Message transmission control method, computing node, device and system

Abstract

The invention discloses a message transmission control method, a computing node, equipment and a system. The message transmission control method comprises the following steps: responding to online of a target virtual machine, receiving a forwarding flow table issued by a control device through a corresponding target virtual switch, the forwarding flow table being used for representing a message forwarding path between the target virtual machine and a corresponding target address configuration service; when an address request message sent by a target virtual machine is received, broadcasting the address request message to a target address configuration service and at least one virtual machine connected with the target virtual switch through the target virtual switch based on the forwarding flow table; and generating an address configuration message through the target address configuration service, and sending the address configuration message to the target virtual machine. The hardware cost and the maintenance cost of a management plane are reduced, the response speed of address allocation is improved, and larger-scale public cloud construction can be supported.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a message transmission control method, computing node, device and system. Background Art

[0002] Public cloud usually refers to the cloud provided by a third-party provider for users. The public cloud platform is responsible for organizing and coordinating computing resources and providing three types of virtualization services: computing, networking, and storage according to user needs.

[0003] In the related art, a public cloud generally contains multiple computing nodes, and the virtual machines (VMs) deployed on each computing node need to obtain Internet Protocol (IP) addresses through Dynamic Host Configuration Protocol (DHCP). As the scale of computing nodes in public cloud data centers continues to expand, the controller's DHCP service capabilities for all virtual machines will be limited by the processing power of the Software Defined Network (SDN) controller, increasing the hardware cost and maintenance cost of the SDN server. Summary of the invention

[0004] The present application mainly provides a message transmission control method, computing node, device and system, which can not only reduce the hardware cost and maintenance cost of the management side and improve the response speed of address allocation, but also support larger-scale public cloud construction without increasing hardware.

[0005] The technical solution of this application is implemented as follows:

[0006] In a first aspect, an embodiment of the present application provides a message transmission control method, wherein a cloud computing system includes at least one computing node, each computing node includes at least one virtual switch, at least one address configuration service, and at least one virtual machine; the message transmission control method includes:

[0007] In response to the target virtual machine going online, receiving a forwarding flow table sent by a control device through a corresponding target virtual switch, where the forwarding flow table is used to represent a message forwarding path between the target virtual machine and the corresponding target address configuration service;

[0008] When receiving an address request message sent by the target virtual machine, broadcasting the address request message to the target address configuration service and at least one virtual machine connected to the target virtual switch through the target virtual switch based on the forwarding flow table;

[0009] Generate an address configuration message through the target address configuration service and send the address configuration message to the target virtual machine.

[0010] In a second aspect, an embodiment of the present application provides a message transmission control method, wherein the cloud computing system includes a control device, and the message transmission control method includes:

[0011] Acquire multiple fields to be encoded in the forwarding flow table through a control device, and determine the numbers corresponding to the multiple fields to be encoded respectively;

[0012] According to the multiple to-be-encoded fields and the numbers corresponding to the multiple to-be-encoded fields, the forwarding flow table is compressed by a control device to obtain a compressed forwarding flow table;

[0013] The compressed forwarding flow table is stored in the local database through the control device.

[0014] In a third aspect, an embodiment of the present application provides a message transmission control method, wherein the cloud computing system includes a network isolation device and a public network gateway device; the message transmission control method includes:

[0015] Receiving an access message sent by a target virtual machine in a target computing node through a network isolation device;

[0016] Performing address translation on the access message through the network isolation device to obtain a translated access message, and sending the translated access message to the public network gateway device;

[0017] The converted access message is subjected to address translation by a public network gateway device to obtain a public network access message, and the public network access message is sent to a corresponding receiving device in the public network.

[0018] In a fourth aspect, an embodiment of the present application provides a computing node, the computing node comprising at least one virtual switch, at least one address configuration service and at least one virtual machine; wherein:

[0019] The virtual machine is used to send an address request message to the corresponding virtual switch;

[0020] A virtual switch, configured to receive and, based on the forwarding flow table sent by the control device, broadcast the address request message to a corresponding address configuration service and at least one virtual machine connected to the virtual switch;

[0021] The address configuration service is used to generate an address configuration message based on the address request message and send the address configuration message to the virtual machine through the virtual switch.

[0022] In a fifth aspect, an embodiment of the present application provides a network isolation device, the network isolation device comprising at least one tenant domain; wherein:

[0023] The network isolation device is used to receive access messages sent by virtual machines in computing nodes, perform address translation on the access messages, obtain translated access messages, and send the translated access messages to corresponding public network gateway devices.

[0024] In a sixth aspect, an embodiment of the present application provides a control device, the control device comprising a local database; wherein:

[0025] A control device is used to obtain multiple fields to be encoded in a forwarding flow table and determine the numbers corresponding to the multiple fields to be encoded; compress the forwarding flow table according to the multiple fields to be encoded and the numbers corresponding to the multiple fields to be encoded, obtain a compressed forwarding flow table, and store the compressed forwarding flow table in a local database.

[0026] In the seventh aspect, an embodiment of the present application provides a cloud computing system, which includes a public network gateway device, a network isolation device as described in the fifth aspect, a control device as described in the sixth aspect, and at least one computing node as described in the fourth aspect.

[0027] The embodiment of the present application provides a message transmission control method, computing node, device and system. When receiving an address request message sent by a target virtual machine, the target switch, based on the forwarding flow table issued by the control device, floods the address request message in the target address configuration service and at least one switch connected to the target virtual switch. Finally, the target address configuration service generates an address configuration message and sends it to the target virtual machine. In this way, the address request message is only flooded in the second layer of the same computing node and the same network segment, avoiding the impact of the address request message on the bandwidth of the supporting network. In addition, the distributed address configuration service provides addresses to the corresponding virtual machines, which can support the address configuration of large-scale networks, which can not only reduce the hardware cost and maintenance cost of the management side, improve the response speed of address allocation, but also support the construction of larger-scale public clouds without increasing hardware. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A network topology diagram of a public cloud;

[0029] Figure 2 A schematic diagram of an interaction process for an address configuration service;

[0030] Figure 3 A topological diagram of a cloud computing system provided in an embodiment of the present application;

[0031] Figure 4 A flow chart of a message transmission control method provided in an embodiment of the present application Figure 1 ;

[0032] Figure 5A schematic diagram of an address allocation process provided in an embodiment of the present application Figure 1 ;

[0033] Figure 6 A schematic diagram of an address allocation process provided in an embodiment of the present application Figure 2 ;

[0034] Figure 7 Configure a flow chart for a flow table;

[0035] Figure 8 A flow chart of a message transmission control method provided in an embodiment of the present application Figure 2 ;

[0036] Fig. 9 A schematic diagram of a forwarding flow table provided in an embodiment of the present application;

[0037] Fig.10 A schematic diagram of an address conversion process;

[0038] Fig.11 A flow chart of a message transmission control method provided in an embodiment of the present application Figure 3 ;

[0039] Fig.12 A schematic diagram of an address conversion process provided in an embodiment of the present application;

[0040] Fig.13 A schematic diagram of the structure of a computing node provided in an embodiment of the present application;

[0041] Fig.14 A schematic diagram of the composition structure of a network isolation device provided in an embodiment of the present application;

[0042] Fig.15 A schematic diagram of the composition structure of a control device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] In order to enable a more detailed understanding of the features and technical contents of the embodiments of the present application, the implementation of the embodiments of the present application is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present application.

[0044] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0045] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0046] It should also be pointed out that the terms "first\second\third" involved in the embodiments of the present application are only used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged in a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0047] The professional terms involved in this application include:

[0048] (1) Software Defined Networking: Software Defined Networking is a network architecture that achieves centralized management and programmatic control of the network by separating the network control plane (control logic) from the data plane (data forwarding). The core idea of ​​SDN is to centralize the network control logic in a central controller, thereby achieving network flexibility, programmability, and automation.

[0049] (2) Control device, also known as SDN controller. The SDN controller is the central control node of the software-defined network, responsible for managing and controlling the entire network. It communicates with network devices (such as switches and routers), issues control instructions and policies, and collects network status information. The SDN controller can implement network programming, traffic management, fault recovery and other functions.

[0050] (3) Virtual Switch (Open vSwitch or vSwitch, OVS): is an open source virtual switch software used to build and manage virtual networks in a virtualized environment. It can run on a virtual machine host and provide functions similar to traditional switches, such as virtual ports, virtual local area networks (VLANs), traffic forwarding, etc. OVS supports multiple protocols, including OpenFlow, enabling it to be integrated with SDN technology.

[0051] (4) Virtual Machine: A virtual machine is a software-implemented computing environment that can create multiple independent virtual computer instances on a physical computer. Each virtual machine can run its own operating system and applications, just like an independent physical computer. Virtualization technology enables multiple virtual machines to run in parallel on the same physical computer, thereby improving resource utilization and flexibility.

[0052] (5) Compute node: A compute node is a node or server that performs computing tasks in a distributed computing environment. In cloud computing and containerized environments, compute nodes usually take on the task of running virtual machines or containers and provide computing resources and execution environments.

[0053] (6) Dynamic Host Configuration Protocol: Dynamic Host Configuration Protocol is a network protocol used to automatically assign IP addresses and other network configuration information to computer devices. The DHCP server is responsible for managing the IP address pool and assigning available IP addresses, subnet masks, gateways and other configuration information to computer devices when they are connected to the network.

[0054] (7) Network Address Translation: Network Address Translation is a network technology used to convert IP addresses between different networks. NAT maps the private IP addresses of the internal network to public IP addresses on network boundary devices (such as routers or firewalls) to enable communication between internal computers and external networks. NAT technology can help solve the problem of IPv4 address shortage and provide network security.

[0055] (8) Programmable switches: Programmable switches are network switch devices with programmable control planes and data planes. They support programmatic definition and control of network traffic behavior, enabling network administrators to customize and adjust network functions as needed. Programmable switches are often associated with SDN technology and can communicate with SDN controllers through protocols such as OpenFlow.

[0056] (9) Virtual Private Cloud (VPC): VPC is a virtualized network environment used to create and manage virtual networks in a cloud platform. It provides logical isolation and security, enabling users to build their own private networks in the cloud.

[0057] Public cloud data centers mainly provide users with three types of virtualized services: computing, networking, and storage. The following is a brief technical background introduction to the network part of public cloud data centers.

[0058] Figure 1 is a network topology diagram of a public cloud. Figure 1 As shown in the figure, from an overall perspective, the public cloud data center network mainly includes the following elements:

[0059] Controller 102, also known as an SDN controller, serves as a data center network control plane, provides virtual machine network services, manages the entire network SDN network equipment, and converts service orchestration into network element configuration based on tenant needs and synchronizes the configuration to the network element.

[0060] The server node device, for example, may include a first device 104, a second device 105, ... an Nth device 106, where N is a positive integer greater than or equal to 1. These devices can provide computing resources for tenants to provide east-west and north-south intercommunication functions of a virtual private cloud. Each service node device includes at least one virtual machine and at least one virtual switch (vSwitch). For example, the first device 104 includes a virtual switch 1 1041 and a virtual machine 1 1042, the second device 105 includes a virtual switch 2 1051 and a virtual machine 2 1052, ..., and the Nth device 106 includes a virtual switch N 1061 and a virtual machine N 1062. At present, the configuration of the virtual switch is mainly in the form of a flow table. The virtual switch forwards and processes packets according to the flow table entries, including service flow packets for layer 2 and layer 3 intercommunication and access to the public network.

[0061] The public network egress 103 provides the tenant virtual private cloud with the ability to access the public network 101 and provide services for the public network 101, and can convert overlapping private addresses of different tenants into corresponding public network IP addresses.

[0062] The basic network 107 , which can generally be an underlay network, is a bottom-level physical network responsible for data packet transmission between the device and the controller 102 and the public network outlet 103 .

[0063] Figure 2 The following is a schematic diagram of the interaction process of an address configuration service. Figure 2 As shown, taking the controller 102 assigning an IP address to the first device 104 as an example, in the prior art, the controller 102 generally deploys DHCP server software (such as dnsmasq) to provide DHCP services for virtual machine 1 1042. When virtual machine 1 1042 requests a DHCP address, ① is executed, virtual machine 1 1042 sends a DHCP request message to the virtual switch 1 (vSwitch) 1041 of the computing node, and then ② is executed, and virtual switch 1 1041 sends the DHCP request message to controller 102 by message broadcasting, and further ③ is executed, and controller 102 responds to a DHCP response message after looking up the table according to the MAC address carried in the DHCP request message, and feeds back to virtual switch 1 1041, and finally ④ is executed, and virtual switch 1 1041 feeds back to virtual machine 1 1042. With the continuous expansion of the scale of computing nodes in public cloud data centers, the service capacity of DHCP for virtual machines in the entire network will be limited by the processing capacity of the SDN controller, and the SDN controller cluster needs to be expanded to meet the DHCP service requirements of large-scale computing nodes.

[0064] In this way, the DHCP service is provided by an independent control plane cluster, and the DHCP scale that the entire network can support is easily limited by the controller cluster capacity; the control plane cluster failure will cause damage to the entire network service, and it is impossible to completely achieve the decoupling and separation of the control plane and the forwarding plane (that is, the control plane failure affects the forwarding plane); it is necessary to rely on stack servers to solve the DHCP needs of large-scale computing nodes, which has high hardware costs, and it is necessary to introduce complex distributed and computing scheduling mechanisms to meet the service load sharing requirements in the cluster mode, and the maintenance cost is also high. In addition, when DHCP is provided by an independent cluster, since DHCP traffic belongs to broadcast flooding messages, it will be replicated multiple times and needs to pass through the Underlay network, which will have a certain impact on the bandwidth utilization of the Underlay network of the entire network.

[0065] Based on this, the embodiment of the present application provides a message transmission control method, computing node, device and system. When receiving an address request message sent by a target virtual machine, the target switch, based on the forwarding flow table issued by the control device, floods the address request message in the target address configuration service and at least one switch connected to the target virtual switch. Finally, the target address configuration service generates an address configuration message and sends it to the target virtual machine. In this way, the address request message is only flooded in the second layer of the same computing node and the same network segment, avoiding the impact of the address request message on the bandwidth of the supporting network. In addition, the distributed address configuration service provides addresses to the corresponding virtual machines, which can support the address configuration of large-scale networks, not only reducing the hardware cost and maintenance cost of the management side, improving the response speed of address allocation, but also supporting the construction of larger-scale public clouds without increasing hardware.

[0066] The present application is further described in detail below through the accompanying drawings and specific embodiments.

[0067] In one embodiment of the present application, a message transmission control method is provided, which can be applied to a cloud computing system. Figure 3 A topological diagram of a cloud computing system provided in an embodiment of the present application. Figure 3 As shown, the cloud computing system 20 includes at least one computing node, and each computing node includes at least one virtual switch, at least one address configuration service, and at least one virtual machine.

[0068] In an embodiment of the present application, the cloud computing system 20 may further include a control device 201, wherein the control device 201 may be an SDN controller, and the control device 201 is connected to at least one computing node through an underlying network 107, such as an underlay network.

[0069] In an embodiment of the present application, at least one computing node may include a first computing node 202, a second computing node 203, ..., an Mth computing node 204, etc., wherein each computing node may be divided into at least one different network segment, and for each network segment, a virtual switch (vSwitch or OpenvSwitch), at least one virtual machine (VM), and an address configuration service (vDHCP) in the same network segment may be set in the computing node. Exemplarily, the first computing node 202 includes a first virtual switch 2021, a first virtual machine 2022, and a first address configuration service 2023; the second computing node 203 includes a second virtual switch 2031, a second virtual machine 2032, and a second address configuration service 2033, ..., and the Mth computing node 204 includes an Mth virtual switch 2041, an Mth virtual machine 2042, and an Mth address configuration service 2043. Wherein, M is a positive integer greater than or equal to 1.

[0070] It should be noted that the address configuration service may be run in the computing node in the form of a process and provided to the virtual machine in the form of a service.

[0071] Figure 4 A flow chart of a message transmission control method provided in an embodiment of the present application Figure 1 .like Figure 4 As shown, the message transmission control method may include:

[0072] S301, in response to a target virtual machine going online, receiving a forwarding flow table sent by a control device through a corresponding target virtual switch.

[0073] The forwarding flow table is used to represent the message forwarding path between the target virtual machine and the corresponding target address configuration service.

[0074] In the embodiment of the present application, virtual machines in the same network segment correspond to the same virtual switch and the same address configuration service, and the number of address configuration services corresponds to the number of network segments. It should be understood that after the first virtual machine in the network segment to which the address configuration service belongs goes online, the address configuration service is deployed and started, and after the last virtual machine in the network segment goes offline, the address configuration service of the network segment is also destroyed.

[0075] In the embodiment of the present application, the target virtual machine can be any virtual machine in at least one virtual machine in any node in the computing node that is ready to go online and requests an IP address. The target address configuration service and the target virtual switch are both in the same network segment of the same node as the target virtual machine.

[0076] After the computing node senses that the target virtual machine is online, in response to the information about the target address configuration service corresponding to the network segment where the target virtual machine is located synchronized by the computing node, the control device generates and sends the corresponding forwarding flow table to the target virtual switch in the computing node. After receiving the forwarding flow table, the target virtual switch stores it locally on the target virtual switch.

[0077] Among them, the forwarding flow table sent by the control device may include fields such as source address, destination address, protocol type, port number, etc., which are stored in the target virtual switch, so that the target virtual switch can determine the data packets sent by the target virtual machine or target address configuration service to the other party based on the information in these fields. Can be forwarded correctly.

[0078] S302: When an address request message sent by a target virtual machine is received, based on a forwarding flow table, the address request message is broadcasted to a target address configuration service and at least one virtual machine connected to the target virtual switch through a target virtual switch.

[0079] In an embodiment of the present application, after the target virtual machine goes online, an address request message (DHCP request message) can be sent to the target virtual switch. After the target virtual switch receives the message, since the destination physical address of the address request message or the media access control (MAC) address is a broadcast MAC address, that is, all 48 bits are F, the target virtual switch performs a layer 2 flooding process on the address request message, that is, the address request message is restricted within the target virtual switch, and the target virtual switch only sends the address request message to the target address configuration service and at least one virtual machine that is connected to the target virtual switch and is in the same network segment as the target virtual switch.

[0080] S303: Generate an address configuration message through the target address configuration service, and send the address configuration message to the target virtual machine.

[0081] In the embodiment of the present application, the target address configuration service receives the address request message through the broadcast of the target virtual switch, and the target address configuration service generates an address configuration message (DHCP response message) based on the IP address allocated to the target virtual machine and sends it to the target virtual machine. The target address configuration service can obtain the IP address from the control device in the aforementioned deployment stage.

[0082] In this way, the address request message sent by the target virtual machine is only flooded in the same network segment of the same computing node, and does not enter other network segments or other computing nodes. The target virtual switch relies on the forwarding flow table to provide the target virtual machine with normal requests and responses for DHCP messages between the target address configuration service.

[0083] The embodiment of the present application provides a message transmission control method. When receiving an address request message sent by a target virtual machine, the target switch, based on the forwarding flow table issued by the control device, floods the address request message in the target address configuration service and at least one switch connected to the target virtual switch. Finally, the target address configuration service generates an address configuration message and sends it to the target virtual machine. In this way, the address request message is only flooded in the second layer of the same computing node and the same network segment, avoiding the impact of the address request message on the bandwidth of the supporting network. In addition, the distributed address configuration service provides addresses to the corresponding virtual machines, which can support the address configuration of large-scale networks, not only reducing the hardware cost and maintenance cost of the management side, improving the response speed of address allocation, but also supporting the construction of larger-scale public clouds without increasing hardware.

[0084] In yet another embodiment of the present application, each computing node further includes a service management component. Figure 5 A schematic diagram of an address allocation process provided in an embodiment of the present application Figure 1 .like Figure 5 As shown, Figure 3 Taking any computing node in the target computing node 207 as an example, the target computing node 207 communicates with the control device 201, including the target virtual switch 2071, the target virtual machine 2072, the target address configuration service 2073 and the service management component 2074 as an example, the connection relationship is explained. It should be understood that the target computing node 207 may also include at least one other virtual machine in the same network segment as the target virtual machine 2072, at least one virtual switch, at least one address configuration service and at least one virtual machine in a different network segment from the target virtual machine 2072. Figure 5 Not shown.

[0085] In the embodiment of the present application, the target computing node 207 also includes a service management component 2074. It should be noted that each computing node includes a service management component, which can be a DHCP service management component (DHCP-Agent), which runs in the operating system of the computing node host server in the form of a software process. The scope of the DHCP service management component is the computing node host, that is, the DHCP service management component on the computing node only provides DHCP service lifecycle management functions for the virtual machines on the current computing node, including the deployment and destruction of DHCP services.

[0086] For the aforementioned step S301, in response to the target virtual machine going online, receiving the forwarding flow table sent by the control device through the corresponding target virtual switch may include:

[0087] S401, when monitoring that a target virtual machine is online, deploying a corresponding target address configuration service for the target virtual machine through a service management component.

[0088] In an embodiment of the present application, the service management component can monitor the online and offline notifications of the virtual machines on the computing node where it is located. The service management component senses the online and offline status of the virtual machines in the computing node and deploys the address configuration service on demand to provide DHCP services for the virtual machines.

[0089] The process of computing nodes and control devices on the control plane is as follows: Figure 5 As shown, the service management component 2074 is based on Figure 5 In process ①, when the target virtual machine 2072 in the target computing node 207 where the target virtual machine 2072 is located is monitored to be online, for example, if the tenant has created the target virtual machine 2072 in the computing node, process ② is continued to be executed, and the corresponding target address configuration service 2073 is deployed for the target virtual machine 2072, and the target address configuration service 2073 is connected to the target virtual switch 2071 in the same network segment. Among them, the target address configuration service 2073 can be connected to the target virtual switch 2071 in the Linux network namespace mode, and is in the same layer 2 network as the target virtual machine 2072.

[0090] It should be noted that if there is already a virtual machine in the network segment where the target virtual machine is located, an address configuration service corresponding to the network segment should already exist, so the address configuration service can be used as the target address configuration service; if the target virtual machine is the first virtual machine to go online in the network segment where it is located, the service management component will create a new address configuration service as the target address configuration service.

[0091] S402, configuring the target virtual machine and the target address to access the target virtual switch through the service management component, determining the corresponding access information, and synchronizing the access information to the control device.

[0092] In the examples of this application, see Figure 5 The service management component 2074 continues to execute the above process ②. After connecting the target address configuration service 2073 to the target virtual switch 2071, the service management component 2074 executes process ③, calls the control device 201, and synchronizes the access information of the target address configuration service 2073 to the target virtual switch 2071 to the control device 201.

[0093] The access information may include address information of the target address configuration service, so that the forwarding flow table generated by the control device according to the access information includes the path for the target virtual machine to send messages to the target address configuration service through the target virtual switch.

[0094] S403: The target virtual switch receives the forwarding flow table sent by the control device.

[0095] The forwarding flow table is generated by the control device based on the access information.

[0096] After the control device receives the access information of the target address configuration service, refer to Figure 5 The control device 201 generates a corresponding forwarding flow table according to the access information, and the control device 201 executes Figure 5 In process ④, the forwarding flow table is sent to the target virtual switch 2071.

[0097] It should be noted that the forwarding flow table is used to describe the path of the target virtual machine through the target virtual switch. Other forwarding flow tables are also stored in the target virtual switch, which are used to describe the path of communication between other virtual machines under the target virtual switch and between other virtual machines and the target address configuration service.

[0098] The embodiment of the present application provides a message transmission control method, each computing node also includes a service management component, which is used to deploy and connect the target address configuration service to the target virtual switch when monitoring the target virtual machine to go online, and further synchronize the access information to the control device so that the control device sends the forwarding flow table. In this way, the address configuration service can be deployed for the virtual machine on demand, and the virtual machine and the address configuration service can communicate with each other, providing a basis for the normal request and response of the DHCP message.

[0099] In some embodiments, for the above step S303, generating an address configuration message through a target address configuration service and sending the address configuration message to a target virtual machine may include:

[0100] S501, generate an address configuration message through a target address configuration service, and send the address configuration message to a target virtual switch.

[0101] As mentioned above, after the above control plane process is completed, the address request message sent by the target virtual machine can be forwarded to the target address configuration service through the target virtual switch normally.

[0102] In the embodiments of the present application, Figure 6 A schematic diagram of an address allocation process provided in an embodiment of the present application Figure 2 . Figure 6The data plane traffic model of the address allocation process is shown. Based on the steps in the above embodiment, the target virtual machine 2072 first executes process ① and sends an address request message to the target virtual switch 2071. The target virtual switch 2071 executes process ② and processes the message according to the message characteristics and forwarding table entries. As mentioned above, since the destination MAC of the address request message is a broadcast MAC, the target virtual switch 2071 performs layer 2 flooding processing on the address request message based on the newly received forwarding flow table and the pre-stored forwarding flow table, and broadcasts it to the access port of the target address configuration service 2073 connected to the target virtual switch 2071 and at least one virtual machine. Since the target address configuration service 2073 and the target virtual switch 2072 are in the same network segment in the same node, the address request message does not need to be flooded to other computing nodes except the target computing node.

[0103] In the embodiments of this application, see Figure 6 , other virtual machines discard the address request message after receiving it, and only the target address configuration service 2073 responds and executes process ③. The target address configuration service 2073 communicates with the control device to obtain the IP address assigned by the control device to the target virtual machine 2072, and generates an address configuration message based on the obtained IP address, and sends the address configuration message to the target virtual switch 2071 based on the communication connection with the target virtual machine 2072.

[0104] S502: Based on the physical address of the target virtual machine, send an address configuration message to the target virtual machine through the target virtual switch.

[0105] In the examples of this application, see Figure 6 When receiving the address configuration message, the target virtual switch 2071 can process the address configuration message according to the message characteristics and the forwarding table entries, execute process ④, and send the address configuration message to the target virtual machine 2072. It should be understood that although the target virtual machine has not yet obtained an IP address, the destination physical address in the address configuration message, that is, the destination MAC is the MAC address of the target virtual machine, so the target virtual switch can send the address configuration message to the target virtual machine through the access port of the target virtual machine.

[0106] The embodiment of the present application provides a message transmission control method, wherein the target virtual switch forwards the address configuration message generated by the target address configuration service to the target virtual machine according to the physical address of the target virtual machine. In this way, the normal request and response of the DHCP message can be guaranteed, and the occupation of network bandwidth by the DHCP message during the request and response process can be avoided, thereby improving the efficiency of the cloud computing system.

[0107] It should be noted that in the related art, for the aforementioned Figure 1In the public cloud network shown, the layer 2 and layer 3 communication access capabilities of the virtual machines are carried by the virtual switches of the computing nodes. The virtual switches rely on flow table entries to process forwarding behaviors, and the flow table entries are issued by the vSwitch management and control plane (i.e., issued by the controller 102). Figure 7 Configure a flow chart for a flow table. Figure 7 As shown, after the controller 102 generates a flow table by configuring and orchestrating the flow table through the business orchestration component 1021 according to the tenant network service needs, it executes process ①, calls the flow table management component 1022, and the flow table management component 1022 executes process ②, saves the orchestrated flow table configuration in the database 1023 in the local controller 102, and executes process ③, and synchronizes the flow table to the virtual switch 1 (vSwitch) 1041 of the first device 104 through the openflow protocol channel.

[0108] To achieve network forwarding of virtual machines on the virtual switch, after the tenant subscribes to the virtual machine service, the single virtual machine service resources will be orchestrated according to the tenant's VPC service model, and a large number of flow table item resources will be split. The vSwitch flow table items carried on a single vSwitch are at the level of hundreds of thousands. When the computing nodes reach the level of tens of thousands, the flow table scale of the entire network will reach hundreds of millions or even billions. If a single SDN controller cluster cannot support flow tables of hundreds of millions, the controller needs to be expanded or an independent distributed database needs to be introduced. The database can be a memory database or a non-memory database. The memory database can only meet the read and write performance requirements, and the non-memory database can only meet the storage requirements. If the read and write performance and storage requirements are to be met at the same time, it is necessary to introduce a memory database + sub-library and sub-table + database cluster. However, this solution has high hardware requirements for hardware devices, especially the memory database needs to rely on memory, which greatly increases the hardware cost. In addition, the control plane service will have many stability problems in large memory scenarios, such as the service interruption caused by the stop the world (STW) mechanism of memory garbage collection.

[0109] Therefore, the method provided in the present application based on the following embodiments can reduce the storage pressure of the flow table in the control device when dealing with flow tables of billions of scale in a scenario where a large-scale public cloud adopts an in-memory database.

[0110] In another embodiment of the present application, a message transmission control method is provided, such as Figure 3 As shown, the cloud computing system 20 includes a control device 201, and the message transmission control method can be applied to the control device. Figure 8 A flow chart of a message transmission control method provided in an embodiment of the present application Figure 2 ,like Figure 8 As shown, the method may include:

[0111] S601, obtaining a plurality of to-be-encoded fields in a forwarding flow table through a control device, and determining numbers corresponding to the plurality of to-be-encoded fields.

[0112] In the embodiments of the present application, Fig. 9 A schematic diagram of a forwarding flow table provided in an embodiment of the present application. Fig. 9 As shown, x flow tables are stored in the memory database of the control device. The data model of each flow table uses the field name + field value mapping method to record all the information of a data. For example, x flow tables are stored in the memory database, there are y field names, and the field value length is z bytes. The data header of each flow table occupies m bytes of memory, and each field attribute header occupies n bytes of memory. The total memory occupied by the x flow tables is: x*(m+y*(n+z)). It should be understood that the length of each flow table may be different. For example, one flow table may include Y groups of field headers + field values; another flow table may include (K-Q+1) groups of field headers + field values.

[0113] Through the memory occupancy analysis of the above-mentioned flow table storage, it is found that only the field value part records the key information of the data, and most of the memory will be occupied by objects such as data structures in the flow table that do not record key information, such as data headers and field headers. For the flow table, the number of fields that can appear in the field header exceeds one hundred, which are divided into basic fields, matching fields, action fields, etc., and as the number of iterative fields of the openflow version continues to increase, the proportion of memory used by the flow table storage to store truly valid data will also become lower and lower. Therefore, in an embodiment of the present application, all fields that may appear in the field header part are used as multiple fields to be encoded, and all fields to be encoded are assigned corresponding numbers and saved in a local database. For example, when there are 6 fields to be encoded, including table, priority, in_port, ip, nw_dst, and action, their corresponding numbers can be assigned to 1-6 in turn and saved in the local database of the control device, which can also be called a memory database.

[0114] It should be noted that when the control device generates a forwarding flow table, if the forwarding flow table contains fields that have never appeared and are not numbered, the fields may also be numbered and saved.

[0115] S602: Compress the forwarding flow table through a control device according to the multiple fields to be encoded and the serial numbers corresponding to the multiple fields to be encoded, to obtain a compressed forwarding flow table.

[0116] Furthermore, the control device designs a compression algorithm based on the correspondence between the multiple fields to be encoded and the numbers corresponding to the fields to be encoded, compresses the flow table configuration into string data, and obtains the compressed forwarding flow table for storage. In this way, the compressed forwarding flow table data only records a single string field, which simultaneously records the field value and field name information in the original flow table data, and the content number format is "field number, field value, ..., field number, field value".

[0117] For example, for a flow table (the numbers of the fields in brackets): table(1)=10, priority(2)=10000, in_port(3)=3, ip(4), nw_dst(5)=192.168.1.1, action(6)=drop, based on the numbers assigned to the fields to be encoded, the control device can compress the flow table into a string, and the compressed forwarding flow table is "1, 10, 2, 10000, 3, 3, 4, ip, 5, 192.168.1.1, 6, drop". It should be understood that this example is only one of the cases, and in most cases, not all the fields to be encoded may appear in a flow table at the same time.

[0118] S603: Store the compressed forwarding flow table into a local database through the control device.

[0119] Furthermore, the control device may store the compressed forwarding flow table in a local database, thereby greatly reducing the memory space required for a flow table. The local database may be a database in the memory of the storage control device.

[0120] It should be noted that, in some embodiments, the flow table in the control device may also be compressed in this manner to obtain a compressed forwarding flow table.

[0121] The embodiment of the present application provides a message transmission control method, wherein a control device numbers the fields to be encoded in the forwarding flow table, and compresses the forwarding flow table based on the numbers, obtains the compressed forwarding flow table and stores it in a local database. In this way, the combined compression process can reduce the memory usage of the node, exchange a small amount of time for a large space, and reduce the storage pressure of the node on the flow table items.

[0122] In some embodiments, the message transmission control method may further include:

[0123] S701, reading a compressed forwarding flow table in a local database through a control device.

[0124] In an embodiment of the present application, the control device compresses the forwarding flow table based on the aforementioned embodiment, obtains the compressed forwarding flow table, and stores it in the local database. Before sending the forwarding flow table to the target computing node, the control device reads the compressed forwarding flow table in the local database, performs a decompression operation based on the following steps, and then sends it to the target virtual switch in the target computing node.

[0125] S702, based on the numbers corresponding to the multiple fields to be encoded, the compressed forwarding flow table is mapped to the fields through the control device to obtain the forwarding flow table, and sent to the target virtual switch in the target computing node, so that the target virtual switch performs a message forwarding operation on the message to be forwarded based on the forwarding flow table.

[0126] In the embodiment of the present application, the message to be forwarded may refer to a virtual machine connected to the target virtual switch or a target address configuration service sending a message to be forwarded to other nodes to the target virtual switch, and the message needs to be forwarded by the target virtual switch. After receiving the message to be forwarded, the target virtual switch can determine the destination address information of the message by analysis, and further, it needs to read the forwarding flow table to determine how to forward the message to the correct node.

[0127] It should be noted that, after determining the corresponding compressed forwarding flow table, the control device may read the compressed forwarding flow table from the local database.

[0128] In the embodiment of the present application, as mentioned above, when the control device numbers the fields to be encoded, it can store the corresponding relationship between the multiple fields to be encoded and the numbers of the fields to be encoded. Therefore, when it is necessary to decompress the compressed flow table, the compressed flow table can be mapped according to the fields based on the corresponding relationship and the pre-set compression format, that is, according to the corresponding relationship stored in the database, the original field value of the flow table corresponding to the number is found to obtain the forwarding flow table before compression.

[0129] Exemplarily, for the compressed flow table "5, 192.168.1.1, 6, drop", it can be restored to nw_dst(5)=192.168.1.1, action(6)=drop according to the corresponding relationship, for example, number 5 corresponds to the field nw_dst, number 6 corresponds to the field action, and the preset format of the compressed flow table.

[0130] It should be noted that the forwarding flow table is used to describe to the target virtual switch how to forward the received data message to the correct node. Therefore, after the control device decompresses the compressed forwarding flow table and obtains the forwarding flow table, it can send it to the target virtual switch based on the decompressed forwarding flow table. The target virtual switch performs the message forwarding operation based on the forwarding flow table and forwards the message to be forwarded to the corresponding node.

[0131] The embodiment of the present application provides a message transmission control method, wherein a control device reads a corresponding compressed forwarding flow table, performs decompression to obtain the forwarding flow table, and sends the forwarding flow table to a target virtual switch, so that the target virtual switch can forward the message to be forwarded to the corresponding node based on the forwarding flow table. In this way, when the forwarding flow table is used, the normal reading and use of the forwarding flow table can be guaranteed, and the forwarding efficiency of the message can be guaranteed.

[0132] Fig.10 Figure 1 is a schematic diagram of an address conversion process. Fig.10 As shown, in the prior art, there is an overlap in the virtual machine addresses of different tenants, and the virtual machine address is a private network IP address, which cannot directly access the public network. Therefore, it is generally necessary to perform network address translation (NAT) on the private network IP address of the virtual machine by deploying an independent public network exit network element device and convert it into a public network IP address. At the same time, the tenant VPC to which the private network address of the virtual machine belongs is recorded to solve the NAT address mapping conflict problem when the addresses of virtual machines of different tenants' VPCs overlap. Exemplarily, for the first device 104, when virtual machine 1 needs to access the public network, it first sends a data message to the public network exit 103, the source address of the data message is private network IP 10.1.1.1, the destination address is 8.8.8.8, and the tenant number is VPC-1. The public network exit 103 performs address translation on the data message, converts the source address in the data message, that is, the private network IP, into the public network IP 36.13.4.25, and sends the data message to the node with an address of 8.8.8.8 in the public network.

[0133] It should be understood that the public IP address of the tenant virtual machine needs to be allocated to access the public network. At the same time, in order to distinguish the private IP addresses of different VPCs, the address overlap problem needs to be solved through routing domain isolation technology, which is generally done by configuring virtual routing and forwarding (VRF) on the network element device. In the scenario of large-scale public cloud data centers, in order to meet the needs of a large number of tenant VPCs to access the public network, it is necessary to horizontally expand the capacity of the public network egress network element devices and apply for a large number of public network IPs. In the scenario of large-scale computing nodes, a large number of public network IPs need to be occupied, resulting in low utilization of public network IP resources. The selection of public network egress equipment generally selects high-performance firewalls or programmable switches. The selection of network element equipment requires that both the routing domain isolation capacity specification requirements and the public network egress bandwidth forwarding performance specification requirements be met. In addition, the public network egress gateway needs to rely on routing domain isolation technology to solve the tenant address overlap problem. In the scenario of large-scale tenant VPCs, it will be limited by the number of public network egress routing domains and cannot fully utilize the forwarding capabilities of the public network egress network element devices.

[0134] To solve the above problems, the present application introduces a twice NAT solution to enable multiple tenants to share public IP resources, and its specific implementation is shown in the following embodiments.

[0135] In another embodiment of the present application, continue to refer to Figure 3 ,The cloud computing system also includes network isolation devices and ,public network gateway devices.

[0136] The network isolation device may be a collection of at least one VPC egress network element device, and the VPC egress network element device may be a router or other device capable of performing address forwarding.

[0137] The public network gateway device can be a network element device in a cloud computing device that connects the public network and the private network.

[0138] It should be noted that the public network gateway device, the network isolation device, the control device and at least one computing node are connected to each other through an underlying network, and the underlying network may be an underlay network.

[0139] In another embodiment of the present application, a message transmission control method is provided, which can be applied to a network isolation device and a public network gateway device. Fig.11 A flow chart of a message transmission control method provided in an embodiment of the present application Figure 3 .like Fig.11 As shown, the message transmission control method may also include:

[0140] S801, receiving an access message sent by a target virtual machine in a target computing node through a network isolation device.

[0141] In the embodiments of the present application, Fig.12 A schematic diagram of an address conversion process provided by an embodiment of the present application. Fig.12 As shown, when the first virtual machine 2022 in the first computing node 202 needs to access the public network, the access message is first sent through the basic network to the corresponding first network isolation device 2061. It should be understood that at least one network isolation device can be set in the cloud computing system, and each network isolation device manages at least one computing node of the VPC.

[0142] S802, performing address translation on the access message through the network isolation device to obtain a translated access message, and sending the translated access message to the corresponding public network gateway device.

[0143] In the embodiments of the present application, Fig.12 As shown, the first network isolation device 2061 performs a NAT conversion on the access message with the source address 192.168.1.1 sent by the first virtual machine 2022, and the destination address remains unchanged, but the source address is converted to the unique underlay IP corresponding to the VPC where the first computing node 202 is located, that is, 172.28.23.1, to generate the converted access message. It should be understood that if the destination address of the message is inside the VPC, NAT conversion is not required.

[0144] Furthermore, after the NAT conversion is completed, the network isolation device sends the converted access message to the public network gateway device.

[0145] S803, performing address translation on the converted access message through a public network gateway device to obtain a public network access message, and sending the public network access message to a corresponding receiving device in the public network.

[0146] In the embodiment of the present application, the virtual north-south traffic adopts a two-time NAT design. The first NAT is as shown in the above steps. The network isolation device maps the tenant VPC private network IP to the unique underlay IP in the resource pool, obtains the converted access message and sends it to the public network gateway device. Fig.12 As shown, the public network gateway device 205 performs NAT conversion on the converted access message again, and maps the underlay IP to the public network IP. For example, the converted access message with the source address of 172.28.23.1 is NAT converted to obtain a public network access message with the source address of 36.13.4.25. It should be understood that for access messages whose destination addresses are in computing nodes in other VPCs, the public network gateway device 205 does not need to perform a second NAT conversion.

[0147] In this way, since the addresses within different VPCs are freely planned by tenants, there may be overlap. Performing two NAT conversions on them can avoid the accumulation of duplicate IPs in the public network gateway device for processing, which will lead to the problem of mutual limitation of single network element capacity and performance specifications.

[0148] The embodiment of the present application provides a message transmission control method, which performs two NAT conversions on messages accessing the public network, and splits a single device that relies on routing domains and forwarding performance in north-south communication into different devices (public network exit, VPC exit), thereby avoiding the mutual limitation of the capacity and performance specifications of a single network element and giving full play to the advantages of different network elements.

[0149] In some embodiments, for the aforementioned step S802, performing address translation on the access message by the network isolation device to obtain the translated access message may include:

[0150] S901, determine the target tenant domain where the target virtual machine is located through a network isolation device.

[0151] In the embodiment of the present application, each network isolation device includes at least one tenant domain. Different tenant domains are isolated by routing domain technology, such as VRF. Different VPCs use separate NAT policies. The application scope of the NAT policy is within the routing domain scope corresponding to a single VPC. It should be noted that the target tenant domain may refer to the tenant domain corresponding to the VPC where the computing node containing the target virtual machine is located. For example, Fig.12 As shown, for the virtual machine in the first computing node 202, the tenant number of the VPC in which it is located is VPC-1, which corresponds to the first tenant domain a1; for the virtual machine in the second computing node 203, the tenant number of the VPC in which it is located is VPC-2, which corresponds to the second tenant domain a2; for the Mth computing node 204, the tenant number of the VPC in which it is located is VPC-M, which corresponds to the Mth tenant domain a3. The number of tenant domains corresponds to the number of VPCs in the cloud computing system, and each tenant domain manages at least one computing node.

[0152] S902: Based on the target tenant domain, determine the address information to be converted through the network isolation device.

[0153] In the embodiment of the present application, for each tenant domain, there is a unique underlay IP in the resource pool, that is, the address information to be converted corresponding to the tenant domain. The source address of all messages sent from the tenant domain to other tenant domains or the public network can be converted by the network isolation device to the address information to be converted during the NAT process. In this way, subsequent traffic no longer needs to use the routing domain isolation function, but can be routed to different VPCs bound to different routing domains through non-repetitive underlay IP addresses.

[0154] S903, replacing the source address information in the access message with the address information to be converted through the network isolation device, and generating a converted access message.

[0155] As mentioned above, each VPC includes at least one computing node, and each computing node is equipped with at least one virtual machine. The private IP of each virtual machine is freely planned by the tenant, so that the private IP address overlaps between different VPCs. In the embodiment of the present application, different VPCs are set to have different globally unique addresses, and then during the first NAT, the source address of the access message sent by the computing node is replaced with the unique address information to be converted corresponding to the VPC where it is located, and the converted access message is obtained, which can ensure that the converted access messages are not overlapped when transmitted to the public network gateway device, and the reply message can also be sent back to the VPC through a unique address.

[0156] like Fig.12 As shown, traffic from different tenant VPCs enters different tenant domains in the network isolation device. For example, access messages sent by virtual machines in all computing nodes included in VPC-1 enter the first tenant domain a1, and their source addresses are converted to the corresponding 172.28.23.1; access messages sent by virtual machines in all computing nodes included in VPC-2 enter the second tenant domain a2, and their source addresses are converted to the corresponding 172.28.23.2; access messages sent by virtual machines in all computing nodes included in VPC-M enter the Mth tenant domain a3, and their source addresses are converted to the corresponding 172.28.23.4. In this way, virtual machines with addresses of 102.168.1.1 included in different tenant domains do not overlap after conversion. The overlapping private network addresses are mapped to the addresses corresponding to non-overlapping tenant domains, and routing isolation is completed on the routing isolation device side.

[0157] The embodiment of the present application provides a message transmission control method, in which the network isolation device determines the target tenant domain where the target virtual machine that sends the access message is located, further determines the address information to be converted based on the target tenant domain, replaces the source address information with the address information to be converted, and obtains the converted access message. In this way, the overlapping addresses of different tenant VPCs can be isolated by routing domain on the VPC egress network element device, avoiding the public network egress gateway from being unable to fully play its forwarding performance due to limited routing domain resources.

[0158] In some embodiments, for the aforementioned step S803, performing address translation on the converted access message by a public network gateway device to obtain a public network access message may include:

[0159] S1001, receiving the converted access message through the public network gateway device.

[0160] In an embodiment of the present application, the access message converted after the first NAT by the network isolation device has a source address of the underlay IP corresponding to the VPC and a destination address of a device in the public network.

[0161] S1002, based on the target tenant domain corresponding to the converted access message, determine the public network address information through the public network gateway device.

[0162] In an embodiment of the present application, after receiving the converted access message, the public network gateway device determines which target tenant domain the converted access message comes from. As mentioned above, the public network gateway device manages multiple tenant domains in the cloud computing system, and can aggregate and map the address information used by multiple different tenant domains, for example, mapping the unique addresses corresponding to multiple tenant domains to the same public network address (FIP). Therefore, the public network address information corresponding to the target tenant domain can be determined based on the correspondence between the public network address information maintained in the public network gateway device and at least one tenant domain.

[0163] For example, for Fig.12 The converted access message with source address 172.28.23.1 sent by the first tenant domain a1 with tenant number VPC-1, the converted access message with source address 172.28.23.2 sent by the first tenant domain a2 with tenant number VPC-2, and the converted access message with source address 172.28.23.3 sent by the third tenant domain not shown in the figure can all be mapped to the same public network address 36.13.4.25. In addition, the converted access message with source address 172.28.23.4 sent by the Mth tenant domain with tenant number VPC-M can be mapped to another public network address.

[0164] S1003: Replace the address information to be converted in the converted access message with the public network address information through the public network gateway device to generate a public network access message.

[0165] In an embodiment of the present application, after the public network gateway device determines the correspondence between the information to be converted in the converted access message and the public network address information, it replaces the source address in the converted access message with the public network address information, generates a public network access message and sends it to the corresponding device in the public network.

[0166] It should be noted that for public network access messages mapped to the same public network address, their ports in the public network gateway device are different. The subsequent messages returned by the devices in the public network can determine the tenant domain that receives the returned message based on the port when it was sent. After receiving the message, the tenant domain can also determine which virtual machine in which computing node in the VPC to send the message to based on the port when it was sent.

[0167] The embodiment of the present application provides a message transmission control method, which determines the corresponding public network address information according to the tenant domain where the converted message is located, replaces the source address in the converted access message based on the public network address information, and generates a public network access message. In this way, the VPC of different tenants can be addressed through the underlay IP routing, and multiple tenants can share the FIP through the N:1 mapping method, saving FIP resources to the greatest extent.

[0168] In another embodiment of the present application, Fig.13 A schematic diagram of the composition structure of a computing node provided in an embodiment of the present application. Fig.13 As shown, the computing node 110 includes at least one virtual switch, at least one address configuration service and at least one virtual machine; wherein:

[0169] The virtual machine is used to send an address request message to the corresponding virtual switch;

[0170] A virtual switch, configured to receive and, based on the forwarding flow table sent by the control device, broadcast the address request message to a corresponding address configuration service and at least one virtual machine connected to the virtual switch;

[0171] The address configuration service is used to generate an address configuration message based on the address request message and send the address configuration message to the virtual machine through the virtual switch.

[0172] like Fig.13 As shown, the computing node includes multiple virtual switches from virtual switch A1 111 to virtual switch AN 115, wherein virtual switch A1 111 is connected to virtual machine A1 112, virtual machine A2 and address configuration service A1 114 and are in the same network segment; virtual switch AN 115 is connected to virtual machine AM 116 and address configuration service AN 117 and are in the same network segment. AN and AM are both positive integers greater than or equal to 1.

[0173] It should be noted that, as in the aforementioned embodiment, each computing node may also include a service management component, which is used to deploy a corresponding target address configuration service for the target virtual machine when monitoring that the target virtual machine in at least one virtual machine is online. The service management component is also used to call the control device to synchronize the access information of the target address configuration service to the target virtual switch, so that the control device generates a forwarding flow table representing the message forwarding path between the target virtual machine and the corresponding target address configuration service, and sends it to the target virtual switch.

[0174] It should also be noted that each computing node can execute the message transmission control method applied to the computing node in the aforementioned embodiment, which will not be described in detail here.

[0175] In another embodiment of the present application, Fig.14 A schematic diagram of the composition structure of a network isolation device provided in an embodiment of the present application. Fig.14 As shown, the network isolation device 206 includes at least one tenant domain; wherein:

[0176] The network isolation device 206 is used to receive the access message sent by the virtual machine in the computing node, perform address conversion on the access message, obtain the converted access message, and send the converted access message to the corresponding public network gateway device, so that the public network gateway device performs address conversion on the converted access message, obtains the public network access message, and sends the public network access message to the corresponding receiving device in the public network.

[0177] It should be noted that if Fig.14 As shown, exemplarily, the network isolation device 206 may include tenant domain B1 2061, tenant domain B2 2062 to tenant domain BM 2063, where BM is a positive integer greater than or equal to 1. The above-mentioned multiple tenant domains can be set on the same network element device, or distributed on different network element devices, determined according to the carrying capacity of the network element device. Each tenant corresponds to a unique address in the resource pool. After the network isolation device 206 receives the access message sent from the VPC, the source address of the access message is replaced with the address.

[0178] It should also be noted that the network isolation device 206 can execute the message transmission control method applied to the network isolation device 206 in the aforementioned embodiment, which will not be repeated here.

[0179] In another embodiment of the present application, Fig.15 A schematic diagram of the structure of a control device provided in an embodiment of the present application. Fig.15 As shown, the control device 201 includes a local database 2011; wherein:

[0180] The control device 201 is used to obtain multiple fields to be encoded in the forwarding flow table and determine the numbers corresponding to the multiple fields to be encoded; compress the forwarding flow table according to the multiple fields to be encoded and the numbers corresponding to the multiple fields to be encoded to obtain a compressed forwarding flow table, and store the compressed forwarding flow table to the local database 2011.

[0181] It should also be noted that the control device 201 can execute the message transmission control method applied to the control device 201 in the aforementioned embodiment, which will not be described in detail here.

[0182] In another embodiment of the present application, a cloud computing system is provided. Figure 3 The cloud computing system 20 includes a public network gateway device 205, a network isolation device 206 in the aforementioned embodiment, a control device 201 in the aforementioned embodiment, and at least one computing node in the aforementioned embodiment.

[0183] In an embodiment of the present application, a low-cost SDN solution for implementing a large-scale public cloud data center network is provided. The SDN solution is in the form of a cloud computing system, and its forwarding plane network elements are composed of a virtual switch (vSwitch) and an address configuration service (vDHCP) in at least one computing node, a network isolation device (VPC egress), and a public network gateway device (public network egress), and the control plane is composed of a control device (SDN controller).

[0184] Among them, the address configuration service in the computing node provides DHCP services for virtual machines, and the virtual switch in the computing node provides Layer 2 and Layer 3 communication services for virtual machines, including east-west interconnection services and north-south access to the public network and Underlay services. Network isolation devices and public network gateway devices mainly provide NAT address services for virtual machines under the tenant VPC, providing virtual machines with access to the public network and Underlay and the ability to serve the public network and Underlay as a server.

[0185] In the embodiment of the present application, the implementation of the cloud computing system includes the following three key technical points.

[0186] First, the design of the virtual machine DHCP process. Deploy a service management component on each computing node, which can also be called a DHCP service management component (DHCP-Agent). The DHCP service management component runs in the computing node host server operating system as a software process. The scope of the DHCP service management component is the computing node host, that is, the DHCP service management component on the computing node only provides DHCP service lifecycle management functions (including the deployment and destruction of DHCP services) for the virtual machines on the current computing node.

[0187] DHCP-Agent monitors the online and offline notifications of the virtual machines on the current computing node. DHCP-Agent senses the online and offline status of the virtual machines on the computing node and deploys the address configuration service (vDHCP service) on demand to provide DHCP services for the virtual machines. The vDHCP service is connected to the Open vSwitch in the Linux network namespace and is in the same Layer 2 network as the virtual switch that provides the DHCP service. Open vSwitch relies on flow table entries for forwarding. The flow table for communication between the virtual machine and the vDHCP service is issued by the SDN controller, and the normal request and response of DHCP messages are realized through the flow table.

[0188] The virtual machine DHCP control plane process is as follows Figure 5 As shown, including:

[0189] (1) The DHCP agent monitors the current computing node, that is, the target virtual machine in the target computing node goes online (for example, the tenant creates VM1 in the computing node).

[0190] (2) DHCP Agent deploys the target address configuration service (vDHCP service) for VM1 and connects it to the target virtual switch (vSwitch) of the computing node.

[0191] (3) DHCP Agent calls the control device (SDN controller) to synchronize the vDHCP service access vSwitch information.

[0192] (4) The SDN controller generates a forwarding flow table for communication between the target virtual machine and the vDHCP service based on the vDHCP service access vSwitch information and sends it to the computing node vSwitch.

[0193] After the above control plane process is completed, the DHCP message sent by the target virtual machine can be forwarded to vDHCP normally. The data plane traffic model is as follows Figure 6 As shown, including:

[0194] (1) The target virtual machine sends an address request message, i.e., a DHCP request message, to the target virtual switch (Open vSwitch). Open vSwitch processes the message according to the message characteristics and forwarding table entries.

[0195] (2) Since the destination MAC of the DHCP request message is a broadcast MAC, Open vSwitch performs Layer 2 flooding on the message and sends it to the vDHCP service access port of the current computing node. In this way, since the DHCP service is within the current computing node, the DHCP request message does not need to be flooded to other computing nodes.

[0196] (3) The vDHCP service responds to the DHCP response message, generates an address configuration message and sends it to Open vSwitch. Open vSwitch processes the message based on the message characteristics and forwarding table entries.

[0197] (4) The destination MAC address of the DHCP response message is the MAC address of the target virtual machine, so it will be sent to the target virtual machine through the target virtual machine access port.

[0198] The second point is the flow table merging and compression design of the virtual switch (vSwitch). In order to meet the needs of efficient reading and writing, the vSwitch flow table generally uses an in-memory database, but the control device is somewhat weak when dealing with a flow table of billions of scale using an in-memory database. As the flow table scale continues to expand, the cost of hardware memory investment is also rising.

[0199] In the memory database, the data model uses the field name + field value mapping method to record all the information of a piece of data. Fig. 9 Taking the forwarding flow table shown as an example, a flow table set with x data records, y field names, and field values ​​of z bytes in length is used as an example. The memory size occupied by each data header is m bytes, and the memory size occupied by each field attribute header is n bytes. The total memory occupied by the forwarding flow table set is: x*(m+y*(n+z)).

[0200] Through the memory usage analysis of the above flow table storage, it is found that only z records the key information of the data, and most of the memory will be occupied by objects such as data structures that do not record key information (data header, field header). This is particularly obvious in the flow table configuration scenario described in this application, mainly because the flow table features contain more than 100 fields (including basic fields, matching fields, and action fields), and as the number of iterative fields of the openflow version continues to increase, the proportion of memory used by the flow table storage to store truly effective data will also become lower and lower.

[0201] The main design idea of ​​vSwitch flow table merging and compression is that the control device compresses the key information of the flow table configuration into a string data according to a pre-designed compression algorithm and saves it; when the flow table data needs to be retrieved, the control device decompresses the string according to the pre-designed decompression algorithm.

[0202] The compression and decompression algorithm first numbers the fields. For example, 10 fields are numbered from 1 to 10. After compression, each flow table data only records a single string field, which records both the field value and field name information in the original flow table data. The content encoding format is "field number, field value, ..., field number, field value".

[0203] Take the following flow table as an example (the numbers in brackets are the corresponding fields):

[0204] table(1)=10, priority(2)=10000, in_port(3)=3, ip(4), nw_dst(5)=192.168.1.1, action(6)=drop.

[0205] After compression, it is stored in the database as a string with the value: "1, 10, 2, 10000, 3, 3, 4, ip, 5, 192.168.1.1, 6, drop".

[0206] Decompression is similar. Field mapping is performed according to the field number, and the value after the field number in the string stored in the database is mapped to the original field value of the flow table.

[0207] The third point is the design of the virtual machine north-south business flow model. In the embodiment of the present application, the virtual north-south traffic adopts a 2-time NAT design, such as Fig.12 As shown in the figure, the first NAT is performed by the network isolation device (VPC egress network element device) to map the tenant VPC private IP to the only underlay IP in the resource pool. The tenant VPC private IP is freely planned by the tenant and there will be overlaps. The underlay IP addresses used by the first NAT of VPC will not overlap. After the first NAT, the message with the source address of the underlay IP is forwarded to the public network gateway device (public network egress network port), and then the underlay IP is mapped to the public network IP.

[0208] The traffic design of secondary NAT is as follows Fig.12 As shown in the figure, the overlapping addresses of different VPCs are isolated at the VPC egress through routing domain technology (generally using VRF). Different VPCs use separate NAT policies, and the application scope of the NAT policy is within the routing domain of a single VPC. After the tenant VPC private network address is converted by the NAT policy in the routing domain, the message address is converted to the only underlay ip in the resource pool, because the subsequent traffic no longer needs to use the routing domain isolation function, but can be routed to the routing domain bound to different VPCs through non-repeated underlay ips. At the public network egress network element, the underlay ips used by different tenant VPCs can be aggregated and mapped through PNAT technology, for example, multiple underlay ips are mapped to the same FIP (for example, 172.28.23.1-3 shares FIP 36.13.4.25 in the figure below).

[0209] The traffic forwarding process is as follows:

[0210] (1) The first virtual machine (VM1) with IP address 192.168.1.1 sends a packet to the public network to be matched by the flow table of the computing node vSwitch and then sent to the network isolation device (VPC egress).

[0211] (2) Traffic from different tenant VPCs enters different tenant domains at the VPC egress (VM1 traffic enters the VPC1_VRF_1 tenant domain at the VPC egress), also known as the routing domain. The first NAT is performed in this tenant domain to convert the source address to the underlay IP (for example, 192.168.1.1 is converted to 172.28.23.1).

[0212] (3) Traffic with the source address of the underlay IP is forwarded to the public network gateway device, and the public network gateway device maps the underlay IP to the public network IP (172.28.23.1 is converted to 36.13.4.25).

[0213] In this way, the design and introduction of the double NAT for north-south services of virtual machines solves two problems: First, the overlapping addresses of different tenants' VPCs are isolated by routing domains on the VPC egress network element devices, so as to avoid the public network egress gateway from being unable to fully exert its forwarding performance due to limited routing domain resources. Second, the VPC egress network element devices are mapped to underlay ips, which can be used to route and address different tenants' VPCs, and multiple tenants can share FIPs through N:1 mapping, saving FIP resources to the greatest extent.

[0214] The embodiment of the present application provides a cloud computing system. First, by introducing the address configuration service of the computing node, the DHCP service is unloaded from the control plane cluster to the computing node, reducing the processing pressure of the SDN controller cluster. Moreover, based on the computing node dimension, the address configuration service is provided to the virtual machine, reducing the bandwidth occupation of the broadcast traffic caused by the DHCP service in the underlay network; secondly, the north-south service introduces a secondary NAT solution to enable multi-tenant access to the public network SNAT service to share FIP resources and reduce the waste of public network IP addresses; and by distinguishing the VPC export network element and the public network export network element, the VPC routing domain isolation function is decoupled from the export FIP ​​mapping function. Finally, by merging and compressing the SDN controller traffic model, the number of SDN controller flow table storage is reduced, and the storage pressure of the flow table items is reduced.

[0215] In this way, compared with the related art, the cloud computing system provided by the embodiment of the present application provides address configuration services by reusing computing node resources, reducing the cost of management plane resource construction and maintenance. Moreover, compared with the prior art solution, which introduces a complex and costly distributed memory database solution, the present application redesigns the data model of the flow table and introduces a self-developed flow table compression and decompression algorithm to minimize the storage capacity of the vSwitch flow table by exchanging time for space, thereby improving the utilization rate of storage space. Finally, compared with the prior art solution, the public network export simultaneously bears the isolation of different VPC routing domains and the public network IP mapping method. The present application splits the single device that relies on the routing domain and forwarding performance in the north-south communication into different devices (public network export, VPC export) through a secondary NAT gateway to avoid the mutual limitation of the capacity and performance specifications of a single network element, and give full play to the advantages of different network elements.

[0216] An embodiment of the present application also provides a computer program product comprising instructions, including a computer program or instructions, which, when executed by a processor, implements the steps in the method provided in the above method embodiment.

[0217] It should be understood that the description of the above storage medium and device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details not disclosed in the storage medium, storage medium and device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0218] It should be understood that "one embodiment" or "an embodiment" or "some embodiments" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in one embodiment" or "in some embodiments" appearing throughout the specification may not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application. The above-mentioned sequence numbers of the embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments. The above description of each embodiment tends to emphasize the differences between the various embodiments, and the same or similar aspects can be referenced to each other. For the sake of brevity, this article will not repeat them.

[0219] It should also be noted that in this application, the terms "include", "comprises" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0220] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0221] The methods disclosed in several method embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments.

[0222] The features disclosed in several product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0223] The features disclosed in several method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method embodiments or device embodiments.

[0224] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0225] The above is only a preferred embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A message transmission control method, characterized in that: The cloud computing system includes at least one computing node, each of which includes at least one virtual switch, at least one address configuration service and at least one virtual machine; the message transmission control method includes: In response to the target virtual machine going online, receiving a forwarding flow table sent by a control device through a corresponding target virtual switch, wherein the forwarding flow table is used to represent a message forwarding path between the target virtual machine and a corresponding target address configuration service; When receiving an address request message sent by the target virtual machine, broadcasting the address request message to the target address configuration service and at least one virtual machine connected to the target virtual switch through the target virtual switch based on the forwarding flow table; An address configuration message is generated through the target address configuration service, and the address configuration message is sent to the target virtual machine.

2. The message transmission control method according to claim 1, characterized in that: Each of the computing nodes also includes a service management component; In response to the target virtual machine going online, receiving the forwarding flow table sent by the control device through the corresponding target virtual switch, includes: When monitoring that the target virtual machine is online, deploying a corresponding target address configuration service for the target virtual machine through the service management component; Connecting the target virtual machine and the target address configuration service to the target virtual switch through the service management component, determining corresponding access information, and synchronizing the access information to the control device; The target virtual switch receives a forwarding flow table sent by the control device, where the forwarding flow table is generated by the control device based on the access information.

3. The message transmission control method according to claim 1, characterized in that: The generating an address configuration message through the target address configuration service and sending the address configuration message to the target virtual machine includes: Generate the address configuration message through the target address configuration service, and send the address configuration message to the target virtual switch; Based on the physical address of the target virtual machine, the address configuration message is sent to the target virtual machine through the target virtual switch.

4. A message transmission control method, characterized in that: The cloud computing system includes a control device, and the message transmission control method includes: Acquire multiple fields to be encoded in the forwarding flow table through the control device, and determine the numbers corresponding to the multiple fields to be encoded respectively; According to the multiple fields to be encoded and the numbers corresponding to the multiple fields to be encoded, the forwarding flow table is compressed by the control device to obtain a compressed forwarding flow table; The compressed forwarding flow table is stored in a local database through the control device.

5. The message transmission control method according to claim 4, characterized in that: The message transmission control method further includes: Reading the compressed forwarding flow table in the local database through the control device; Based on the numbers corresponding to the multiple fields to be encoded, the control device performs field mapping on the compressed forwarding flow table to obtain the forwarding flow table, and sends it to the target virtual switch in the target computing node, so that the target virtual switch performs a message forwarding operation on the message to be forwarded based on the forwarding flow table.

6. A message transmission control method, characterized in that: The cloud computing system includes a network isolation device and a public network gateway device; the message transmission control method includes: Receiving, through the network isolation device, an access message sent by a target virtual machine in a target computing node; Performing address translation on the access message through the network isolation device to obtain a translated access message, and sending the translated access message to the public network gateway device; The converted access message is subjected to address conversion by the public network gateway device to obtain a public network access message, and the public network access message is sent to a corresponding receiving device in the public network.

7. The message transmission control method according to claim 6, characterized in that: The performing address translation on the access message by the network isolation device to obtain the translated access message includes: Determine the target tenant domain where the target virtual machine is located by using the network isolation device; Based on the target tenant domain, determining the address information to be converted through the network isolation device; The source address information in the access message is replaced with the address information to be converted by the network isolation device to generate the converted access message.

8. The message transmission control method according to claim 7, characterized in that: The step of performing address translation on the translated access message by the public network gateway device to obtain a public network access message includes: Receiving the converted access message through the public network gateway device; Based on the target tenant domain corresponding to the converted access message, determining the public network address information through the public network gateway device; The public network gateway device replaces the address information to be converted in the converted access message with the public network address information to generate the public network access message.

9. A computing node, characterized in that: The computing node includes at least one virtual switch, at least one address configuration service and at least one virtual machine; wherein: The virtual machine is used to send an address request message to the corresponding virtual switch; The virtual switch is configured to receive and, based on the forwarding flow table sent by the control device, broadcast the address request message to the corresponding address configuration service and at least one virtual machine connected to the virtual switch; The address configuration service is used to generate an address configuration message based on the address request message, and send the address configuration message to the virtual machine through the virtual switch.

10. A network isolation device, characterized in that: The network isolation device includes at least one tenant domain; wherein: The network isolation device is used to receive an access message sent by a virtual machine in a computing node, perform address conversion on the access message to obtain a converted access message, and send the converted access message to a corresponding public network gateway device, so that the public network gateway device performs address conversion on the converted access message to obtain a public network access message, and sends the public network access message to a corresponding receiving device in the public network.

11. A control device, characterized in that: The control device includes a local database; wherein: The control device is used to obtain multiple fields to be encoded in the forwarding flow table and determine the numbers corresponding to each of the multiple fields to be encoded; compress the forwarding flow table according to the multiple fields to be encoded and the numbers corresponding to each of the multiple fields to be encoded to obtain a compressed forwarding flow table, and store the compressed forwarding flow table in the local database.

12. A cloud computing system, characterized in that: The cloud computing system includes a public network gateway device, a network isolation device as claimed in claim 10, a control device as claimed in claim 11, and at least one computing node as claimed in claim 9.

Images