Dynamic networking method for distributed edge cloud

Abstract

The invention provides a dynamic networking method of a distributed edge cloud. According to the method, the cloud network scheduling server is deployed, and the dialing software and the virtual network controller are deployed on each cloud node, so that the IP of the distributed edge cloud dynamic internet and the IP / Mac information of the virtual machine are acquired and synchronized. A distributed virtual switch and a virtual edge gateway are constructed through a virtual network forwarding plane realized based on eBPF, and two-layer network intercommunication between virtual machines in a distributed edge cloud can be realized in a geographically dispersed and dynamic IP environment. Meanwhile, the virtual edge gateway realizes secure forwarding of data packets of cross-cloud access through policy control. In a word, the problems of two-layer network intercommunication and security access in the dynamic address environment in the distributed edge cloud are effectively solved, and the flexibility and expandability of the system are improved.

Description

Technical Field

[0001] The present invention relates to the field of edge cloud technology, and in particular to a dynamic networking method for a distributed edge cloud. Background Art

[0002] With the rapid development of technologies such as the Internet of Things, 5G, smart cities, and autonomous driving, edge computing, as an important architecture to meet the needs of low-latency, high-bandwidth applications, has received widespread attention and application. In this context, Distributed Edge Cloud provides services closer to users and devices by distributing computing and storage resources on edge nodes of the network. However, Distributed Edge Cloud faces multiple technical challenges in practical applications, one of which is how to achieve Layer 2 network interconnection between virtual machines (VMs) on each edge cloud node in a distributed scenario.

[0003] In the traditional cloud computing architecture of data centers, communication between virtual machines is usually achieved through fixed Internet IP and the internal network of the data center. However, in the distributed edge cloud environment, due to the geographical dispersion and the complexity of the network environment, dial-up networks are often used to connect to the Internet. The IP addresses of these nodes are dynamically allocated and there is no fixed Internet IP, which makes the traditional static IP address mapping and routing methods ineffective.

[0004] Since communication between edge clouds needs to span multiple different network environments, it is a technical challenge to achieve Layer 2 network interoperability between these heterogeneous networks and ensure that virtual machines can communicate as if they were in the same LAN. Summary of the invention

[0005] The purpose of the present invention is to propose a dynamic networking method for a distributed edge cloud. In the scenario of a dynamic Internet IP address using a dial-up network in an edge cloud environment, cloud nodes dynamically update and perceive changes in node networks and virtual machine locations through a cloud network scheduling server, thereby achieving Layer 2 network interconnection between virtual machines on a distributed cloud, and achieving limited and secure access between cross-cloud virtual machines by setting cross-cloud access policies on the virtual edge gateway of the cloud node.

[0006] The present invention is achieved through the following technical solutions:

[0007] A distributed edge cloud dynamic networking method includes the following steps:

[0008] A cloud network dispatching server is deployed on a public network server with a fixed public IP address to connect multiple geographically discrete and independently running edge clouds to form a distributed edge cloud;

[0009] The cloud network scheduling server communicates with each cloud node via the Internet, is used to receive Internet IP information and virtual machine (VM) IP / MAC information reported by the cloud node, and caches and distributes the received information;

[0010] Deploy dial-up software on each cloud node, obtain a dynamic Internet IP address through PPPoE or similar dial-up protocols, and bind the IP address to the Internet network card of the cloud node;

[0011] A virtual network controller is deployed on each cloud node to monitor the changes in the Internet network card IP of this node and the changes in the virtual machine IP / MAC information caused by the cloud controller's creation, deletion, modification and migration operations on the virtual machine; the virtual network controller reports the changed Internet IP address information and virtual machine IP / MAC information to the cloud network scheduling server by calling the reporting interface of the cloud network scheduling server, and obtains the relevant update information of other cloud nodes through the subscription interface, and records the global node IP and virtual machine IP / MAC mapping data in the eBPF Map;

[0012] A virtual network forwarding plane is built on each cloud node based on eBPF technology, including a distributed virtual switch (DVS) and a virtual edge gateway (VEG); the DVS and VEG run as eBPF programs in kernel state, and realize dynamic networking of Layer 2 network interconnection and cross-cloud access between virtual machines by querying the node Internet IP and virtual machine IP / MAC information cached in the eBPF Map, as well as cross-cloud access policies.

[0013] Furthermore, in the above-mentioned dynamic networking method of the distributed edge cloud, the cloud network scheduling server provides the following http interface:

[0014] Cloud node Internet IP address reporting interface, used to receive Internet IP change information reported by cloud nodes;

[0015] Cloud node Internet IP address change subscription interface, used to distribute IP change information of other cloud nodes;

[0016] Cloud node virtual machine IP / MAC address reporting interface, used to receive VM IP / MAC change information reported by cloud nodes;

[0017] Cloud node virtual machine IP / MAC address change subscription interface, used to distribute VM IP / MAC change information of other cloud nodes.

[0018] Furthermore, in the above-mentioned dynamic networking method of the distributed edge cloud, the specific steps of synchronizing the Internet network card IP are:

[0019] Call the "cloud node Internet IP address reporting interface" provided by the cloud network scheduling server to report the cloud ID, cloud node ID and current Internet IP of this node to the cloud network scheduling server;

[0020] At the same time, call the "Cloud Node Internet IP Address Change Subscription Interface" to subscribe to the Internet IP change information of other cloud nodes. The cloud network scheduling server collects and summarizes the reported information of each cloud node in the background, and distributes the full amount of cloud node Internet IP information to all subscribed nodes;

[0021] The virtual network controller writes the received full node ID and the corresponding Internet IP address relationship into the local eBPF Map for subsequent forwarding decisions of the distributed virtual switch (DVS) and virtual edge gateway (VEG).

[0022] Furthermore, in the above-mentioned dynamic networking method of the distributed edge cloud, the specific steps of synchronizing the virtual machine IP / MAC information are as follows:

[0023] The virtual network controller also monitors the node cloud controller's creation, deletion, modification, and migration operations on virtual machines. When the IP / MAC address information of the virtual machine changes, the virtual network controller calls the "cloud node virtual machine IP / MAC address reporting interface" of the cloud network scheduling server to report the virtual machine IP / MAC change information, including cloud ID, node ID, virtual machine IP, and virtual machine MAC;

[0024] Call the "Cloud Node Virtual Machine IP / MAC Address Change Subscription Interface" to subscribe to other cloud node virtual machine IP / MAC change information; after receiving the virtual machine IP / MAC information change reported by any node, the cloud network scheduling server distributes the change to all subscribed cloud nodes; after each cloud node receives the update information, the virtual network controller writes the latest VMIP / MAC data into the local eBPF Map.

[0025] Furthermore, in the above-mentioned dynamic networking method of the distributed edge cloud, the specific steps of the eBPF implementing the distributed virtual switch (DVS) are:

[0026] 1) ARP request processing:

[0027] When the source VM sends an ARP request to resolve the MAC address of the target VM, the ARP packet first enters the eBPF program processing logic of the DVS.

[0028] After the DVS eBPF program parses the ARP header, it searches the eBPF Map for the MAC address corresponding to the IP address of the target VM. If there is a record in the Map, that is, the MAC address of the target VM is known, the eBPF program does not need to broadcast the ARP request like a traditional switch. It only needs to use bpf_redirect() or bpf_clone_redirect() to generate an ARP reply packet and send it back to the virtual network card of the source VM to complete the unicast reply.

[0029] 2) Unicast packet forwarding:

[0030] When the source VM knows the MAC of the target VM and sends a unicast packet, the eBPF program of DVS finds the node and cloud domain information of the target VM from the eBPF Map by parsing the Ethernet header, IP header (and necessary transport layer header);

[0031] If the target VM is on this node, the eBPF program calls bpf_redirect(ifindex,0) to redirect the data packet to the corresponding virtual network card interface (ifindex is the index of the target VM network card), and the kernel state can complete the layer 2 forwarding;

[0032] If the target VM is in another node of the same cloud, the eBPF program knows based on the Map query that the data packet should be sent from the physical service network card of this node; the data packet is sent to the underlying network through bpf_redirect(physical service network card ifindex,0). After reaching the target node, the DVS eBPF program on the target node will look up the table again and finally deliver the data packet to the target VM;

[0033] If the target VM is in another cloud domain, DVS does not forward the data packet directly to the physical service network card, but redirects the data packet to VEG for processing; DVS can use bpf_redirect(vegw_ifindex,0) to direct the data packet to the dedicated virtual network card or internal interface of the virtual edge gateway for cross-cloud encapsulation and policy detection.

[0034] Furthermore, in the above-mentioned dynamic networking method of the distributed edge cloud, the specific steps of the eBPF to implement the virtual edge gateway (VEG) are:

[0035] 1) Cross-cloud access policy check:

[0036] VEG's eBPF program parses the packet header (IP, MAC, protocol, port) and matches the cross-cloud access policy rules in the eBPF Map;

[0037] 2) vxlan tunnel encapsulation and peer selection:

[0038] If the policy allows, VEG queries the Internet IP address and tunnel information of the target cloud node from the eBPF Map, and performs vxlan encapsulation on the data packet:

[0039] When the remote VEG receives a vxlan packet, its eBPF program decapsulates the packet and redirects the decapsulated original Ethernet frame back to the DVS for final delivery to the target VM.

[0040] Furthermore, in the above-mentioned dynamic networking method of distributed edge cloud, in step 1), if the policy does not allow the data packet to be transmitted across clouds, VEG discards it by directly returning TC_ACT_SHOT (in TC Hook) or returning XDP_DROP in XDP, or uses bpf_redirect() to direct the data packet to a discard interface. In this way, policy filtering is completed directly in kernel state, improving the security and flexibility of cross-cloud access.

[0041] Furthermore, in the above-mentioned dynamic networking method of the distributed edge cloud, in step 2), the vxlan header and the outer UDP and IP headers are added to the packet header using the eBPF kernel auxiliary function (such as bpf_skb_store_bytes()), and the checksum is updated using bpf_l3_csum_replace() and bpf_l4_csum_replace();

[0042] After encapsulation is completed, the vxlan encapsulated data packet is sent to the Internet network card of this node through bpf_redirect (Internet network card ifindex, 0), so that it reaches the VEG of the remote cloud domain through the public network and the corresponding vxlan tunnel path.

[0043] By means of the above technical solution, the beneficial effects of the present invention are:

[0044] 1) The present invention deploys a cloud network scheduling server and deploys dial-up software and a virtual network controller on each cloud node to achieve the acquisition and synchronization of distributed edge cloud dynamic Internet IP and IP / Mac information of virtual machines.

[0045] 2) By building a distributed virtual switch and virtual edge gateway based on the virtual network forwarding plane implemented based on eBPF, Layer 2 network interconnection between virtual machines in the distributed edge cloud can be achieved in a geographically dispersed and dynamic IP environment.

[0046] 3) At the same time, the virtual edge gateway realizes the secure forwarding of data packets for cross-cloud access through policy control. In summary, the present invention effectively solves the problem of Layer 2 network intercommunication and secure access in a dynamic address environment in a distributed edge cloud, and improves the flexibility and scalability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 Shown is a schematic diagram of the distributed edge cloud dynamic networking component architecture;

[0048] Figure 2 It shows the schematic diagram of the synchronization of the cloud node's Internet IP and virtual machine IP / Mac information;

[0049] Figure 3 Shown is a flow chart of Layer 2 network access between virtual machines in a distributed cloud. DETAILED DESCRIPTION

[0050] The present invention is further described in detail below through specific preferred embodiments combined with effect test examples, but the present invention is not limited to the following embodiments.

[0051] The present invention discloses a dynamic networking method for distributed edge cloud. The present invention deploys a cloud network scheduling server, and deploys dial-up software and a virtual network controller on each cloud node to achieve the acquisition and synchronization of the distributed edge cloud dynamic Internet IP and the IP / Mac information of the virtual machine. eBPF (Extended Berkeley Packet Filter) is a high-performance and secure technology for network filtering and observation. It can run in the Linux kernel and has highly restricted access rights, thereby ensuring the security of the kernel and achieving high-speed data packet processing.

[0052] The present invention constructs a distributed virtual switch and a virtual edge gateway by using a virtual network forwarding plane based on eBPF, which can realize Layer 2 network intercommunication between virtual machines in a distributed edge cloud in a geographically dispersed and dynamic IP environment. At the same time, the virtual edge gateway realizes secure forwarding of data packets for cross-cloud access through policy control. In short, the present invention effectively solves the problem of Layer 2 network intercommunication and secure access in a dynamic address environment in a distributed edge cloud, and improves the flexibility and scalability of the system.

[0053] Reference Figure 1-3 As shown, the present invention provides a dynamic networking method for a distributed edge cloud, the method comprising the following steps:

[0054] Deploy a cloud network scheduling server on a public network server with a fixed public IP address to connect multiple geographically discrete and independently running edge clouds (i.e., cloud nodes) to form a distributed edge cloud;

[0055] The cloud network scheduling server communicates with each cloud node through the Internet to receive Internet IP information and virtual machine address information reported by the cloud node, and caches and distributes the received Internet IP information and virtual machine address information;

[0056] The cloud node deploys dial-up software, uses the dial-up protocol to obtain a dynamic Internet IP address, and binds the IP address to the cloud node's Internet network card;

[0057] The virtual network controller deployed on the cloud node monitors the information changes of the node, reports the changed information to the cloud network scheduling server by calling the reporting interface of the cloud network scheduling server, obtains the relevant update information of other cloud nodes through the subscription interface, and records the global node IP and virtual machine IP / MAC mapping data in the eBPF Map, thereby realizing the synchronization of Internet network card IP and virtual machine IP / MAC address synchronization.

[0058] Distributed virtual switches and virtual edge gateways are built on each cloud node based on eBPF technology. The virtual switches and virtual edge gateways run as eBPF programs in kernel state, and achieve dynamic networking of Layer 2 network interconnection and cross-cloud access between virtual machines by querying the node Internet IP and virtual machine IP / MAC information cached in the eBPF Map, as well as cross-cloud access policies.

[0059] The present invention requires the deployment and implementation of the following components, such as Figure 1 shown. Figure 1 Shown is a schematic diagram of the distributed edge cloud dynamic networking component architecture.

[0060] Deploy a cloud network scheduling server: deploy this component on a public network server with a fixed Internet IP.

[0061] The component is responsible for caching and distributing the Internet IP of all cloud nodes, the IP and Mac address information of the virtual machines on the cloud nodes, and providing HTTP interface;

[0062] Cloud node Internet IP address reporting interface, cloud node Internet IP address change subscription interface, cloud node virtual machine IP / Mac address reporting interface and cloud node virtual machine IP / Mac address change subscription interface. Deploy dial-up software on cloud nodes: Each cloud node uses dial-up software to dial using standard PPPoE and other protocols and obtains a dynamic Internet IP from the operator. Deploy a virtual network controller on the cloud node and implement the virtual network forwarding plane:

[0063] The virtual network controller is a resident process of each node, responsible for the control and scheduling of the node's virtual network. The virtual network controller sends virtual network forwarding rules to the virtual network forwarding plane. In implementation, the virtual network forwarding plane forwards virtual machine traffic through technologies such as bpf_redirect of the eBPF program, and the forwarding rules are stored in the eBPF Map.

[0064] Implement a distributed virtual switch on the virtual network forwarding plane:

[0065] The virtual machine network cards in the same layer 2 domain on the cloud node are logically connected to the same virtual switch. In terms of implementation, the eBPF program of the distributed virtual switch reads the virtual machine and node distribution information stored in the eBPF Map, dynamically schedules and selects the destination port to achieve secondary forwarding of virtual machine traffic.

[0066] Implement a virtual edge gateway on the virtual network forwarding plane:

[0067] The virtual edge gateway is responsible for maintaining the vxlan tunnels between nodes across the cloud, and selecting the tunnels to send and receive data packets for cross-cloud access. When the Internet IP of the cloud node changes, the edge gateway needs to rebuild these tunnels. At the same time, for data packets for cross-cloud access, the edge gateway also verifies and intercepts the data packets according to the cross-cloud access policy. The rules of the access policy use matching and actions, and the matching is a five-tuple of the virtual machine source, target IP and source, target Mac address and IP protocol. The rule action is whether to allow access.

[0068] Figure 2 The diagram shows the synchronization of the cloud node's Internet IP and virtual machine IP / Mac information; the cloud node's dial-up software obtains the Internet IP during initialization and binds the Internet IP to the node's Internet network card, through which the node can access the Internet. When the operator dynamically disconnects the dial-up connection and assigns a new Internet IP, the Internet network card's IP is also replaced with the new IP.

[0069] The virtual network controller monitors the changes of IP on the Internet network card, calls the cloud node Internet IP address reporting interface of the cloud network scheduling server, reports the cloud ID, cloud node ID, and Internet IP to the distributed cloud network scheduling server, and calls the cloud node Internet IP address change subscription interface at the same time to receive all node Internet IP messages distributed by the cloud network scheduling server, and records the relationship between the node ID and the Internet IP address in the eBPF Map.

[0070] The virtual network controller monitors the node cloud controller's creation, deletion, modification, and migration actions on virtual machines. When the IP / Mac address of the virtual machine changes, it calls the cloud node virtual machine IP / Mac address reporting interface of the cloud network scheduling server to report the change of the virtual machine IP / Mac address to the cloud network scheduling server. At the same time, it calls the cloud node virtual machine IP / Mac address change subscription interface to receive the cloud node virtual machine IP / Mac address change message distributed by the cloud network scheduling server, and records the cloud ID, node ID, virtual machine IP, and virtual machine Mac relationship to the eBPF Map.

[0071] The cloud network scheduling server receives the Internet IP address changes and cloud node virtual machine IP / Mac address changes reported by the cloud nodes and distributes them to all subscribed cloud nodes.

[0072] After the above synchronization process, the eBPF Map of each cloud node caches the full amount of cloud node ID and Internet IP address relationship data, and cloud node and virtual machine IP / Mac address relationship data.

[0073] Figure 3 The diagram shows the Layer 2 network access flow between virtual machines in a distributed cloud. The virtual network cards of virtual machines in the same Layer 2 network on a cloud node are all connected to the same distributed virtual switch. The uplink port of the distributed virtual switch is connected to the service network card and the virtual edge gateway. The virtual edge gateway is connected to the Internet network card.

[0074] When the virtual machine of the node initiates access, the eBPF program that implements the virtual switch will parse the ARP request and read all the virtual machine IP and virtual machine Mac address relationships in the eBPF Map. If the destination virtual machine IP address requested by the virtual machine exists, the eBPF program uses the corresponding virtual machine Mac address to unicast ARP reply to the virtual machine.

[0075] After the source virtual machine learns the Mac of the destination virtual machine, it initiates a unicast access request. The eBPF program that implements the virtual switch reads the relationship between the cloud ID, node ID, and virtual machine IP in the eBPF Map to find the cloud node where the virtual machine is located.

[0076] If the access is to a virtual machine on the same cloud node, the virtual switch will redirect the data packet to the virtual network card of the destination virtual machine.

[0077] If you are accessing a virtual machine on a different cloud node in the same cloud, the virtual switch will redirect the data packet to the destination physical service network card. After receiving the data packet, the physical service network card of the target cloud node redirects it to the virtual switch and finally reaches the destination virtual machine.

[0078] If the virtual machine accessed is a cross-cloud virtual machine, the virtual switch will redirect the data packet to the virtual edge gateway. The virtual edge gateway receives the access data packet between the virtual machines accessed across the cloud redirected from the virtual switch. The eBPF program that implements the virtual edge gateway will parse the destination virtual machine IP, and find the node ID in the relationship between the cloud ID, node ID, and virtual machine IP of the eBPF Map based on the virtual machine IP, and find the Internet IP of the cloud node where the destination virtual machine is located in the relationship between the node ID and the Internet IP address. Select the vxlan tunnel established with the destination cloud node and forward the data packet to the destination cloud node through this tunnel. The virtual edge gateway of the destination cloud node receives the data packet sent from the remote end, redirects the data packet to the distributed virtual switch, and finally reaches the destination virtual machine.

[0079] For data packets accessed across clouds, the edge gateway will also perform verification and release detection based on the set cross-cloud access policy. Only data packets that comply with the access policy will be forwarded, otherwise they will be intercepted.

[0080] The above process is also applicable to the process of the destination virtual machine returning to the source virtual machine.

[0081] In summary, the deployment process and components above enable secure Layer 2 network access between virtual machines on the distributed edge cloud.

[0082] Example 1

[0083] In this embodiment, the cloud network scheduling server provides the following http interface:

[0084] Cloud node Internet IP address reporting interface, used to receive Internet IP change information reported by cloud nodes;

[0085] Cloud node Internet IP address change subscription interface, used to distribute IP change information of other cloud nodes;

[0086] Cloud node virtual machine IP / MAC address reporting interface, used to receive the IP / MAC change information of the virtual machine reported by the cloud node;

[0087] The cloud node virtual machine IP / MAC address change subscription interface is used to distribute the IP / MAC change information of virtual machines in other cloud nodes.

[0088] In this embodiment, the specific steps of synchronizing the Internet network card IP are:

[0089] Call the "cloud node Internet IP address reporting interface" provided by the cloud network scheduling server to report the cloud ID, cloud node ID and current Internet IP of this node to the cloud network scheduling server;

[0090] At the same time, call the "Cloud Node Internet IP Address Change Subscription Interface" to subscribe to the Internet IP change information of other cloud nodes. The cloud network scheduling server collects and summarizes the reported information of each cloud node in the background, and distributes the full amount of cloud node Internet IP information to all subscribed nodes;

[0091] The virtual network controller writes the received full node ID and the corresponding Internet IP address relationship into the local eBPF Map for subsequent forwarding decisions of the distributed virtual switch (DVS) and virtual edge gateway (VEG).

[0092] In this embodiment, the specific steps of synchronizing the virtual machine IP / MAC information are as follows:

[0093] The virtual network controller also monitors the node cloud controller's creation, deletion, modification, and migration operations on virtual machines. When the IP / MAC address information of the virtual machine changes, the virtual network controller calls the "cloud node virtual machine IP / MAC address reporting interface" of the cloud network scheduling server to report the virtual machine IP / MAC change information, including cloud ID, node ID, virtual machine IP, and virtual machine MAC;

[0094] Call the "Cloud Node Virtual Machine IP / MAC Address Change Subscription Interface" to subscribe to other cloud node virtual machine IP / MAC change information. After receiving the virtual machine IP / MAC information change reported by any node, the cloud network scheduling server distributes the change to all subscribed cloud nodes. After each cloud node receives the update information, the virtual network controller writes the latest VMIP / MAC data to the local eBPF Map.

[0095] In this embodiment, building a distributed virtual switch based on eBPF technology on each cloud node includes:

[0096] 1) ARP request processing:

[0097] When the source virtual machine sends an ARP request to resolve the MAC address of the target virtual machine, the ARP packet first enters the eBPF program processing logic of the distributed virtual switch.

[0098] After parsing the ARP header, the eBPF program of the distributed virtual switch looks up the MAC address corresponding to the IP of the target VM from the eBPF Map. If there is a record in the Map, that is, the MAC of the target VM is known, the eBPF program does not need to broadcast the ARP request like a traditional switch, but only needs to use bpf_redirect() or bpf_clone_redirect() to generate an ARP reply packet and send it back to the virtual network card of the source VM to complete the unicast reply;

[0099] 2) Unicast packet forwarding:

[0100] When the source VM knows the MAC of the target VM and sends a unicast packet, the eBPF program of DVS finds the node and cloud domain information of the target VM from the eBPF Map by parsing the Ethernet header, IP header (and necessary transport layer header);

[0101] If the target VM is on this node, the eBPF program calls bpf_redirect(ifindex,0) to redirect the data packet to the corresponding virtual network card interface (ifindex is the index of the target VM network card), and the kernel state can complete the layer 2 forwarding;

[0102] If the target VM is in another node of the same cloud, the eBPF program knows based on the Map query that the data packet should be sent from the physical service network card of this node; the data packet is sent to the underlying network through bpf_redirect(physical service network card ifindex,0). After reaching the target node, the DVS eBPF program on the target node will look up the table again and finally deliver the data packet to the target VM;

[0103] If the target VM is in another cloud domain, DVS does not forward the data packet directly to the physical service network card, but redirects the data packet to VEG for processing; DVS can use bpf_redirect(vegw_ifindex,0) to direct the data packet to the dedicated virtual network card or internal interface of the virtual edge gateway for cross-cloud encapsulation and policy detection.

[0104] In this embodiment, the specific steps of eBPF implementing the virtual edge gateway (VEG) are:

[0105] 1) Cross-cloud access policy check:

[0106] VEG's eBPF program parses the packet header (IP, MAC, protocol, port) and matches the cross-cloud access policy rules in the eBPF Map;

[0107] 2) vxlan tunnel encapsulation and peer selection:

[0108] If the policy allows, VEG queries the Internet IP address and tunnel information of the target cloud node from the eBPF Map, and performs vxlan encapsulation on the data packet:

[0109] When the remote VEG receives a vxlan packet, its eBPF program decapsulates the packet and redirects the decapsulated original Ethernet frame back to the DVS for final delivery to the target VM.

[0110] Example 2

[0111] In this embodiment, the present invention provides a distributed edge cloud dynamic networking method, the method comprising the following steps:

[0112] Step 1), if the policy does not allow the packet to be transmitted across the cloud, VEG drops it by directly returning TC_ACT_SHOT (in TCHook) or returning XDP_DROP in XDP, or using bpf_redirect() to direct the packet to a drop interface;

[0113] Step 2) Use the eBPF kernel helper function to add the vxlan header and the outer UDP and IP headers to the packet header, and use bpf_l3_csum_replace() and bpf_l4_csum_replace() to update the checksum;

[0114] After encapsulation is completed, the vxlan encapsulated data packet is sent to the Internet network card of this node through bpf_redirect (Internet network card ifindex, 0), so that it reaches the VEG of the remote cloud domain through the public network and the corresponding vxlan tunnel path.

[0115] In this embodiment, the information changes of this node include changes in the Internet network card IP of this node, and changes in the virtual machine IP / MAC information caused by the cloud controller's creation, deletion, modification and migration operations on the virtual machine; the virtual network controller stores and distributes the changed Internet IP address information and virtual machine IP / MAC information.

[0116] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Therefore, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the technical solution of the present invention still fall within the scope of the technical solution of the present invention.

Claims

1. A dynamic networking method for a distributed edge cloud, characterized in that: The method comprises the following steps: Deploy a cloud network scheduling server on a public network server with a fixed public IP address to connect multiple geographically discrete and independently running edge clouds to form a distributed edge cloud; The cloud network scheduling server communicates with each cloud node through the Internet, is used to receive Internet IP information and address information of the virtual machine reported by the cloud node, and caches and distributes the received Internet IP information and address information of the virtual machine; The cloud node deploys dial-up software, uses the dial-up protocol to obtain a dynamic Internet IP address, and binds the IP address to the cloud node's Internet network card; The virtual network controller deployed on the cloud node monitors the information changes of the node, reports the changed information to the cloud network scheduling server by calling the reporting interface of the cloud network scheduling server, obtains the relevant update information of other cloud nodes through the subscription interface, and records the global node IP and virtual machine IP / MAC mapping data in the eBPF Map, thereby realizing the synchronization of Internet network card IP and virtual machine IP / MAC address; A distributed virtual switch and a virtual edge gateway are built on each cloud node based on the eBPF technology. The virtual switch and the virtual edge gateway run as eBPF programs in the kernel state, and realize dynamic networking of Layer 2 network interconnection and cross-cloud access between virtual machines by querying the node Internet IP and virtual machine IP / MAC information cached in the eBPF Map, as well as the cross-cloud access policy.

2. The dynamic networking method of a distributed edge cloud according to claim 1, characterized in that: The cloud network scheduling server provides the following http interface: Cloud node Internet IP address reporting interface, used to receive Internet IP change information reported by cloud nodes; Cloud node Internet IP address change subscription interface, used to distribute IP change information of other cloud nodes; Cloud node virtual machine IP / MAC address reporting interface, used to receive the IP / MAC change information of the virtual machine reported by the cloud node; The cloud node virtual machine IP / MAC address change subscription interface is used to distribute the IP / MAC change information of virtual machines in other cloud nodes.

3. The dynamic networking method of distributed edge cloud according to claim 2, characterized in that: The specific steps of synchronizing the Internet network card IP are: Call the "Cloud Node Internet IP Address Reporting Interface" provided by the cloud network scheduling server to report the cloud ID, cloud node ID and current Internet IP of this node to the cloud network scheduling server; At the same time, call the "Cloud Node Internet IP Address Change Subscription Interface" to subscribe to the Internet IP change information of other cloud nodes. The cloud network scheduling server collects and summarizes the reported information of each cloud node in the background, and distributes the full amount of cloud node Internet IP information to all subscribed nodes; The virtual network controller writes the received full node ID and the corresponding Internet IP address relationship into the local eBPFMap for subsequent forwarding decisions of the distributed virtual switch (DVS) and virtual edge gateway (VEG).

4. The dynamic networking method of a distributed edge cloud according to claim 3, characterized in that: The specific steps of synchronizing the virtual machine IP / MAC information are as follows: The virtual network controller also monitors the node cloud controller's creation, deletion, modification, and migration operations on virtual machines. When the IP / MAC address information of the virtual machine changes, the virtual network controller calls the "cloud node virtual machine IP / MAC address reporting interface" of the cloud network scheduling server to report the virtual machine IP / MAC change information, including cloud ID, node ID, virtual machine IP, and virtual machine MAC; Call the "Cloud Node Virtual Machine IP / MAC Address Change Subscription Interface" to subscribe to other cloud node virtual machine IP / MAC change information. After receiving the virtual machine IP / MAC information change reported by any node, the cloud network scheduling server distributes the change to all subscribed cloud nodes. After each cloud node receives the update information, the virtual network controller writes the latest VM IP / MAC data into the local eBPF Map.

5. The distributed edge cloud dynamic networking method according to claim 4, characterized in that: The construction of a distributed virtual switch based on the eBPF technology on each cloud node includes: 1) ARP request processing: When the source VM sends an ARP request to resolve the MAC address of the target VM, the ARP packet first enters the eBPF program processing logic of the distributed virtual switch; After parsing the ARP header, the eBPF program of the distributed virtual switch looks up the MAC address corresponding to the IP of the target VM from the eBPF Map. If there is a record in the Map, that is, the MAC of the target VM is known, the eBPF program uses bpf_redirect() or bpf_clone_redirect() to generate an ARP reply packet and send it back to the virtual network card of the source VM to complete the unicast reply. 2) Unicast packet forwarding: When the source VM knows the MAC of the target VM and sends a unicast packet, the eBPF program of DVS finds the node and cloud domain information of the target VM from the eBPF Map by parsing the Ethernet header and IP header; If the target VM is on this node, the eBPF program calls bpf_redirect(ifindex,0) to redirect the data packet to the corresponding virtual network card interface (ifindex is the index of the target VM network card), and the kernel state can complete the layer 2 forwarding; If the target VM is in another node of the same cloud, the eBPF program knows based on the Map query that the data packet should be sent from the physical service network card of this node; the data packet is sent to the underlying network through bpf_redirect(physical service network card ifindex,0). After reaching the target node, the DVS eBPF program on the target node will look up the table again and finally deliver the data packet to the target VM; If the target VM is in another cloud domain, DVS does not forward the data packet directly to the physical service network card, but redirects the data packet to VEG for processing; DVS can use bpf_redirect(vegw_ifindex,0) to direct the data packet to the dedicated virtual network card or internal interface of the virtual edge gateway for cross-cloud encapsulation and policy detection.

6. The dynamic networking method of distributed edge cloud according to claim 5, characterized in that: The specific steps of implementing the virtual edge gateway (VEG) by eBPF are as follows: 1) Cross-cloud access policy check: VEG's eBPF program parses the packet header (IP, MAC, protocol, port) and matches the cross-cloud access policy rules in the eBPF Map; 2) vxlan tunnel encapsulation and peer selection: If the policy allows, VEG queries the Internet IP address and tunnel information of the target cloud node from the eBPF Map, and performs vxlan encapsulation on the data packet: When the remote VEG receives a vxlan packet, its eBPF program decapsulates the packet and redirects the decapsulated original Ethernet frame back to the DVS for final delivery to the target VM.

7. The dynamic networking method of a distributed edge cloud according to claim 6, characterized in that: In step 1), if the policy does not allow the packet to be transmitted across the cloud, VEG drops it by directly returning TC_ACT_SHOT (in TC Hook) or returning XDP_DROP in XDP, or using bpf_redirect() to direct the packet to a discard interface.

8. The dynamic networking method of a distributed edge cloud according to claim 6, characterized in that: In step 2), use the eBPF kernel helper function to add the vxlan header and the outer UDP and IP headers to the packet header, and use bpf_l3_csum_replace() and bpf_l4_csum_replace() to update the checksum. After encapsulation is completed, the vxlan encapsulated data packet is sent to the Internet network card of this node through bpf_redirect (Internet network card ifindex, 0), so that it reaches the VEG of the remote cloud domain through the public network and the corresponding vxlan tunnel path.

9. The dynamic networking method of a distributed edge cloud according to claim 6, characterized in that: The information changes of this node include the changes of the Internet network card IP of this node, and the changes of the virtual machine IP / MAC information caused by the cloud controller's creation, deletion, modification and migration operations on the virtual machine; the virtual network controller will change the Internet IP address information and virtual machine IP / MAC information.

Images