Traffic forwarding method, device and system

Abstract

The present application provides a traffic forwarding method, device and system, which belongs to the field of network technology. In the solution provided by the present application, the cloud platform can distribute authentication keys to users based on the accelerated access request sent by the user, so that the user can deploy leaf nodes in the local area network. The leaf node can forward the message in the local area network to the acceleration node in the acceleration network so as to access the Internet through the acceleration node. The solution provided by the present application does not require the user to perceive and configure complex routing protocols, effectively reduces the complexity of routing docking between the local area network and the acceleration node in the acceleration network, and improves the efficiency of directing traffic to the acceleration node.

Description

[0001] This application claims priority to Chinese patent application No. 202311302838.1, filed on October 8, 2023, and entitled “Method and Device for Accelerating Access to the Internet”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the field of network technology, and in particular to a traffic forwarding method, device and system. Background Art

[0003] Local area networks such as physical networks (such as enterprise branch networks) and cloud vendor virtual private cloud (VPC) networks can divert traffic to an acceleration network (also called an acceleration backbone network) and accelerate access to Internet services through the acceleration network. The acceleration network can be a backbone network using overlay technology.

[0004] In order to achieve routing connection with the acceleration network, the physical network can configure the virtual extensible local area network (VXLAN) or generic routing encapsulation (GRE) tunnel routing protocol on its egress router. The VPC network can configure the IPsecVPN tunnel routing protocol through the virtual private network (VPN) gateway. Among them, IPsecVPN refers to a VPN technology that uses the Internet protocol security (IPsec) to achieve remote access.

[0005] However, the above process of configuring the routing protocol is relatively complicated and time-consuming. Summary of the invention

[0006] The present application provides a traffic forwarding method, device and system, which can solve the technical problem in the related technology that the process of configuring the routing protocol is relatively complicated and time-consuming when the local area network and the acceleration network are routed and connected.

[0007] In a first aspect, a traffic forwarding method is provided, the method comprising: a cloud platform allocates an authentication key to a user according to an acceleration access request issued by the user, so that the user deploys a first leaf node in a local area network. The first leaf node obtains a message sent by an egress device in the local area network, and forwards the message to a first acceleration node in an acceleration network; the first acceleration node sends the message to a target device, which is located on the Internet.

[0008] In the solution provided by this application, after the user deploys a leaf node in the local area network based on the authentication key assigned by the cloud platform, the leaf node can directly divert the traffic of the local area network to the acceleration node in the acceleration network. Since the above diversion process does not require the user to perceive and configure complex routing protocols, it effectively reduces the complexity of routing docking between the local area network and the acceleration node in the acceleration network, and improves the efficiency of diverting traffic to the acceleration node.

[0009] Optionally, the method may also include: the cloud platform receives first authentication information sent by the first leaf node, the first authentication information carries the authentication key; the cloud platform authenticates the first leaf node based on the authentication key in the first authentication information.

[0010] After the user obtains the authentication key assigned by the cloud platform, the authentication key can be configured in the first leaf node, for example, the authentication key can be written into the configuration file of the first leaf node. In this way, it can be ensured that the first leaf node can request authentication from the cloud platform based on the authentication key. After the cloud platform determines that the first leaf node has passed the authentication, it can register and manage the first leaf node.

[0011] Optionally, the method further includes: if the cloud platform determines that the first leaf node has passed authentication, determining a first acceleration node for access by the first leaf node from a plurality of acceleration nodes included in the acceleration network.

[0012] For example, the cloud platform can determine the first acceleration node for access by the first leaf node based on the distance between the first leaf node and the multiple acceleration nodes. The distance between the first leaf node and the first acceleration node is less than a threshold. For example, the first acceleration node can be the acceleration node closest to the first leaf node among the multiple acceleration nodes. Thus, it can be ensured that the traffic of the local area network can be quickly forwarded to the acceleration network, thereby effectively improving the speed at which devices in the local area network access Internet services through the acceleration network.

[0013] Optionally, the method may further include: the cloud platform sends a scheduling policy to the first leaf node; the first leaf node establishes a tunnel with the first acceleration node based on the scheduling policy. Accordingly, the process of the first acceleration node forwarding the message to the first acceleration node in the acceleration network may include: the first acceleration node forwarding the message to the first acceleration node through the tunnel.

[0014] In the solution provided by this application, after the cloud platform determines that the first leaf node has passed the authentication, it can register and manage the first leaf node, and can instruct the first leaf node to access the first acceleration node through the scheduling policy. In other words, the process of routing the local area network and the acceleration node in the acceleration network can be uniformly scheduled by the cloud platform, without the need for users to perceive and configure complex routing protocols.

[0015] Optionally, the method may also include: if the cloud platform detects that the first acceleration node fails, determining a second acceleration node for access by the first leaf node from the multiple acceleration nodes included in the acceleration network; the cloud platform sends an access change message to the first leaf node; the first leaf node forwards the message of the local area network to the second acceleration node based on the access change message; and the second acceleration node sends the message to the target device.

[0016] After the cloud platform senses the failure of the first acceleration node, it can promptly notify the first leaf node to access the new acceleration node (i.e., the second acceleration node), thereby ensuring that the traffic within the LAN can be forwarded normally by the acceleration network.

[0017] Optionally, the authentication key can also be used by the user to deploy a second leaf node in the local area network; the method can also include: the second leaf node obtains a message sent by an export device in the local area network, and forwards the message to the first acceleration node.

[0018] By deploying multiple leaf nodes in a LAN, it can be ensured that when any leaf node fails, other leaf nodes can still forward the traffic of the LAN normally, thereby ensuring the reliability of the traffic diversion of the LAN. In addition, the multiple leaf nodes can also forward traffic by load sharing.

[0019] Optionally, the method may also include: the cloud platform receives second authentication information sent by the second leaf node, the second authentication information carries the authentication key; the cloud platform authenticates the second leaf node based on the authentication key in the second authentication information.

[0020] For each leaf node deployed in the local area network, the cloud platform needs to authenticate it before registering and managing it. For example, the cloud platform can also send a scheduling policy to the second leaf node to instruct the second leaf node to access the first acceleration node.

[0021] Optionally, the local area network may be a physical network, and the next hop of an equal-cost multi-path (ECMP) routing configured on the egress device points to the first leaf node and the second leaf node respectively;

[0022] Alternatively, the local area network may be a VPC network, the first leaf node and the second leaf node share a virtual Internet protocol (IP) address, and the next hop of the VPC route on the egress device is the virtual IP address.

[0023] In a second aspect, a traffic forwarding method is provided, the method comprising: a cloud platform receives an acceleration access request issued by a user, and allocates an authentication key to the user. The authentication key is used for the user to deploy a first leaf node in a local area network, so that the first leaf node forwards a message sent by an egress device in the local area network to a first acceleration node in the acceleration network, and then the first acceleration node sends the message to a target device, which is located on the Internet.

[0024] Optionally, the method may also include: the cloud platform receives first authentication information sent by the first leaf node, the first authentication information carries the authentication key; the cloud platform authenticates the first leaf node based on the authentication key in the first authentication information.

[0025] Optionally, the method may further include: if the cloud platform determines that the first leaf node has passed authentication, determining a first acceleration node for access by the first leaf node from a plurality of acceleration nodes included in the acceleration network.

[0026] Optionally, the method may further include: the cloud platform sends a scheduling policy to the first leaf node, where the scheduling policy is used to instruct the first leaf node to establish a tunnel with the first acceleration node.

[0027] Optionally, the method may also include: if the cloud platform detects that the first acceleration node fails, determining a second acceleration node for access by the first leaf node from the multiple acceleration nodes included in the acceleration network, and sending an access change message to the first leaf node, wherein the access change message is used to instruct the first leaf node to forward the message to the second acceleration node.

[0028] Optionally, the authentication key is also used by the user to deploy a second leaf node in the local area network. The method may also include: the cloud platform receives second authentication information sent by the second leaf node, the second authentication information carries the authentication key; and authenticates the second leaf node based on the authentication key in the second authentication information.

[0029] In a third aspect, a traffic forwarding method is provided, which includes: a leaf node receives a scheduling strategy issued by a cloud platform, and based on the scheduling strategy, the leaf node establishes a first tunnel with a first acceleration node in the acceleration network, and forwards the message sent by the export device in the local area network to the first acceleration node through the first tunnel.

[0030] Optionally, the method may further include: the leaf node sends authentication information to the cloud platform, the authentication information carries an authentication key configured by the user, and the authentication key is used by the cloud platform to authenticate the leaf node.

[0031] Optionally, the method may further include: the leaf node receives an access change message sent by the cloud platform, the access change message being used to instruct the leaf node to access a second acceleration node among the multiple acceleration nodes. Afterwards, the leaf node may establish a second tunnel with the second acceleration node based on the access change message, and forward the message sent by the egress device to the second acceleration node through the second tunnel.

[0032] Optionally, the leaf node is configured with an authentication key assigned by the cloud platform; the process of the leaf node establishing a first tunnel with the first acceleration node based on the scheduling policy may include: the leaf node performs tunnel negotiation with the first acceleration node based on the scheduling policy and the authentication key to establish the first tunnel.

[0033] In a fourth aspect, a cloud platform is provided, which includes a communication unit and a processing unit, and the communication unit and the processing unit can be used to implement the traffic forwarding method provided in the second aspect above.

[0034] In a fifth aspect, a leaf node is provided, which includes at least one module, and the at least one module can be used to implement the traffic forwarding method provided in the third aspect.

[0035] In a sixth aspect, a traffic forwarding system is provided, the traffic forwarding system comprising a cloud platform, a first leaf node and a first acceleration node. The cloud platform is used to allocate an authentication key to the user according to an acceleration access request issued by the user, so that the user can deploy the first leaf node in the local area network. The first leaf node is used to obtain a message sent by an egress device in the local area network, and forward the message to the first acceleration node in the acceleration network. The first acceleration node is used to send the message to a target device, which is located on the Internet.

[0036] Optionally, the cloud platform is also used to: receive first authentication information sent by the first leaf node, the first authentication information carrying the authentication key; and authenticate the first leaf node based on the authentication key in the first authentication information.

[0037] Optionally, the cloud platform is further configured to determine a first acceleration node for access by the first leaf node from a plurality of acceleration nodes included in the acceleration network if it is determined that the first leaf node has passed authentication.

[0038] Optionally, the cloud platform is further used to issue a scheduling policy to the first leaf node; the first leaf node is further used to establish a tunnel with the first acceleration node based on the scheduling policy; the first acceleration node is used to forward the message to the first acceleration node through the tunnel.

[0039] Optionally, the cloud platform is further used to determine a second acceleration node for access by the first leaf node from a plurality of acceleration nodes included in the acceleration network if a failure of the first acceleration node is detected, and send an access change message to the first leaf node; the first leaf node is further used to forward the message to the second acceleration node based on the access change message; the second acceleration node is used to send the message to the target device.

[0040] Optionally, the authentication key is also used by the user to deploy a second leaf node in the local area network; the second leaf node is used to obtain the message and forward the message to the first acceleration node.

[0041] Optionally, the cloud platform is also used to: receive second authentication information sent by the second leaf node, the second authentication information carrying the authentication key; and authenticate the second leaf node based on the authentication key in the second authentication information.

[0042] Optionally, the local area network is a physical network, and the next hop of the equal-cost multi-path routing configured on the export device points to the first leaf node and the second leaf node respectively; or, the local area network is a VPC network, the first leaf node and the second leaf node share a virtual IP address, and the next hop of the VPC routing on the export device is the virtual IP address.

[0043] In a seventh aspect, a computing device is provided, the computing device comprising a processor and a memory. The processor is used to execute instructions stored in the memory to implement the traffic forwarding method provided in any of the above aspects.

[0044] In an eighth aspect, a computing device cluster is provided, the computing device cluster comprising at least one computing device, each computing device comprising a processor and a memory. The processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the traffic forwarding method provided in any of the above aspects.

[0045] In a ninth aspect, a computer-readable storage medium is provided, in which computer program instructions are stored. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the traffic forwarding method provided in any of the above aspects.

[0046] In a tenth aspect, a computer program product comprising instructions is provided. When the instructions are executed by a computing device cluster, the computing device cluster executes the traffic forwarding method provided in any of the above aspects.

[0047] In summary, the present application provides a traffic forwarding method, device and system. In the solution provided by the present application, the cloud platform can assign authentication keys to users based on the accelerated access request sent by the user, so that the user can deploy leaf nodes in the local area network. The leaf node can forward messages in the local area network to the acceleration node in the acceleration network so as to access the Internet through the acceleration node. Since the user deploys the leaf node in the local area network based on the authentication key assigned by the cloud platform, the leaf node can directly divert the traffic of the local area network to the acceleration node in the acceleration network, so the diversion process does not require the user to perceive and configure complex routing protocols. As a result, the complexity of routing docking between the local area network and the acceleration node in the acceleration network is effectively reduced, and the efficiency of diverting traffic to the acceleration node is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is a structural diagram of a traffic forwarding system provided in an embodiment of the present application;

[0049] Figure 2 It is a structural diagram of another traffic forwarding system provided in an embodiment of the present application;

[0050] Figure 3 It is a flow chart of a traffic forwarding method provided by an embodiment of the present application;

[0051] Figure 4 It is a structural diagram of another traffic forwarding system provided in an embodiment of the present application;

[0052] Figure 5 It is a structural diagram of another traffic forwarding system provided in an embodiment of the present application;

[0053] Figure 6 is a flow chart of another traffic forwarding method provided in an embodiment of the present application;

[0054] Figure 7 This is a flow chart of another traffic forwarding method provided in an embodiment of the present application;

[0055] Figure 8 It is a structural schematic diagram of a traffic forwarding device provided in an embodiment of the present application;

[0056] Fig. 9 It is a structural schematic diagram of another traffic forwarding device provided in an embodiment of the present application;

[0057] Fig.10is a schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0058] Fig.11 is a schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0059] Fig.12 It is a structural diagram of a network connection between computing devices provided by the present application. DETAILED DESCRIPTION

[0060] The following describes in detail the traffic forwarding method, device and system provided by the embodiments of the present application in conjunction with the accompanying drawings. In order to make the technical solution provided by the embodiments of the present application clearer, before specifically describing the technical solution provided by the embodiments of the present application, the relevant terms are first explained.

[0061] Center controller: Also called controller, it is responsible for managing acceleration nodes and leaf nodes, collecting quality of service (QOS) measurement data (such as latency and packet loss rate, etc.) reported by acceleration nodes, and performing path calculation and routing table entry distribution based on the collected QOS measurement data; as the central brain of the traffic forwarding system, the center controller is also responsible for the network service scheduling of acceleration nodes. It should be noted that the cloud platform is one of the implementation methods of the controller. The cloud platform provides an access interface (such as an interface), and tenants can operate the client remote access access interface to register a cloud account and password on the cloud management platform and log in to the cloud platform. After the cloud platform successfully authenticates the cloud account and password, the tenant can further pay to select and purchase a virtual machine of a specific specification (processor, memory, disk) or a node of a specific specification on the cloud platform. After the payment is successful, the cloud platform provides the remote login account and password of the purchased resources (such as virtual machines, nodes, etc.), and the client can remotely log in to the resource and run the resource. Furthermore, the cloud platform receives control commands, creates and manages resources throughout their life cycle on the server according to the control commands. The embodiments of the present application will be introduced using a cloud platform as an example, but it should be understood that the embodiments of the present application do not limit the implementation method of the controller in a specific embodiment.

[0062] Accelerate node: A node in an acceleration network (such as an overlay network), also known as a backbone node, responsible for measuring and reporting QOS data, and forwarding overlay tunnels based on routing table entries issued by the cloud platform. In some possible implementations, an acceleration node can be an instance (such as a virtual machine, a container, or a bare metal server, etc.), or a service running on an instance. The deployment environment of the acceleration node includes but is not limited to edge cloud, optical line terminal (OLT), multiaccess edge computing (MEC), POP, cloud region, and content delivery network (CDN). In addition, the embodiments of the present application do not limit the type and creation method of the acceleration node.

[0063] Leaf node: A device deployed in a local area network, which can establish a tunnel with an acceleration node in the acceleration network under the scheduling of the cloud platform, thereby directing the private network traffic in the local area network to the acceleration node by default. In some possible implementations, the device deployed by the leaf node can be a host in the local area network (such as a server), or it can also be a device of other forms. For example, the device can also be a mobile phone, a PC, or a network device (such as a switch and a router). The embodiments of the present application do not limit the type and creation method of the leaf node.

[0064] Local Area Network: A network formed by interconnecting devices (such as terminals) within a limited range. In the embodiment of the present application, the local area network can be a physical network of an enterprise branch, or a cloud vendor VPC network. Alternatively, the local area network can also include only one device, for example, the local area network can include only a mobile phone or a personal computer (PC).

[0065] In order to accelerate access to Internet services, local area networks such as enterprise branch physical networks and cloud vendor VPC networks need to divert traffic to the acceleration network. The process of diverting traffic from the physical network (such as an enterprise branch network) to the acceleration network to access Internet services mainly includes the following steps:

[0066] 1. The physical network applies for an acceleration instance from the acceleration network, and the acceleration network allocates an access line to the physical network, such as a GRE or VXLAN tunnel line. The line parameters of the access line include the VXLAN network identifier (VNI) and the tunnel interconnection IP address.

[0067] 2. The operation and maintenance personnel of the physical network configure VXLAN or GRE tunnels and static routes on the egress router of the physical network according to the allocated line parameters to facilitate negotiation and connection with the acceleration network.

[0068] 3. If reliability is further considered, for the VXLAN protocol solution, the operation and maintenance personnel also need to configure complex protocols such as Ethernet virtual private network (EVPN), border gateway protocol (BGP), open shortest path first (OSPF), and VPN. For the GRE protocol solution, the operation and maintenance personnel also need to configure the primary and backup GRE tunnels, primary and backup routes, and primary and backup fault detection and switching protocols.

[0069] 4. After completing the above configuration, the traffic of the terminals in the physical network can be directed to the acceleration network through GRE or VXLAN, and finally access the Internet service.

[0070] The process of cloud vendor VPC networks directing traffic to the acceleration network to access Internet services mainly includes the following steps:

[0071] 1. The cloud tenant applies for an acceleration instance from the acceleration network, and the acceleration network allocates an access line to the cloud tenant, such as an IPsecVPN line. The line parameters of the IPsecVPN line include the security association (SA) key and the VPN tunnel interconnection IP address.

[0072] 2. The cloud tenant applies for VPN interconnection services from the cloud vendor based on the allocated IPsecVPN line parameters, and configures IPsecVPN tunnels and static routes to negotiate and connect with the acceleration network.

[0073] 3. For further reliability considerations, cloud tenants also need to configure primary and backup VPN tunnels, primary and backup routing, and primary and backup fault detection and switching protocols.

[0074] 4. After completing the above configuration, the traffic of the terminals in the cloud VPC network can be directed to the acceleration network through the VPN tunnel and finally access the Internet service.

[0075] Based on the above analysis, we can know that the enterprise branch network needs to be connected to the accelerated network through the complex VXLAN or GRE tunnel routing protocol configured on the egress router, and the cloud vendor VPC network needs to be connected to the accelerated network through the complex IPsecVPN tunnel routing protocol configured through the VPN gateway. In other words, both enterprise customers and cloud tenants need to participate in complex network configuration operations and need to be familiar with protocols such as GRE, VXLAN, and IPsecVPN, which places high skill requirements on operation and maintenance personnel, and the configuration process takes a long time.

[0076] In addition, tunnel interconnection technologies such as GRE, VXLAN and IPsecVPN have very complex redundant line primary and backup reliability solutions. For example, VXLAN reliability requires the use of the EVPN routing protocol, which includes complex BGP, OSPF, VXLAN, VPN and other comprehensive routing protocols.

[0077] It is understandable that in order to simplify the network connection between the acceleration network and the local area network, the industry has considered adding a layer of collaborative layer controller. The collaborative layer controller can call the sub-controllers between the acceleration network and the local area network respectively to complete the automatic network connection of the two network domains. However, due to the ever-changing sub-controllers of the local area network and the different product forms of different manufacturers, it is necessary to call the application programming interface (API) one by one for development and docking. Therefore, although the above solution can realize the automatic network connection of different network domains, there is still a large amount of development work.

[0078] Figure 1 Schematic diagram of a traffic forwarding system provided in an embodiment of the present application. Figure 1 As shown, the traffic forwarding system includes: a cloud platform, a leaf node and multiple acceleration nodes. Among them, the leaf node is deployed in a local area network, and the next hop of the egress device of the local area network points to the leaf node. The multiple acceleration nodes belong to an acceleration backbone network (also called an acceleration network), and the acceleration network can be an overlay network. The multiple acceleration nodes can report QOS measurement data to the cloud platform, and can realize wide-area long-distance forwarding of traffic based on the routing table issued by the cloud platform. The cloud platform can uniformly schedule and manage the leaf node and multiple acceleration nodes, and can perform path calculation and routing table issuance based on the QOS measurement data reported by the acceleration node.

[0079] In an embodiment of the present application, a user (e.g., a customer of a physical network or a cloud tenant) can apply to the acceleration network for an acceleration instance (also referred to as an acceleration service), and the cloud platform of the acceleration network can allocate a leaf node authentication key to the user. The authentication key can also be referred to as an application code (APP code). The user can deploy a leaf node in a local area network, write the authentication key in the configuration file of the leaf node, and configure the next hop of the local area network's egress device as the leaf node. For example, refer to Figure 2 If the LAN is a physical network, the user can configure the next hop of the egress router in the physical network as the leaf node. If the LAN is a VPC network, the user can configure the next hop of the VPC gateway in the VPC network as the leaf node.

[0080] The leaf node can then forward the message sent by the egress device in the local area network to the acceleration node in the acceleration network, and the acceleration node can forward the message to the target device in the Internet, so that the devices in the local area network can accelerate access to Internet services. For example, the leaf node can send authentication information to the cloud platform based on the configured authentication key. After the cloud platform determines that the leaf node has passed the authentication, it can register and manage the leaf node. After that, the cloud platform can issue a scheduling policy to the leaf node to instruct the leaf node to access the nearest acceleration node. Based on the scheduling policy, after the leaf node establishes a tunnel with the nearest acceleration node, it can automatically forward the traffic sent by the egress device in the local area network to the acceleration node through the tunnel. The acceleration node can then forward the traffic to the target device in the Internet based on the routing table issued by the cloud platform.

[0081] Based on the above analysis, it can be seen that in the solution provided by this application, the leaf node can automatically negotiate with the acceleration node to establish a tunnel under the scheduling of the cloud platform. This process does not require users to perceive and configure complex routing protocols, effectively reducing the complexity of routing docking between the local area network and the acceleration node in the acceleration network, and improving the efficiency of directing traffic to the acceleration node.

[0082] Figure 3 This is a flow chart of a traffic forwarding method provided by an embodiment of the present application, which can be applied to Figure 1 In the traffic forwarding system shown in FIG. Figure 3 As shown, the method includes:

[0083] Step 101: The user sends an accelerated access request to the cloud platform.

[0084] In the embodiment of the present application, if a user (such as an enterprise branch customer or a cloud tenant) needs to access the Internet through an accelerated network, he or she can send an accelerated access request to the cloud platform of the accelerated network to apply for the accelerated service of the accelerated node.

[0085] Step 102: The cloud platform allocates an authentication key to the user.

[0086] After receiving the accelerated access request sent by the user, the cloud platform can allocate an authentication key to the user so that the user can configure the authentication key in the leaf node. It can be understood that the leaf node can be an APP deployed in the device, and the authentication key can also be called an access key or APP code.

[0087] Step 103: The user deploys at least one leaf node in the local area network and configures an authentication key in the at least one leaf node.

[0088] In an embodiment of the present application, a user can apply for at least one device in a local area network to deploy at least one leaf node and configure an authentication key in the at least one leaf node. Optionally, a leaf node can be deployed in each device. The device can be a host (such as a server) in a local area network, or it can also be a device of other forms. For example, the device can also be a mobile phone, a PC, or a network device (such as a switch and a router). Among them, the network device can be a data communication network device, an access network device, or a transmission network device.

[0089] It is understandable that the leaf node in the embodiment of the present application can be an APP that supports different operating systems (such as Window and Linux, etc.). The cloud platform can provide the download address or installation file of the leaf node in its service control interface, and the user can download the installation file of the leaf node in the device and install the leaf node in the device. In addition, the cloud platform can also provide its assigned authentication key in the service control interface, and the user can write the authentication key assigned by the cloud platform in the configuration file of the leaf node. Since the leaf node can be parasitic in the operating system of the device, it only takes up a small amount of processor resources and memory space, so it can be flexibly embedded in devices in different types of local area networks to realize automatic drainage of traffic in the local area network. Among them, the processor may include a central processing unit (CPU).

[0090] It is also understandable that the user can deploy one or more leaf nodes in the local area network. As a first possible example, assuming that the local area network is a physical network (such as an enterprise branch physical network), the user can deploy N leaf nodes in the local area network, where N is an integer greater than 1, for example, N can be equal to 2. The N leaf nodes can achieve load sharing of traffic and ensure reliability. For example, refer to Figure 4 , the user can deploy 2 leaf nodes, namely the first leaf node and the second leaf node, in the physical network.

[0091] As a second possible example, assuming that the LAN is a VPC network, Figure 5 As shown, the user can deploy two leaf nodes in the LAN, one of which is a primary leaf node and the other is a backup leaf node. By deploying two primary and backup leaf nodes, the reliability of forwarding traffic in the LAN through the leaf nodes can be ensured.

[0092] Step 104: The user configures the next hop of the egress device of the local area network as the at least one leaf node.

[0093] After the user has deployed at least one leaf node in the LAN, the user can configure the next hop of the LAN's egress device to be the at least one leaf node. In other words, the user can configure the next hop address of the LAN's egress device to be the address of the at least one leaf node. For example, the user can configure a static route on the egress device, and the next hop of Internet 0.0.0.0 in the static route is the at least one leaf node.

[0094] As a first possible example, see Figure 4 , N leaf nodes are deployed in the physical network, and the egress device of the physical network is a network device. The user can configure ECMP routing on the network device, and the next hop of the ECMP routing points to the N leaf nodes. For example, the next hop of the ECMP routing points to the first leaf node and the second leaf node respectively.

[0095] As a second possible example, see Figure 5 , two leaf nodes, active and standby, are deployed in the VPC network, and the egress device of the VPC network is the VPC gateway, which can connect to the virtual machines (VMs) in the VPC network. The two leaf nodes in the VPC network can share the same virtual IP address. Users can configure VPC routing on the VPC gateway, and the next hop of the VPC routing is the virtual IP address.

[0096] Step 105: The leaf node sends authentication information to the cloud platform.

[0097] In the embodiment of the present application, after the user configures the authentication key in the leaf node, the leaf node can send authentication information (also called authentication request) to the cloud platform, and the authentication information can carry the authentication key configured by the user. If multiple leaf nodes are deployed in the local area network, the multiple leaf nodes can all send authentication information to the cloud platform.

[0098] Example, reference Figure 4, the first leaf node can send the first authentication information to the cloud platform, and the second leaf node can send the second authentication information to the cloud platform. Both the first authentication information and the second authentication information can carry the authentication key configured by the user.

[0099] Step 106: The cloud platform authenticates the leaf node based on the authentication key in the authentication information.

[0100] After the cloud platform receives the authentication information sent by the leaf node, it can authenticate the leaf node based on the authentication key in the authentication information. If the cloud platform determines that the authentication key sent by the leaf node is consistent with the authentication key assigned by the cloud platform, it can be determined that the leaf node has passed the authentication and the leaf node can be registered and managed.

[0101] It is understandable that if multiple leaf nodes are deployed in the local area network, and the cloud platform receives authentication information sent by the multiple leaf nodes, the cloud platform can authenticate the leaf node based on the authentication information sent by each leaf node. Figure 4 In the scenario shown, the cloud platform can authenticate the first leaf node based on the first authentication information sent by the first leaf node, and can authenticate the second leaf node based on the second authentication information sent by the second leaf node.

[0102] Step 107: If the cloud platform determines that the leaf node has passed the authentication based on the authentication information, a first acceleration node for the leaf node to access is determined from multiple acceleration nodes.

[0103] In an embodiment of the present application, after the cloud platform determines that the leaf node has passed authentication, it can also determine a first acceleration node for the leaf node to access from a plurality of acceleration nodes managed by it.

[0104] Optionally, the cloud platform can determine the first acceleration node for the leaf node to access based on the distance between the leaf node and the multiple acceleration nodes. The distance between the leaf node and the first acceleration node can be less than a threshold, that is, the distance between the first acceleration node determined by the cloud platform and the leaf node is relatively close, so as to ensure that the leaf node can access the nearest acceleration node. In this way, it can be ensured that the traffic of the local area network can be quickly forwarded to the acceleration network, thereby effectively improving the speed at which the devices in the local area network access Internet services through the acceleration network.

[0105] It is understandable that the threshold value may be a distance value pre-configured in the cloud platform, or it may be determined by the cloud platform based on the distance between the leaf node and the multiple acceleration nodes. For example, the threshold value may be the mean or lower quartile of the distance between the leaf node and the multiple acceleration nodes. Alternatively, the threshold value may be the distance value that is located second after the distance between the leaf node and the multiple acceleration nodes is arranged in order from small to large. That is, the first acceleration node may be the acceleration node that is closest to the leaf node.

[0106] It can also be understood that the cloud platform can determine the distance between the leaf node and each acceleration node based on the IP address of the leaf node and the physical location of the acceleration node (such as longitude and latitude data).

[0107] It can also be understood that if a plurality of leaf nodes are deployed in a certain local area network, the first acceleration node determined by the cloud platform can be used for access by the plurality of leaf nodes. That is, a plurality of leaf nodes in the same local area network can access the same acceleration node.

[0108] Step 108: The cloud platform sends a scheduling strategy to the leaf nodes.

[0109] After the cloud platform determines the first acceleration node for the leaf node to access, it can send a scheduling policy to the leaf node, which can be used to instruct the leaf node to access the first acceleration node. For example, the scheduling policy can include the IP address of the first acceleration node.

[0110] It is understandable that if there are multiple leaf nodes deployed in the LAN, the cloud platform can send scheduling policies to each leaf node separately. Figure 4 , the cloud platform can send scheduling strategies to the first leaf node and the second leaf node respectively.

[0111] Step 109: The leaf node establishes a first tunnel with the first acceleration node based on the scheduling strategy.

[0112] In an embodiment of the present application, after the leaf node receives the scheduling policy issued by the cloud platform, it can automatically establish a first tunnel with the first acceleration node based on the scheduling policy. For example, the leaf node can determine that the acceleration node it needs to access is the first acceleration node based on the scheduling policy. After that, the leaf node can perform tunnel negotiation with the first acceleration node. For example, the leaf node can perform tunnel negotiation with the first acceleration node based on the configured authentication key, thereby establishing a first tunnel with the first acceleration node.

[0113] It is understandable that if multiple leaf nodes deployed in the local area network all receive the scheduling policy issued by the cloud platform, each of the multiple leaf nodes can establish a tunnel with the first acceleration node based on the scheduling policy. Figure 4 , the first leaf node can establish a first tunnel with the first acceleration node based on the scheduling policy. The second leaf node can establish a third tunnel with the first acceleration node based on the scheduling policy. The tunnels (such as the first tunnel and the third tunnel) established between the leaf node and the first acceleration node can be software development kit (SDK) tunnels.

[0114] Based on the above steps, it can be seen that in the method provided in the embodiment of the present application, the cloud platform can uniformly schedule complex tunnel diversion protocols to achieve automatic negotiation and diversion between leaf nodes and acceleration nodes. The operation and maintenance personnel only need to configure simple static routes on the export devices to divert the LAN traffic to the leaf nodes.

[0115] Step 110: The leaf node forwards the message sent by the egress device to the first acceleration node through the first tunnel.

[0116] In the embodiment of the present application, since the next hop of the LAN egress device points to the leaf node, the traffic in the LAN will be directed to the leaf node by the egress device. After the leaf node receives the message sent by the egress device, it can automatically forward the message to the first acceleration node through the first tunnel, that is, the leaf node can automatically "dump" the traffic of the LAN to the first acceleration node to which it is connected.

[0117] It is understandable that if multiple leaf nodes are deployed in the LAN, and the next hop of the LAN egress device points to the multiple leaf nodes, the traffic in the LAN will be directed to the multiple leaf nodes by the egress device. After each leaf node receives the message sent by the egress device, it can automatically forward the message to the first acceleration node through the tunnel between it and the first acceleration node.

[0118] For example, refer to Figure 4 , the egress device can forward the traffic load of the LAN to the first leaf node and the second leaf node in a load-balanced manner. The first leaf node can forward the received message to the first acceleration node through the first tunnel, and the second leaf node can forward the received message to the first acceleration node through the third tunnel.

[0119] It can also be understood that the first acceleration node stores a routing table issued by the cloud platform. Based on the routing table, the first acceleration node can forward the message of the local area network to the target device in the Internet, thereby achieving the purpose of accelerating the access of the local area network to the Internet service.

[0120] Step 111: If the cloud platform detects that the first acceleration node fails, it determines a second acceleration node for the leaf node to access from multiple acceleration nodes.

[0121] During the process of traffic forwarding, if the cloud platform detects that the first acceleration node fails, in order to ensure reliability, the cloud platform can re-determine the second acceleration node for the leaf node to access from multiple acceleration nodes. It is understandable that the cloud platform can also determine the second acceleration node for the leaf node to access based on the distance between the leaf node and the multiple acceleration nodes. For example, the distance between the leaf node and the second acceleration node can also be less than a threshold. For example, the second acceleration node can be the acceleration node closest to the leaf node except the first acceleration node.

[0122] Optionally, after the first acceleration node fails, the failure information may be actively reported to the cloud platform, and the cloud platform may determine that the first acceleration node is faulty based on the failure information reported by the first acceleration node. Alternatively, the cloud platform may actively detect whether the first acceleration node is faulty, for example, the cloud platform may detect whether the first acceleration node is faulty through a detection message (such as a heartbeat message) between the cloud platform and the first acceleration node.

[0123] Step 112: The cloud platform sends an access change message to the leaf node.

[0124] After the cloud platform determines the second acceleration node, it can send an access change message to the leaf node. The access change message is used to instruct the first leaf node to access the second acceleration node. For example, the access change message includes the IP address of the second acceleration node.

[0125] It is understandable that if multiple leaf nodes are deployed in the local area network, the cloud platform sends an access change message to each leaf node to instruct each leaf node to reconnect to the second acceleration node. Figure 4 , the cloud platform can send access change messages to the first leaf node and the second leaf node respectively.

[0126] Step 113: The leaf node establishes a second tunnel with the second acceleration node based on the access change message.

[0127] After receiving the access change message sent by the cloud platform, the leaf node can re-negotiate the tunnel with the second acceleration node based on the access change message to establish a second tunnel with the second acceleration node.

[0128] It is understandable that if multiple leaf nodes are deployed in the local area network, and the multiple leaf nodes have received the access change message sent by the cloud platform, each leaf node can reconnect to the second acceleration node, that is, each leaf node can establish a tunnel with the second acceleration node. Figure 4, the first leaf node can establish a second tunnel with the second acceleration node, and the second leaf node can establish a fourth tunnel with the second acceleration node.

[0129] Step 114: The leaf node forwards the message sent by the egress device to the second acceleration node through the second tunnel.

[0130] In the embodiment of the present application, after the second tunnel is established between the leaf node and the second acceleration node, the message sent by the egress device in the local area network can be forwarded to the second acceleration node through the second tunnel. The second acceleration node can then forward the message of the local area network to the target device in the Internet based on the routing table issued by the cloud platform.

[0131] It is understandable that if multiple leaf nodes are deployed in the local area network, after each leaf node receives a message sent by the egress device, it can automatically forward the message to the second acceleration node through the tunnel between it and the second acceleration node. Figure 4 , the egress device can forward the traffic load of the LAN to the first leaf node and the second leaf node in a load-balanced manner. The first leaf node can forward the received message to the second acceleration node through the second tunnel, and the second leaf node can forward the received message to the second acceleration node through the fourth tunnel.

[0132] It is also understandable that the order of the steps of the traffic forwarding method provided in the embodiment of the present application can be adjusted appropriately, and the steps can be increased or decreased accordingly. For example, the above steps 105 to 107 can be deleted according to the situation; or steps 111 to 114 can be deleted according to the situation.

[0133] The following takes the local area network as a physical network (such as an enterprise branch physical network) as an example to introduce the traffic forwarding method provided in the embodiment of the present application. Figure 6 As shown, the method may include:

[0134] 1. The operation and maintenance personnel apply for multiple hosts in the physical network and deploy N leaf nodes with one click (at least 2 active and standby nodes are reliable);

[0135] 2. The operation and maintenance personnel configure the authentication keys such as APPCode in the leaf node, and the leaf node is registered and managed with the central cloud platform and passes the authentication;

[0136] 3. The cloud platform interacts with the leaf nodes and schedules the leaf nodes so that they can access the nearest acceleration nodes.

[0137] 4. The operation and maintenance personnel configure ECMP routing on the egress device of the physical network (such as a network device). The next hop of the ECMP routing points to N leaf nodes to ensure reliability after any leaf node fails.

[0138] 5. The network device diverts the traffic of the physical network to the leaf node, and the leaf node redirects the traffic to the acceleration network through the SDK tunnel;

[0139] 6. Accelerate network access to Internet public network services through overlay routing;

[0140] 7. If the acceleration node connected to the leaf node fails, the cloud platform will sense the failure and notify the leaf node to change to a new acceleration node to ensure that the business failure can be recovered in time.

[0141] Based on the above process, in the scenario of enterprise branch physical network, when the traffic of physical network is diverted to the acceleration network, tenants do not need to configure complex VXLAN protocols, such as VNI and VXLAN peers. If reliability is further considered, there is no need to configure complex protocols such as EVPN BGP, OSPF and VPN. In addition, tenants do not need to configure complex GRE protocols, including network configurations such as GRE tunnels, peers and static routes. If reliability is further considered, there is no need to configure active-standby GRE tunnels, active-standby routes and active-standby fault detection switching protocols. Tenants only need to install leaf nodes with one click and configure simple ECMP static routes to leaf nodes.

[0142] The following takes the local area network as a VPC network as an example to introduce the traffic forwarding method provided by the embodiment of the present application. Figure 7 As shown, the method may include:

[0143] 1. The operation and maintenance personnel apply for two hosts in the VPC of the cloud region (region), deploy the active and standby leaf nodes with one click, and configure the virtual IP address in the VPC network. The virtual IP address is bound to the active and standby leaf nodes.

[0144] 2. The operation and maintenance personnel configure the authentication keys such as APPCode in the leaf node, and the leaf node is registered and managed with the central cloud platform and passes the authentication;

[0145] 3. The cloud platform interacts with the leaf nodes and schedules the leaf nodes based on data such as longitude and latitude, so that the leaf nodes can access the nearest acceleration nodes;

[0146] 4. Configure the VPC route next hop to point to the leaf node virtual IP address to ensure failure reliability;

[0147] 5. After the VPC traffic is directed to the leaf node, the leaf node redirects the traffic to the acceleration network through the SDK tunnel;

[0148] 6. Accelerate network access to Internet public network services through overlay routing;

[0149] 7. If the acceleration node connected to the leaf node fails, the cloud platform will sense the failure and notify the leaf node to change to a new acceleration node to ensure that the business failure can be recovered in time.

[0150] Based on the above process, in the cloud vendor VPC scenario, when the traffic of the VPC network is diverted to the acceleration network, tenants do not need to configure complex IPSecVPN protocols, such as SA, IPsecVPN Peer, and static routing. If reliability is further considered, there is no need to configure the primary and backup IPsecVPN tunnels, primary and backup routes, and primary and backup fault detection switching protocols. Tenants only need to install the leaf node with one click and configure a simple VPC static route to the leaf node.

[0151] Based on the above analysis, it can be seen that the method provided by the embodiment of the present application can simplify and shield the complex routing protocol configuration and docking process, allowing users to divert LAN traffic to the acceleration network by configuring simple static routes (such as ECMP static routes or VPC routes). The acceleration network can automatically select routes and forward, ultimately achieving the purpose of accelerating access to Internet services. During the above diversion process, users do not need to perceive complex routing protocol technologies such as VXLAN, EVPN, GRE, IPSecVPN, and master-slave detection, and can increase the speed of docking the LAN with the acceleration network route from 4 hours to 0.5 hours.

[0152] In summary, an embodiment of the present application provides a traffic forwarding method, and the cloud platform can assign an authentication key to the user based on the accelerated access request sent by the user, so that the user can deploy a leaf node in the local area network. The leaf node can forward the message in the local area network to the acceleration node in the acceleration network so as to access the Internet through the acceleration node. After the user deploys the leaf node in the local area network based on the authentication key assigned by the cloud platform, the leaf node can directly divert the traffic of the local area network to the acceleration node in the acceleration network, so the diversion process does not require the user to perceive and configure complex routing protocols. As a result, the complexity of routing docking between the local area network and the acceleration node in the acceleration network is effectively reduced, and the efficiency of diverting traffic to the acceleration node is improved.

[0153] The embodiment of the present application provides a traffic forwarding system, which can implement the traffic forwarding method provided by the above method example. Figure 1 The traffic forwarding system includes: a cloud platform, a first leaf node and a first acceleration node. Figure 8 As shown, the cloud platform includes: a communication unit 201 and a processing unit 202 .

[0154] The communication unit 201 is used to receive an accelerated access request from a user. The processing unit 202 is used to assign an authentication key to the user. The authentication key is used for the user to deploy a first leaf node in a local area network. The functional implementation of the communication unit 201 can refer to the relevant description of step 101 in the above method embodiment, and the functional implementation of the processing unit 202 can refer to the relevant description of step 102 in the above method embodiment.

[0155] The first leaf node is used to forward the message sent by the egress device in the local area network to the first acceleration node in the acceleration network.

[0156] The first acceleration node is used to send the message to a target device, where the target device is located on the Internet.

[0157] Optionally, the communication unit 201 may also be used to receive first authentication information sent by the first leaf node, wherein the first authentication information carries the authentication key. The function of the communication unit 201 may also refer to the relevant description of step 105 in the above method embodiment.

[0158] Optionally, the processing unit 202 may also be used to authenticate the first leaf node based on the authentication key in the first authentication information. The function of the processing unit 202 may also refer to the relevant description of step 106 in the above method embodiment.

[0159] Optionally, the processing unit 202 may also be used to: if it is determined that the first leaf node is authenticated, determine a first acceleration node for access by the first leaf node from the multiple acceleration nodes included in the acceleration network. The function of the processing unit 202 may also refer to the relevant description of step 107 in the above method embodiment.

[0160] Optionally, the communication unit 201 may also be used to send a scheduling policy to the first leaf node. The function of the communication unit 201 may also refer to the relevant description of step 108 in the above method embodiment.

[0161] The first leaf node is further used to establish a tunnel with the first acceleration node based on the scheduling strategy, and forward messages sent by the egress device in the local area network through the tunnel.

[0162] Optionally, the processing unit 202 is further configured to determine a second acceleration node for access by the first leaf node from among the plurality of acceleration nodes included in the acceleration network if a failure of the first acceleration node is detected. The function of the processing unit 202 may also refer to the relevant description of step 111 in the above method embodiment.

[0163] The communication unit 201 is also used to send an access change message to the first leaf node, and the access change message is used to instruct the first leaf node to forward the message to the second acceleration node. The function of the communication unit 201 can also refer to the relevant description of step 112 in the above method embodiment.

[0164] The first leaf node is further used to forward the message sent by the egress device in the local area network to the second acceleration node based on the access change message.

[0165] The second acceleration node is used to send the message to the target device.

[0166] Optionally, the authentication key is also used for the user to deploy a second leaf node in the local area network, that is, the traffic forwarding system may also include: a second leaf node deployed by the user in the local area network based on the authentication key. The second leaf node is used to obtain the message sent by the egress device and forward the message to the first acceleration node.

[0167] Optionally, the communication unit 201 may also be used to receive second authentication information sent by the second leaf node, where the second authentication information carries the authentication key.

[0168] The processing unit 202 may also be configured to authenticate the second leaf node based on the authentication key in the second authentication information.

[0169] Optionally, the local area network is a physical network, and the next hop of the equal-cost multi-path route configured on the egress device points to the first leaf node and the second leaf node respectively. Alternatively, the local area network is a VPC network, and the first leaf node and the second leaf node share a virtual IP address, and the next hop of the VPC route on the egress device is the virtual IP address.

[0170] In summary, an embodiment of the present application provides a traffic forwarding system, in which a cloud platform can assign authentication keys to users based on accelerated access requests sent by users, so that users can deploy leaf nodes in a local area network. The leaf node can forward messages within the local area network to the acceleration node in the acceleration network so as to access the Internet through the acceleration node. Since the user deploys a leaf node in the local area network based on the authentication key assigned by the cloud platform, the leaf node can directly divert the traffic of the local area network to the acceleration node in the acceleration network, so the diversion process does not require the user to perceive and configure complex routing protocols. As a result, the complexity of routing docking between the local area network and the acceleration node in the acceleration network is effectively reduced, and the efficiency of diverting traffic to the acceleration node is improved.

[0171] The present application embodiment provides a leaf node, which can be applied to Figure 1 , Figure 2 , Figure 4 and Figure 5 In the traffic forwarding system shown in FIG. 1 , the steps performed by the leaf node in the above method example can be implemented. In addition, the leaf node is deployed in a local area network, and the next hop of the egress device in the local area network points to the leaf node. Fig. 9 As shown, the leaf node includes:

[0172] The receiving module 301 is used to receive the scheduling policy issued by the cloud platform, and the scheduling policy is used to instruct the leaf node to access the first acceleration node among the multiple acceleration nodes. The function of the receiving module 301 can refer to the relevant description of step 108 in the above method embodiment.

[0173] The establishment module 302 is used to establish a first tunnel with the first acceleration node based on the scheduling policy. The function of the establishment module 302 can refer to the relevant description of step 109 in the above method embodiment.

[0174] The forwarding module 303 is used to forward the message sent by the egress device to the first acceleration node through the first tunnel. The implementation of the function of the forwarding module 303 can refer to the relevant description of step 110 in the above method embodiment.

[0175] Optionally, continue to refer to Fig. 9 The leaf node may further include: a sending module 304, which is used to send authentication information to the cloud platform, and the authentication information is used for the cloud platform to authenticate the leaf node. The function of the sending module 304 can refer to the relevant description of step 105 in the above method embodiment.

[0176] Optionally, the receiving module 301 may also be used to receive an access change message sent by the cloud platform, the access change message being used to instruct the leaf node to access a second acceleration node among the multiple acceleration nodes. The function of the receiving module 301 may also refer to the relevant description of step 112 in the above method embodiment.

[0177] The establishing module 302 may also be used to establish a second tunnel with the second acceleration node based on the access change message. The implementation of the functions of the establishing module 302 may also refer to the relevant description of step 113 in the above method embodiment.

[0178] The forwarding module 303 can also be used to forward the message sent by the egress device to the second acceleration node through the second tunnel. The function of the forwarding module 303 can also refer to the relevant description of step 114 in the above method embodiment.

[0179] Optionally, the leaf node is configured with an authentication key assigned by the cloud platform; the establishment module 302 can be used to perform tunnel negotiation with the first acceleration node based on the scheduling strategy and the authentication key to establish a first tunnel.

[0180] In summary, an embodiment of the present application provides a leaf node, which is deployed in a local area network. The leaf node can establish a tunnel with the acceleration node based on the scheduling policy issued by the cloud platform. As a result, the leaf node can forward the traffic in the local area network to the acceleration node to which it is connected. The solution provided by the embodiment of the present application does not require the user to perceive and configure complex routing protocols, effectively reduces the complexity of routing docking between the local area network and the acceleration node in the acceleration network, and improves the efficiency of directing traffic to the acceleration node.

[0181] It is understandable that each unit and module in the above-mentioned cloud platform and leaf nodes can be implemented by software or by hardware. As an example of a software functional unit, the unit and module may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, each module may include code running on multiple hosts / virtual machines / containers. It is understandable that multiple hosts / virtual machines / containers for running the code may be distributed in the same region or in different regions. Further, multiple hosts / virtual machines / containers for running the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including a data center or multiple data centers with similar geographical locations. Among them, usually a region may include multiple AZs.

[0182] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0183] As an example of a hardware functional unit, a module may include at least one computing device, such as a server, etc. Alternatively, a module may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0184] The multiple computing devices included in the module can be distributed in the same region or in different regions. The multiple computing devices included in the module can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the module can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0185] It can be understood that in other embodiments, each module included in the cloud platform and the leaf node can be used to execute any step in the above-mentioned traffic forwarding method, and the steps that each module is responsible for implementing can be specified as needed. The full functions of the traffic forwarding device can be realized by implementing different steps in the traffic forwarding method through the above-mentioned modules.

[0186] Fig.10 is a schematic diagram of the structure of a computing device provided in an embodiment of the present application. Fig.10 , the computing device may include: a bus 402, a processor 404, a memory 406, and a communication interface 408. The processor 404, the memory 406, and the communication interface 408 communicate through the bus 402. The computing device may be a server or a terminal device. It should be understood that the embodiment of the present application does not limit the number of processors and memories in the computing device.

[0187] The bus 402 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.10 The bus 404 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 404 may include a path for transmitting information between various components of the computing device (for example, the memory 406, the processor 404, and the communication interface 408).

[0188] The processor 404 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0189] The memory 406 may include a volatile memory, such as a random access memory (RAM). The processor 404 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0190] The memory 406 stores executable program codes, and the processor 404 executes the executable program codes to respectively implement the functions of each unit in the aforementioned cloud platform, or the functions of each module in the leaf node, thereby implementing the traffic forwarding method provided by the aforementioned method embodiment. That is, the memory 406 stores instructions for executing the traffic forwarding method.

[0191] The communication interface 403 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device and other devices or a communication network.

[0192] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0193] like Fig.11 As shown, the computing device cluster includes at least one computing device. The memory 406 in one or more computing devices in the computing device cluster may store the same instructions for executing the above traffic forwarding method.

[0194] In some possible implementations, the memory 406 of one or more computing devices in the computing device cluster may also store some instructions for executing the above traffic forwarding method. In other words, a combination of one or more computing devices may jointly execute instructions for executing the above traffic forwarding method.

[0195] It is understandable that the memory 406 in different computing devices in the computing device cluster can store different instructions, which are respectively used to execute part of the functions of the traffic forwarding device. That is, the instructions stored in the memory 406 in different computing devices can implement the function of at least one unit in the cloud platform, or can implement the function of at least one module in the leaf node.

[0196] In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network. Fig.12 A possible implementation is shown in FIG. Fig.12 As shown, two computing devices 400A and 400B are connected via a network. Specifically, the network is connected via a communication interface in each computing device. In this type of possible implementation, the memory 406 in different computing devices in the computing device cluster can store different instructions for executing part of the functions of the traffic forwarding device. That is, the instructions stored in the memory 406 in different computing devices can implement the functions of at least one unit in the cloud platform, or can implement the functions of one or more modules in the leaf node.

[0197] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computing device to execute the traffic forwarding method provided in the above method embodiment.

[0198] The embodiment of the present application also provides a computer program product including instructions. The computer program product may be a software or program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the traffic forwarding method provided in the above method embodiment.

[0199] In the embodiments of the present application, the terms "first", "second" and "third" are used for descriptive purposes only and should not be understood as indicating or implying relative importance. In the embodiments of the present application, the term "at least one" refers to one or more, and "multiple" refers to two or more. In the embodiments of the present application, the term "and / or" is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the previously associated objects are in an "or" relationship.

[0200] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present application, rather than to limit them. Although the embodiments of the present application have been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A traffic forwarding method, characterized in that: The method comprises: The cloud platform allocates an authentication key to the user according to the accelerated access request issued by the user, so that the user can deploy a first leaf node in the local area network; The first leaf node obtains a message sent by an egress device in the local area network, and forwards the message to a first acceleration node in the acceleration network; The first acceleration node sends the message to a target device, where the target device is located on the Internet.

2. The method according to claim 1, characterized in that The method further comprises: The cloud platform receives first authentication information sent by the first leaf node, where the first authentication information carries the authentication key; The cloud platform authenticates the first leaf node based on the authentication key in the first authentication information.

3. The method according to claim 2, characterized in that The method further comprises: If the cloud platform determines that the first leaf node has passed authentication, it determines a first acceleration node for access by the first leaf node from a plurality of acceleration nodes included in the acceleration network.

4. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: The cloud platform sends a scheduling policy to the first leaf node; The first leaf node establishes a tunnel with the first acceleration node based on the scheduling policy; The first acceleration node forwarding the message to a first acceleration node in the acceleration network includes: the first acceleration node forwarding the message to the first acceleration node through the tunnel.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: If the cloud platform detects that the first acceleration node fails, determining a second acceleration node for access by the first leaf node from a plurality of acceleration nodes included in the acceleration network; The cloud platform sends an access change message to the first leaf node; The first leaf node forwards the message to the second acceleration node based on the access change message; The second acceleration node sends the message to the target device.

6. The method according to any one of claims 1 to 5, characterized in that: The authentication key is also used for the user to deploy a second leaf node in the local area network; the method further includes: The second leaf node obtains the message, and forwards the message to the first acceleration node.

7. The method according to claim 6, characterized in that The method further comprises: The cloud platform receives second authentication information sent by the second leaf node, where the second authentication information carries the authentication key; The cloud platform authenticates the second leaf node based on the authentication key in the second authentication information.

8. The method according to claim 6 or 7, characterized in that: The local area network is a physical network, and the next hop of the equal-cost multi-path routing configured on the egress device points to the first leaf node and the second leaf node respectively; Alternatively, the local area network is a VPC network, the first leaf node and the second leaf node share a virtual Internet Protocol IP address, and the next hop of the VPC route on the egress device is the virtual IP address.

9. A traffic forwarding system, characterized in that: The traffic forwarding system includes a cloud platform, a first leaf node and a first acceleration node; The cloud platform is used to allocate an authentication key to the user according to an accelerated access request issued by the user, so that the user can deploy the first leaf node in the local area network; The first leaf node is used to obtain a message sent by an egress device in the local area network, and forward the message to the first acceleration node in the acceleration network; The first acceleration node is used to send the message to a target device, and the target device is located on the Internet.

10. The system according to claim 9, characterized in that The cloud platform is also used for: Receiving first authentication information sent by the first leaf node, where the first authentication information carries the authentication key; The first leaf node is authenticated based on the authentication key in the first authentication information.

11. The system according to claim 10, characterized in that The cloud platform is further configured to determine, if it is determined that the first leaf node has passed authentication, a first acceleration node for access by the first leaf node from among a plurality of acceleration nodes included in the acceleration network.

12. The system according to any one of claims 9 to 11, characterized in that: The cloud platform is further used to send a scheduling strategy to the first leaf node; The first leaf node is further configured to establish a tunnel with the first acceleration node based on the scheduling policy; The first acceleration node is used to forward the message to the first acceleration node through the tunnel.

13. The system according to any one of claims 9 to 12, characterized in that: The cloud platform is further configured to determine, from the plurality of acceleration nodes included in the acceleration network, a second acceleration node for access by the first leaf node if a failure of the first acceleration node is detected; The cloud platform is further used to send an access change message to the first leaf node; The first leaf node is further configured to forward the message to the second acceleration node based on the access change message; The second acceleration node is used to send the message to the target device.

14. The system according to any one of claims 9 to 13, characterized in that: The traffic forwarding system further includes: a second leaf node deployed by the user in the local area network based on the authentication key; The second leaf node is used to obtain the message and forward the message to the first acceleration node.

15. The system according to claim 14, characterized in that The cloud platform is also used for: Receiving second authentication information sent by the second leaf node, where the second authentication information carries the authentication key; The second leaf node is authenticated based on the authentication key in the second authentication information.

16. The system according to claim 14 or 15, characterized in that The local area network is a physical network, and the next hop of the equal-cost multi-path routing configured on the egress device points to the first leaf node and the second leaf node respectively; Alternatively, the local area network is a VPC network, the first leaf node and the second leaf node share a virtual Internet Protocol IP address, and the next hop of the VPC route on the egress device is the virtual IP address.

17. A computing device cluster, characterized in that: comprising at least one computing device, each computing device comprising a processor and a memory; The processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 8.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster executes the method according to any one of claims 1 to 8.

19. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster executes the method according to any one of claims 1 to 8.

Images