a virtual network device IP, a network connector is created based on the virtual network device IP. Next, the backend processing system will query all virtual machines under the virtual private network. The backend processing system obtains the host information of each virtual machine by interacting with various relevant components of the cloud data center and retrieving the information stored in the database, and then sorts out the corresponding relationship between the host, the virtual private network and the virtual machine. After obtaining the corresponding relationship between the host, the virtual private network and the virtual machine, the backend processing system will send an instruction to create a bridge to all host machines for each host according to the corresponding virtual private network and virtual machine. After receiving the instruction to create a bridge sent by the backend processing system, the host will create a bridge based on the corresponding relationship. In this way, by creating a bridge through the corresponding relationship, the network architecture of the cloud data center can be further optimized, so that virtual machines under different virtual private networks can achieve smoother and more efficient network communication through these bridges and network connectors. To distinguish the name of the bridge, the suffix of the network connector's id is used as the bridge name. The port IP address of the vethpair is allocated from within the virtual private network. The allocation principle is: the first subnet created in the virtual private network provides the port IP address, one end of the veth pair is added to the qRouter of the virtual private network, and the other end is added to the bridge. When the current computing node has a virtual machine of the virtual private network under the network connector, a bridge and vethpair are created. When the virtual machine is destroyed or migrated, if there is no virtual machine of the virtual private network of the network connector on the computing node, the veth pair is released.

[0054] In addition, after the network connector is created, you can add or delete virtual private networks within the network connector. After adding a virtual machine private network, the host machines where the virtual machines under this virtual machine private network are located are counted, and the host machines are traversed to modify qRouter (router namespace) and bridge to ensure that cross-segment traffic can communicate normally.

[0055] Further, after the bridge on the host is created, a hook function is created in the router namespace corresponding to the virtual private network for each virtual private network in the host, and the hook function is used to capture messages for cross-virtual private network communication. The present application connects the network connector to the router namespace, and the network connector can obtain the messages for cross-virtual private network communication captured by the hook function.

[0056] Step S13: determine the type of cross-virtual private network communication based on the target message; if the type is cross-virtual private network communication within the same host machine, create a virtual device interface; and transmit the target message to the destination virtual machine based on the virtual device interface, the router namespace, and the bridge.

[0057] In this embodiment, the network connector of the cloud data center has both cross-virtual private networks on the same host and cross-virtual private networks on the same host. Therefore, it is necessary to first determine whether the current communication type is cross-virtual private network communication between the same host or cross-virtual private network communication between hosts. The present application determines the type of cross-virtual private network communication based on the target message. First, the target message is parsed through the network connector to obtain the destination media access control address and IP address; the port information of the virtual machine in the database is queried according to the destination media access control address and IP address, and the type of cross-virtual private network communication is determined based on the port information. Specifically, a message collector will be built into qRouter, which will send the collected cross-virtual private network messages to the network connector, and the network connector will analyze and process the messages. The type of message is determined by the virtual machine information in the database, whether it is the same virtual private network or cross-virtual private network, the same host or cross-host. After receiving the message, the network connector queries the information of the virtual machine port in the database according to the original destination MAC address and IP address of the inner message, and determines the host machine and the virtual private network to which the two virtual machines belong through the virtual machine where the port is located.

[0058] In this embodiment, after parsing the target message, if it is determined that the communication is Figure 2 In the case of the same host machine across virtual private networks shown in FIG, the target virtual network device IP is configured for the virtual device interface veth pair corresponding to the router namespace based on the virtual private network; a virtual device interface is created according to the target virtual network device IP, and the router namespace and the bridge are connected through the virtual device interface; after the router namespace and the bridge are connected, the target message is directed to the bridge based on the diversion route issued by the router namespace, so that the bridge transmits the target message to the destination virtual machine. Specifically, first, the virtual device interface establishes a connection between the router namespace and the bridge, one end of the veth pair is mounted to qRouter, and the other end is mounted to the bridge. At the same time, the veth port of qRouter is configured with the veth IP allocated from the virtual private network. Then, the router namespace will issue a diversion route. The target message is directed to the bridge through the diversion route. After receiving the target message, the bridge transmits the target message to the destination virtual machine, ensuring that the entire communication process of the same host machine across the virtual private network is completed accurately and efficiently, and ensuring the smooth progress of network communication.

[0059] In this embodiment, if the type of cross-virtual private network communication is a cross-virtual private network on the same host, before the target message is transmitted to the destination virtual machine based on the virtual device interface, router namespace and bridge, the back-end processing system will also determine whether the number of virtual private networks in the current host is greater than or equal to the preset threshold; if so, a new diversion route is created based on the router namespace according to the number of virtual private networks in the current host, so as to utilize the new diversion route for target message transmission. Specifically, before the target message is transmitted to the destination virtual machine based on the virtual device interface, router namespace and bridge, the number of virtual private networks in the current host is evaluated to determine whether it is greater than or equal to the preset threshold. This preset threshold is a key value that is pre-set based on the design of the cloud data center network architecture and performance optimization requirements. Specifically, such as Figure 3 As shown in the figure, when the backend processing system determines that the number of virtual private networks in the current host is greater than or equal to 2, the router namespace will create a new diversion route based on the number of virtual private networks in the current host. The newly added virtual private network only needs to be assigned a veth IP, establish a veth pair with the bridge, issue a diversion route, and add the destination network segment route of the newly added virtual private network to the qRouter of the existing virtual private network. This creation process needs to take into account multiple factors such as the relationship between the various virtual private networks, the current network traffic situation, and the transmission requirements of the target message. Its purpose is to better adapt to the complex network traffic situation in a multi-virtual private network environment, so as to use these new diversion routes to transmit the target message more efficiently and accurately, and ensure the smoothness and reliability of network communication in such a complex environment.

[0060] Step S14: If the type is cross-host machine and cross-virtual private network communication, the target message is transmitted to the destination virtual machine based on the network connector to complete the cross-virtual private network communication.

[0061] In this embodiment, if the type of cross-VPN communication is Figure 4The cross-host and cross-virtual private network communication shown in the figure encapsulates the target message based on the network connector, and sends the corresponding encapsulated message to the target computing node so that the target computing node parses the encapsulated message to obtain the target message, and sends the target message to the target router namespace corresponding to the target virtual private network, and transmits the target message to the destination virtual machine through the target router namespace. Specifically, first, after the network connector obtains the target message, the target message is encapsulated, and then the encapsulated message is sent to the target computing node. After the target computing node receives the encapsulated message, it will first parse the message, send the parsed message to the corresponding router namespace, and the router namespace will send the message to the corresponding destination virtual machine.

[0062] It can be seen that the present application first sends the network connector creation request generated based on the cloud data center to the back-end processing system of the cloud data center controller, and the back-end system verifies the request parameters. After the verification is passed, the virtual network device IP is obtained from the virtual private network, and the network connector is created based on the virtual network device IP. Then, the bridge of all host machines is created, and the hook function is created in the router namespace corresponding to the virtual private network on the current host machine and the network connector is connected to the router namespace, so that the network connector obtains the target message captured by the hook function, and the cross-virtual private network communication type is determined based on the target message. If it is a cross-virtual private network communication between the same host machine, a virtual device interface is created, and the target message is transmitted to the destination virtual machine based on the virtual device interface, the router namespace and the bridge. If it is a cross-virtual private network communication between cross-host machines, the target message is transmitted to the destination virtual machine through the network connector and the router namespace to complete the cross-virtual private network communication. In this way, by adopting different communication methods for different cross-virtual private network communication types, the smooth completion of cross-virtual private network communication is guaranteed, the communication needs between virtual machines in different scenarios are met, and the flexible routing configuration of cross-virtual private network communication is realized, and the consumption of computing resources is reduced. The network connector and hook function are used at the same time to report the message to the network connector for processing, thereby enhancing the security and reliability of network communication.

[0063] According to the previous embodiment, the present application releases the veth pair when there is no virtual machine private network number of the network connector on the computing node after the virtual machine is destroyed or migrated. Next, the process of processing the computing node namespace and the bridge will be described in detail for the specific situation when the virtual machine is destroyed or migrated and activated.

[0064] When a virtual machine is activated, first, determine whether there is a network connector in the virtual private network where the current virtual machine is located. If so, further check whether there are other virtual machines under the current virtual private network in the host where it is located. If so, no processing is required. However, if there are no other virtual machines under the current virtual private network in the host, it is necessary to further determine whether the current virtual private network is the first one for the host. If it is the first, a series of network configuration operations will be triggered. First, a virtual network device IP is allocated in the virtual private network, and then a request to create a hook function is sent to the computing node namespace so that the hook function can be used to capture messages to prepare for subsequent cross-segment communication. At the same time, a bridge and a virtual device interface are created, and the relationship between the bridge and the virtual device interface is established. In this way, a preliminary network foundation is built for cross-segment communication with the same host. If the current virtual private network is not the first on the host, then only a virtual device interface needs to be created and connected to the existing bridge. In this way, the existing network resources can be fully utilized to quickly connect the newly activated virtual machine to the existing network environment. After that, the traffic diversion route to the destination virtual machine is sent to the computing node namespace, and the traffic diversion route to the current virtual machine is also sent to the peer end, thereby ensuring that the newly activated virtual machine can effectively communicate with other related network segments.

[0065] When a virtual machine is destroyed or migrated, the processing flow also needs to consider the situation of the virtual private network and the host machine where it is located. After the virtual machine is destroyed or migrated, first determine whether there is a network connector in the virtual private network where it is located. If so, then check whether there are other virtual machines in the current virtual private network on the host where it is located. If there are, no processing is required. However, if there are no other virtual machines in the current virtual private network on the host, request the compute node namespace to delete the hook function and delete the veth pair; if there are virtual machines in other virtual private networks under the network connector on the host, request to delete the drainage route to this virtual private network on the qRouter of the other virtual private network.

[0066] In this way, the network configuration for cross-virtual private network communication is adjusted according to the activation, destruction or migration of virtual machines, reducing the waste and consumption of computing resources.

[0067] See also Figure 5 As shown, an embodiment of the present invention discloses a cross-virtual private network communication device, including:

[0068] A virtual network device IP acquisition module 11 is used to send a network connector creation request generated based on a cloud data center to a backend processing system of a cloud data center controller, so that the backend processing system verifies the parameters corresponding to the network connector creation request, and if the verification passes, obtains the virtual network device IP from the virtual private network;

[0069] The target message acquisition module 12 is used to create a network connector of the computing node based on the virtual network device IP, create a bridge of all host machines, create a hook function in the router namespace corresponding to the virtual private network on the current host machine, and connect the network connector with the router namespace so that the network connector can obtain the target message captured by the hook function;

[0070] A first target message transmission module 13 is used to determine the type of cross-virtual private network communication based on the target message, and if the type is cross-virtual private network communication within the same host machine, create a virtual device interface, and transmit the target message to the destination virtual machine based on the virtual device interface, the router namespace and the bridge;

[0071] The second target message transmission module 14 is used to transmit the target message to the destination virtual machine based on the network connector to complete the cross-virtual private network communication if the type is cross-host machine and cross-virtual private network communication.

[0072] It can be seen that the present application first sends the network connector creation request generated based on the cloud data center to the back-end processing system of the cloud data center controller, and the back-end system verifies the request parameters. After the verification is passed, the virtual network device IP is obtained from the virtual private network, and the network connector is created based on the virtual network device IP. Then, the bridge of all host machines is created, and the hook function is created in the router namespace corresponding to the virtual private network on the current host machine and the network connector is connected to the router namespace, so that the network connector obtains the target message captured by the hook function, and the cross-virtual private network communication type is determined based on the target message. If it is a cross-virtual private network communication between the same host machine, a virtual device interface is created, and the target message is transmitted to the destination virtual machine based on the virtual device interface, the router namespace and the bridge. If it is a cross-virtual private network communication between cross-host machines, the target message is transmitted to the destination virtual machine through the network connector and the router namespace to complete the cross-virtual private network communication. In this way, by adopting different communication methods for different cross-virtual private network communication types, the smooth completion of cross-virtual private network communication is guaranteed, the communication needs between virtual machines in different scenarios are met, and the flexible routing configuration of cross-virtual private network communication is realized, and the consumption of computing resources is reduced. The network connector and hook function are used at the same time to report the message to the network connector for processing, thereby enhancing the security and reliability of network communication.

[0073] In some specific embodiments, the target message acquisition module 12 includes:

[0074] The bridge creation unit is used to query the virtual machine corresponding to the virtual private network based on the back-end processing system, determine the correspondence between the host machine, the virtual private network and the virtual machine, and create a bridge for all the host machines based on the correspondence.

[0075] In some specific embodiments, the first target message transmission module 13 includes:

[0076] A target message parsing unit, used for parsing the target message through the network connector to obtain a destination media access control address and an IP address;

[0077] The network communication type determination unit is used to query the port information of the virtual machine in the database according to the destination media access control address and the IP address, and determine the type of cross-virtual private network communication based on the port information.

[0078] In some specific embodiments, the first target message transmission module 13 may specifically include:

[0079] A target virtual network device IP configuration unit, configured to configure a target virtual network device IP for a virtual device interface corresponding to the router namespace based on a virtual private network;

[0080] A router namespace and bridge connection unit, configured to create the virtual device interface according to the target virtual network device IP, and connect the router namespace and the bridge through the virtual device interface;

[0081] The first target message transmission unit is used to guide the target message to the bridge based on the diversion route issued by the router namespace after the router namespace and the bridge are connected, so that the bridge transmits the target message to the destination virtual machine.

[0082] In some specific embodiments, the device may further include:

[0083] A virtual private network quantity determination unit, configured to determine, through the backend processing system, whether the quantity of the virtual private networks in the current host machine is greater than or equal to a preset threshold;

[0084] A new diversion route creating unit is used to create a new diversion route based on the router namespace according to the number of the virtual private networks in the current host machine, so as to use the new diversion route to transmit the target message.

[0085] In some specific embodiments, the second target message transmission module 14 includes:

[0086] A second target message transmission unit is used to encapsulate the target message based on the network connector, send the corresponding encapsulated message to the target computing node, so that the target computing node parses the encapsulated message to obtain the target message, and send the target message to the target router namespace corresponding to the target virtual private network, and transmit the target message to the destination virtual machine through the target router namespace.

[0087] In some specific embodiments, the device may further include:

[0088] a virtual machine determination module, configured to determine whether a virtual machine corresponding to the virtual private network exists in a host machine corresponding to the network connector if the virtual machine corresponding to the virtual private network under the network connector is destroyed or migrated;

[0089] A first judgment result execution module, used for deleting the hook function and the virtual device interface if they do not exist;

[0090] The second judgment result execution module is used for not processing the hook function and the virtual device interface if they exist.

[0091] Furthermore, the present application also discloses an electronic device. Figure 6 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram cannot be regarded as any limitation on the scope of use of the present application.

[0092] Figure 6 A schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the cross-virtual private network communication method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0093] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0094] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0095] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the cross-virtual private network communication method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0096] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the aforementioned disclosed cross-virtual private network communication method. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0097] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0098] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0099] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0100] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0101] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for cross-virtual private network communication, characterized in that: include: Sending a network connector creation request generated based on the cloud data center to a backend processing system of the cloud data center controller so that the backend processing system verifies the parameters corresponding to the network connector creation request, and if the verification passes, obtains the virtual network device IP from the virtual private network; Creating a network connector of a computing node based on the virtual network device IP, creating a network bridge of all host machines, creating a hook function in a router namespace corresponding to a virtual private network on the current host machine, and connecting the network connector with the router namespace so that the network connector obtains a target message captured by the hook function; Determine the type of cross-virtual private network communication based on the target message, and if the type is cross-virtual private network communication within the same host machine, create a virtual device interface, and transmit the target message to the destination virtual machine based on the virtual device interface, the router namespace, and the bridge; If the type is cross-host machine and cross-virtual private network communication, the target message is transmitted to the destination virtual machine based on the network connector to complete the cross-virtual private network communication.

2. The method for cross-virtual private network communication according to claim 1, characterized in that: The step of creating a network bridge for all hosts includes: Based on the backend processing system, the virtual machine corresponding to the virtual private network is queried to determine the corresponding relationship between the host machine, the virtual private network and the virtual machine, and a network bridge of all the host machines is created based on the corresponding relationship.

3. The method for cross-virtual private network communication according to claim 1, characterized in that: The determining the type of cross-virtual private network communication based on the target message includes: Parsing the target message through the network connector to obtain a destination media access control address and an IP address; The port information of the virtual machine in the database is queried according to the destination media access control address and the IP address, and the type of cross-virtual private network communication is determined based on the port information.

4. The method for cross-virtual private network communication according to any one of claims 1 to 3, characterized in that: The step of creating a virtual device interface and transmitting the target message to a destination virtual machine based on the virtual device interface, the router namespace, and the bridge includes: Based on the virtual private network, configure the target virtual network device ip for the virtual device interface corresponding to the router namespace; Create the virtual device interface according to the target virtual network device IP, and connect the router namespace and the bridge through the virtual device interface; After the router namespace and the bridge are connected, the target message is directed to the bridge based on the diversion route issued by the router namespace, so that the bridge transmits the target message to the destination virtual machine.

5. The method for cross-virtual private network communication according to claim 1, characterized in that: Before transmitting the target message to the destination virtual machine based on the virtual device interface, the router namespace and the bridge, the method further includes: Determining, by the backend processing system, whether the number of the virtual private networks in the current host machine is greater than or equal to a preset threshold; If so, a new diversion route is created based on the router namespace according to the number of the virtual private networks in the current host machine, so as to use the new diversion route to transmit the target message.

6. The method for cross-virtual private network communication according to claim 1, characterized in that: The transmitting the target message to the destination virtual machine based on the network connector includes: The target message is encapsulated based on the network connector, and the corresponding encapsulated message is sent to the target computing node so that the target computing node parses the encapsulated message to obtain the target message, and the target message is sent to the target router namespace corresponding to the target virtual private network, and the target message is transmitted to the destination virtual machine through the target router namespace.

7. The method for cross-virtual private network communication according to claim 1, characterized in that: Also includes: If the virtual machine corresponding to the virtual private network under the network connector is destroyed or migrated, determining whether the virtual machine corresponding to the virtual private network exists in the host machine corresponding to the network connector; If it does not exist, deleting the hook function and the virtual device interface; If it exists, the hook function and the virtual device interface are not processed.

8. A cross-virtual private network communication device, characterized in that: include: A virtual network device IP acquisition module, used to send a network connector creation request generated based on a cloud data center to a backend processing system of a cloud data center controller, so that the backend processing system verifies the parameters corresponding to the network connector creation request, and if the verification passes, obtains the virtual network device IP from a virtual private network; A target message acquisition module is used to create a network connector of a computing node based on the virtual network device IP, create a network bridge of all host machines, create a hook function in the router namespace corresponding to the virtual private network on the current host machine, and connect the network connector with the router namespace so that the network connector can obtain the target message captured by the hook function; A first target message transmission module is used to determine the type of cross-virtual private network communication based on the target message, and if the type is cross-virtual private network communication within the same host machine, create a virtual device interface, and transmit the target message to a destination virtual machine based on the virtual device interface, the router namespace, and the bridge; The second target message transmission module is used to transmit the target message to the destination virtual machine based on the network connector to complete the cross-virtual private network communication if the type is cross-host machine and cross-virtual private network communication.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the cross-virtual private network communication method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program; wherein, when the computer program is executed by a processor, the cross-virtual private network communication method as described in any one of claims 1 to 7 is implemented.

Images