A dynamic networking method of distributed edge cloud

Abstract

The application provides a dynamic networking method of distributed edge cloud. The application realizes acquisition and synchronization of dynamic Internet IP of distributed edge cloud and IP / Mac information of virtual machine by deploying a cloud network scheduling server, and deploying dialing software and a virtual network controller on each cloud node. A distributed virtual switch and a virtual edge gateway are constructed through a virtual network forwarding plane based on eBPF, so that two-layer network intercommunication between virtual machines in the distributed edge cloud can be realized in a geographically dispersed and dynamic IP environment. Meanwhile, the virtual edge gateway realizes safe forwarding of data packets in cross-cloud access through policy control. In summary, the application effectively solves the two-layer network intercommunication and safe access problem in the dynamic address environment of the distributed edge cloud, and improves the flexibility and scalability of the system.

Description

Technical Field

[0001] This invention relates to the field of edge cloud technology, and more specifically to a dynamic networking method for distributed edge clouds. Background Technology

[0002] With the rapid development of technologies such as the Internet of Things (IoT), 5G, smart cities, and autonomous driving, edge computing has gained widespread attention and application as a crucial architecture for addressing the demands of low-latency, high-bandwidth applications. In this context, Distributed Edge Cloud (DEL) provides services closer to users and devices by distributing computing and storage resources across network edge nodes. However, DEL faces several technical challenges in practical applications, one of which is how to achieve Layer 2 network interoperability between virtual machines (VMs) on various edge cloud nodes in a distributed environment.

[0003] In traditional data center cloud computing architectures, communication between virtual machines is typically achieved through fixed internet IPs and the data center's internal network. However, in distributed edge cloud environments, due to geographical dispersion and the complexity of the network environment, dial-up connections to the internet are often used. The IP addresses of these nodes are dynamically assigned, without fixed internet IPs, making traditional static IP address mapping and routing methods ineffective.

[0004] Since communication between edge clouds needs to cross multiple different network environments, how to achieve Layer 2 network interoperability between these heterogeneous networks and ensure that virtual machines can communicate as if they were in the same local area network is a technical challenge. Summary of the Invention

[0005] The purpose of this invention is to propose a dynamic networking method for distributed edge clouds. In the scenario of using dynamic Internet IP addresses via dial-up networks in the edge cloud environment, cloud nodes dynamically update and perceive changes in node networks and virtual machine locations through a cloud network scheduling server, thereby enabling Layer 2 network interconnection between virtual machines in the distributed cloud. Furthermore, by setting cross-cloud access policies on the virtual edge gateway of the cloud nodes, limited and secure access between virtual machines across clouds is achieved.

[0006] This invention is achieved through the following technical solution:

[0007] A dynamic networking method for distributed edge clouds includes the following steps:

[0008] A cloud network scheduling server is deployed on a public network server with a fixed public IP address to connect multiple geographically dispersed and independently operating edge clouds to form a distributed edge cloud.

[0009] The cloud network scheduling server communicates with each cloud node via the Internet to receive Internet IP information and virtual machine (VM) IP / MAC information reported by the cloud nodes, and caches and distributes the received information.

[0010] Deploy dial-up software on each cloud node to obtain a dynamic Internet IP address via PPPoE or a similar dial-up protocol, and bind the IP address to the cloud node's Internet network card;

[0011] A virtual network controller is deployed on each cloud node to monitor changes in the node's Internet network interface card (NIC) IP address, as well as changes in virtual machine IP / MAC information caused by the cloud controller's creation, deletion, modification, and migration operations on virtual machines. The virtual network controller reports the changed Internet IP address information and virtual machine IP / MAC information to the cloud network scheduling server by calling the reporting interface, and obtains relevant update information from other cloud nodes through the subscription interface. The global node IP and virtual machine IP / MAC mapping data are recorded in the eBPF Map.

[0012] A virtual network forwarding plane is built on each cloud node based on eBPF technology, including a distributed virtual switch (DVS) and a virtual edge gateway (VEG). The DVS and VEG run as eBPF programs in kernel mode. By querying the node Internet IP and virtual machine IP / MAC information cached in the eBPF Map, as well as cross-cloud access policies, dynamic networking is achieved to enable Layer 2 network interconnection and cross-cloud access between virtual machines.

[0013] Furthermore, in the aforementioned dynamic networking method for distributed edge clouds, the cloud network scheduling server provides the following HTTP interface:

[0014] The cloud node Internet IP address reporting interface is used to receive Internet IP address change information reported by cloud nodes.

[0015] The cloud node Internet IP address change subscription interface is used to distribute IP change information of other cloud nodes;

[0016] The cloud node virtual machine IP / MAC address reporting interface is used to receive VM IP / MAC change information reported by the cloud node;

[0017] The cloud node virtual machine IP / MAC address change subscription interface is used to distribute VM IP / MAC change information to other cloud nodes.

[0018] Furthermore, in the aforementioned dynamic networking method for distributed edge clouds, the specific steps for synchronizing the Internet network interface card (NIC) IP address are as follows:

[0019] Call the "Cloud Node Internet IP Address Reporting Interface" provided by the cloud network scheduling server to report the cloud ID, cloud node ID and current Internet IP of this node to the cloud network scheduling server;

[0020] Simultaneously, the "Cloud Node Internet IP Address Change Subscription Interface" is invoked to subscribe to the Internet IP change information of other cloud nodes. The cloud network scheduling server collects and summarizes the reported information from each cloud node in the background and distributes the full amount of cloud node Internet IP information to all subscribed nodes.

[0021] The virtual network controller writes the received full node IDs and their corresponding Internet IP addresses into the local eBPF Map for subsequent forwarding decisions by the Distributed Virtual Switch (DVS) and Virtual Edge Gateway (VEG).

[0022] Furthermore, in the aforementioned dynamic networking method for distributed edge clouds, the specific steps for synchronizing virtual machine IP / MAC information are as follows:

[0023] The virtual network controller also monitors the creation, deletion, modification, and migration operations performed by the node cloud controller on virtual machines. When the IP / MAC address information of a virtual machine changes, the virtual network controller calls the "Cloud Node Virtual Machine IP / MAC Address Reporting Interface" of the cloud network scheduling server to report the virtual machine IP / MAC change information, including cloud ID, node ID, virtual machine IP, and virtual machine MAC.

[0024] The system calls the "Cloud Node Virtual Machine IP / MAC Address Change Subscription Interface" to subscribe to information on changes in the virtual machine IP / MAC addresses of other cloud nodes. After receiving a report of virtual machine IP / MAC address changes from any node, the cloud network scheduling server distributes the changes to all subscribed cloud nodes. Upon receiving the update information, each cloud node's virtual network controller writes the latest VM IP / MAC data to its local eBPF Map.

[0025] Furthermore, in the aforementioned dynamic networking method for distributed edge clouds, the specific steps for implementing the distributed virtual switch (DVS) using eBPF are as follows:

[0026] 1) ARP request processing:

[0027] When the source virtual machine sends an ARP request to resolve the MAC address of the target virtual machine, the ARP packet first enters the eBPF program processing logic of DVS.

[0028] After parsing the ARP header, the DVS eBPF program looks up the MAC address corresponding to the target VM's IP address in the eBPF Map. If a record exists in the Map, meaning the target VM's MAC address is known, the eBPF program does not need to broadcast an ARP request like a traditional switch. Instead, it uses bpf_redirect() or bpf_clone_redirect() to generate an ARP reply packet and send it back to the source VM's virtual network interface card, completing the unicast reply.

[0029] 2) Unicast packet forwarding:

[0030] Once the source VM knows the target VM's MAC address, when it sends a unicast data packet, the DVS's eBPF program searches for the target VM's node and cloud domain information in the eBPF Map by parsing the Ethernet header, IP header (and necessary transport layer headers).

[0031] If the target VM is on this node, the eBPF program calls bpf_redirect(ifindex,0) to redirect the packet to the corresponding virtual network interface (ifindex is the index of the target VM's network interface), and the kernel can complete the Layer 2 forwarding.

[0032] If the target VM is on another node in the same cloud, the eBPF program will use a Map lookup to determine that the data packet should be sent out from the physical service network card of this node. The data packet will be sent to the underlying network via bpf_redirect(physical service network card ifindex,0). After arriving at the target node, the DVS eBPF program on the target node will look up the table again and finally deliver the data packet to the target VM.

[0033] If the target VM is located in another cloud domain, DVS will not forward the data packet directly to the physical service network card, but will redirect the data packet to VEG for processing. DVS can use bpf_redirect(vegw_ifindex,0) to redirect the data packet to the dedicated virtual network card or internal interface of the virtual edge gateway for cross-cloud encapsulation and policy detection.

[0034] Furthermore, in the aforementioned dynamic networking method for distributed edge clouds, the specific steps for implementing the Virtual Edge Gateway (VEG) using eBPF are as follows:

[0035] 1) Cross-cloud access policy check:

[0036] VEG's eBPF program parses the packet header (IP, MAC, protocol, port) and matches it with cross-cloud access policy rules in the eBPF Map;

[0037] 2) VXLAN tunnel encapsulation and peer selection:

[0038] If the policy allows, VEG queries the target cloud node's internet IP address and tunnel information from the eBPF Map, and then encapsulates the data packets using VXLAN:

[0039] When the remote VEG receives VXLAN packets, its eBPF program decapsulates the packets and redirects the decapsulated original Ethernet frame back to the DVS for final delivery to the target VM.

[0040] Furthermore, in the aforementioned dynamic networking method for distributed edge clouds, in step 1), if the policy does not allow the data packet to be transmitted across clouds, VEG discards it by directly returning TC_ACT_SHOT (in TC Hook) or returning XDP_DROP in XDP, or by using bpf_redirect() to redirect the data packet to a discard interface. This allows policy filtering to be completed directly in kernel mode, improving the security and flexibility of cross-cloud access.

[0041] Furthermore, in the above-mentioned dynamic networking method for distributed edge cloud, in step 2), the eBPF kernel helper function (such as bpf_skb_store_bytes()) is used to add a VXLAN header and outer UDP and IP headers to the packet header, and the checksum is updated using bpf_l3_csum_replace() and bpf_l4_csum_replace().

[0042] After encapsulation, the VXLAN encapsulated data packet is sent to the local node's Internet interface card via bpf_redirect(Internet interface card ifindex,0), so that it can reach the VEG in the remote cloud domain through the public network and the corresponding VXLAN tunnel path.

[0043] By employing the above technical solution, the beneficial effects of the present invention are:

[0044] 1) This invention achieves the acquisition and synchronization of dynamic Internet IP and virtual machine IP / MAC information of distributed edge cloud by deploying a cloud network scheduling server and deploying dial-up software and virtual network controllers on each cloud node.

[0045] 2) By constructing distributed virtual switches and virtual edge gateways through a virtual network forwarding plane based on eBPF, Layer 2 network interconnection between virtual machines in a geographically dispersed and dynamic IP environment can be achieved.

[0046] 3) Simultaneously, the virtual edge gateway enables secure packet forwarding for cross-cloud access through policy control. In summary, this invention effectively solves the problem of Layer 2 network interoperability and secure access in a dynamic address environment within a distributed edge cloud, improving the system's flexibility and scalability. Attached Figure Description

[0047] Figure 1 This displays a schematic diagram of the distributed edge cloud dynamic networking component architecture.

[0048] Figure 2 This displays a diagram illustrating the synchronization of the cloud node's Internet IP and virtual machine IP / MAC information;

[0049] Figure 3 This diagram shows the flow chart of Layer 2 network access between virtual machines in a distributed cloud. Detailed Implementation

[0050] The present invention will be further described in detail below through specific preferred embodiments and effect test examples, but the present invention is not limited to the following embodiments.

[0051] This invention discloses a dynamic networking method for distributed edge clouds. By deploying a cloud network scheduling server and dial-up software and virtual network controllers on each cloud node, this invention achieves the acquisition and synchronization of dynamic Internet IP addresses and virtual machine IP / MAC information for the distributed edge cloud. eBPF (Extended Berkeley Packet Filter) is a high-performance, secure technology for network filtering and observation. It can run in the Linux kernel with highly restricted access permissions, ensuring kernel security, and also enables high-speed packet processing.

[0052] This invention constructs distributed virtual switches and virtual edge gateways through a virtual network forwarding plane based on eBPF, enabling Layer 2 network interconnection between virtual machines in a geographically dispersed, dynamic IP environment. Simultaneously, the virtual edge gateway achieves secure packet forwarding for cross-cloud access through policy control. In summary, this invention effectively solves the problems of Layer 2 network interconnection and secure access in a dynamic address environment in a distributed edge cloud, improving the system's flexibility and scalability.

[0053] Reference Figure 1-3 As shown, this invention provides a dynamic networking method for distributed edge clouds, which includes the following steps:

[0054] Deploy a cloud network scheduling server on a public network server with a fixed public IP address to connect multiple geographically dispersed and independently operating edge clouds (i.e. cloud nodes) to form a distributed edge cloud;

[0055] The cloud network scheduling server communicates with each cloud node via the Internet to receive Internet IP information and virtual machine address information reported by the cloud nodes, and caches and distributes the received Internet IP information and virtual machine address information.

[0056] The cloud node obtains a dynamic Internet IP address by deploying dial-up software and using a dial-up protocol, and then binds the IP address to the cloud node's Internet network card.

[0057] The virtual network controller deployed on the cloud node listens for changes in the node's information, reports the changes to the cloud network scheduling server by calling the reporting interface of the cloud network scheduling server, and obtains relevant update information from other cloud nodes through the subscription interface. It records the global node IP and virtual machine IP / MAC mapping data in the eBPF Map, thereby realizing the synchronization of Internet network card IP and virtual machine IP / MAC address.

[0058] Distributed virtual switches and virtual edge gateways are built on each cloud node based on eBPF technology. The virtual switches and virtual edge gateways run as eBPF programs in kernel mode. By querying the node Internet IP and virtual machine IP / MAC information cached in the eBPF Map, as well as cross-cloud access policies, dynamic networking is achieved to enable Layer 2 network interconnection and cross-cloud access between virtual machines.

[0059] This invention requires the deployment and implementation of the following components, such as Figure 1 As shown. Figure 1 This diagram shows a schematic of the distributed edge cloud dynamic networking component architecture.

[0060] Deploy the cloud network scheduling server: Deploy this component on a public network server with a fixed Internet IP address.

[0061] The component is responsible for caching and distributing the Internet IPs, virtual machine IPs and MAC address information of all cloud nodes, and providing an HTTP interface;

[0062] The system includes interfaces for reporting cloud node internet IP addresses, subscribing to changes in cloud node internet IP addresses, reporting cloud node virtual machine IP / MAC addresses, and subscribing to changes in cloud node virtual machine IP / MAC addresses. Dial-up software is deployed on the cloud nodes: each cloud node uses dial-up software to dial using standard protocols such as PPPoE and obtains a dynamic internet IP address from the ISP. A virtual network controller is deployed on the cloud nodes, implementing a virtual network forwarding plane.

[0063] The virtual network controller is a resident process on each node, responsible for controlling and scheduling the node's virtual network. The virtual network controller distributes virtual network forwarding rules to the virtual network forwarding plane. In implementation, the virtual network forwarding plane forwards virtual machine traffic using techniques such as bpf_redirect in the eBPF program, and the forwarding rules are stored in the eBPF Map.

[0064] Implementing distributed virtual switches in the virtual network forwarding plane:

[0065] Virtual machine network interface cards (NICs) in the same Layer 2 domain on cloud nodes are logically connected to the same virtual switch. In implementation, the eBPF program of the distributed virtual switch dynamically schedules and selects destination ports to achieve secondary forwarding of virtual machine traffic by reading the virtual machine and node distribution information stored in the eBPF Map.

[0066] Implement a virtual edge gateway in the virtual network forwarding plane:

[0067] The virtual edge gateway is responsible for maintaining VXLAN tunnels between nodes across clouds and selecting tunnels to send and receive cross-cloud access packets. When the internet IP address of a cloud node changes, the edge gateway needs to rebuild these tunnels. Simultaneously, for cross-cloud access packets, the edge gateway also verifies and intercepts packets according to cross-cloud access policies. The access policy rules use matching and actions. Matching is a five-tuple of virtual machine source, destination IP address, source and destination MAC address, and IP protocol; the action is whether access is allowed or not.

[0068] Figure 2 This diagram illustrates the synchronization of the cloud node's internet IP and virtual machine IP / MAC address information. During initialization, the cloud node's dial-up software obtains the internet IP and binds it to the node's internet network interface card (NIC). The node can then access the internet through this NIC. When the ISP dynamically disconnects the dial-up connection and assigns a new internet IP, the NIC's IP address is also updated to the new IP.

[0069] The virtual network controller listens for changes in the IP address on the Internet network card, calls the cloud node Internet IP address reporting interface of the cloud network scheduling server, and reports the cloud ID, cloud node ID, and Internet IP to the distributed cloud network scheduling server. At the same time, it calls the cloud node Internet IP address change subscription interface to receive all node Internet IP messages distributed by the cloud network scheduling server and records the relationship between node ID and Internet IP address in the eBPF Map.

[0070] The virtual network controller listens for actions performed by the cloud controller on virtual machines (VMs) during creation, deletion, modification, and migration, and when the VM's IP / MAC address changes. It then calls the cloud network scheduling server's VM IP / MAC address reporting interface to report the change. Simultaneously, it calls the cloud node VM IP / MAC address change subscription interface to receive VM IP / MAC address change messages distributed by the cloud network scheduling server, recording the cloud ID, node ID, VM IP, and VM MAC address in the eBPF Map.

[0071] The cloud network scheduling server receives reports from cloud nodes regarding changes in their Internet IP addresses and virtual machine IP / MAC addresses, and distributes these reports to all subscribed cloud nodes.

[0072] After the above synchronization process, each cloud node's eBPF Map caches the full data on cloud node IDs and their relationships with internet IP addresses, as well as the relationships between cloud nodes and virtual machine IP / MAC addresses.

[0073] Figure 3 This diagram illustrates the Layer 2 network access flow between virtual machines in a distributed cloud. Virtual network interface cards (NICs) of virtual machines on the same Layer 2 network on a cloud node are all connected to the same distributed virtual switch. The uplink ports of the distributed virtual switch connect the service NICs and the virtual edge gateway. The virtual edge gateway connects to the internet NIC.

[0074] When a virtual machine on a node initiates an access request, the eBPF program implementing the virtual switch parses the ARP request and reads the relationship between all virtual machine IPs and virtual machine MAC addresses in the eBPF Map. If the destination virtual machine IP address requested by the virtual machine exists, the eBPF program uses the corresponding virtual machine MAC address to unicast ARP to reply to the virtual machine.

[0075] After the source virtual machine learns the MAC address of the destination virtual machine, it initiates a unicast access request. The eBPF program of the virtual switch will read the relationship between cloud ID, node ID, and virtual machine IP in the eBPF Map to find the cloud node where the virtual machine is located.

[0076] If the data packet is accessed from a virtual machine on the same cloud node, the virtual switch will redirect the data packet to the virtual network interface card of the destination virtual machine.

[0077] If the data packet is accessed from a virtual machine on a different cloud node within the same cloud, the virtual switch will redirect the data packet to the destination physical network interface card (NIC). The physical NIC of the target cloud node will then receive the data packet and redirect it to the virtual switch, ultimately reaching the destination virtual machine.

[0078] If the access involves a cross-cloud virtual machine, the virtual switch redirects the data packets to the virtual edge gateway. The virtual edge gateway receives the cross-cloud virtual machine access data packets redirected from the virtual switch on its local node. The eBPF program implementing the virtual edge gateway resolves the destination virtual machine's IP address and, based on this IP address, finds the node ID in the eBPF Map's cloud ID, node ID, and virtual machine IP relationship. It then finds the internet IP address of the cloud node where the destination virtual machine resides in the node ID and internet IP address relationship. A pre-established VXLAN tunnel with the destination cloud node is selected, and the data packets are forwarded through this tunnel to the destination cloud node. The virtual edge gateway on the destination cloud node receives the data packets from the remote end, redirects them to the distributed virtual switch, and ultimately reaches the destination virtual machine.

[0079] For data packets accessing across clouds, the edge gateway will also perform verification and allow detection according to the configured cross-cloud access policy. Only data packets that conform to the access policy will be forwarded; otherwise, they will be blocked.

[0080] The same process applies to the process of the destination virtual machine responding to the source virtual machine.

[0081] In summary, the deployment process and components described above enable Layer 2 network security communication between virtual machines on the distributed edge cloud.

[0082] Example 1

[0083] In this embodiment, the cloud network scheduling server provides the following HTTP interface:

[0084] The cloud node Internet IP address reporting interface is used to receive Internet IP address change information reported by cloud nodes.

[0085] The cloud node Internet IP address change subscription interface is used to distribute IP change information of other cloud nodes;

[0086] The cloud node virtual machine IP / MAC address reporting interface is used to receive IP / MAC change information of virtual machines reported by the cloud node;

[0087] The cloud node virtual machine IP / MAC address change subscription interface is used to distribute IP / MAC address change information of virtual machines on other cloud nodes.

[0088] In this embodiment, the specific steps for synchronizing the Internet network card IP address are as follows:

[0089] Call the "Cloud Node Internet IP Address Reporting Interface" provided by the cloud network scheduling server to report the cloud ID, cloud node ID and current Internet IP of this node to the cloud network scheduling server;

[0090] Simultaneously, the "Cloud Node Internet IP Address Change Subscription Interface" is invoked to subscribe to the Internet IP change information of other cloud nodes. The cloud network scheduling server collects and summarizes the reported information from each cloud node in the background and distributes the full amount of cloud node Internet IP information to all subscribed nodes.

[0091] The virtual network controller writes the received full node IDs and their corresponding Internet IP addresses into the local eBPF Map for subsequent forwarding decisions by the Distributed Virtual Switch (DVS) and Virtual Edge Gateway (VEG).

[0092] In this embodiment, the specific steps for synchronizing virtual machine IP / MAC information are as follows:

[0093] The virtual network controller also monitors the creation, deletion, modification, and migration operations performed by the node cloud controller on virtual machines. When the IP / MAC address information of a virtual machine changes, the virtual network controller calls the "Cloud Node Virtual Machine IP / MAC Address Reporting Interface" of the cloud network scheduling server to report the virtual machine IP / MAC change information, including cloud ID, node ID, virtual machine IP, and virtual machine MAC.

[0094] The system calls the "Cloud Node Virtual Machine IP / MAC Address Change Subscription Interface" to subscribe to virtual machine IP / MAC address change information from other cloud nodes. Upon receiving a virtual machine IP / MAC address change reported by any node, the cloud network scheduling server distributes the change to all subscribed cloud nodes. Upon receiving this update, each cloud node's virtual network controller writes the latest VM IP / MAC data to its local eBPF Map.

[0095] In this embodiment, constructing a distributed virtual switch based on eBPF technology on each cloud node includes:

[0096] 1) ARP request processing:

[0097] When the source virtual machine sends an ARP request to resolve the MAC address of the target virtual machine, the ARP packet first enters the eBPF program processing logic of the distributed virtual switch.

[0098] After parsing the ARP header, the eBPF program of the distributed virtual switch looks up the MAC address corresponding to the IP address of the target VM in the eBPF Map. If the record exists in the Map, that is, the MAC address of the target VM is known, the eBPF program does not need to broadcast the ARP request like a traditional switch. It only needs to use bpf_redirect() or bpf_clone_redirect() to generate an ARP reply packet and send it back to the virtual network card of the source VM to complete the unicast reply.

[0099] 2) Unicast packet forwarding:

[0100] Once the source VM knows the target VM's MAC address, when it sends a unicast data packet, the DVS's eBPF program searches for the target VM's node and cloud domain information in the eBPF Map by parsing the Ethernet header, IP header (and necessary transport layer headers).

[0101] If the target VM is on this node, the eBPF program calls bpf_redirect(ifindex,0) to redirect the packet to the corresponding virtual network interface (ifindex is the index of the target VM's network interface), and the kernel can complete the Layer 2 forwarding.

[0102] If the target VM is on another node in the same cloud, the eBPF program will use a Map lookup to determine that the data packet should be sent out from the physical service network card of this node. The data packet will be sent to the underlying network via bpf_redirect(physical service network card ifindex,0). After arriving at the target node, the DVS eBPF program on the target node will look up the table again and finally deliver the data packet to the target VM.

[0103] If the target VM is located in another cloud domain, DVS will not forward the data packet directly to the physical service network card, but will redirect the data packet to VEG for processing. DVS can use bpf_redirect(vegw_ifindex,0) to redirect the data packet to the dedicated virtual network card or internal interface of the virtual edge gateway for cross-cloud encapsulation and policy detection.

[0104] In this embodiment, the specific steps for eBPF to implement a Virtual Edge Gateway (VEG) are as follows:

[0105] 1) Cross-cloud access policy check:

[0106] VEG's eBPF program parses the packet header (IP, MAC, protocol, port) and matches it with cross-cloud access policy rules in the eBPF Map;

[0107] 2) VXLAN tunnel encapsulation and peer selection:

[0108] If the policy allows, VEG queries the target cloud node's internet IP address and tunnel information from the eBPF Map, and then encapsulates the data packets using VXLAN:

[0109] When the remote VEG receives VXLAN packets, its eBPF program decapsulates the packets and redirects the decapsulated original Ethernet frame back to the DVS for final delivery to the target VM.

[0110] Example 2

[0111] In this embodiment, the present invention provides a dynamic networking method for distributed edge clouds, the method comprising the following steps:

[0112] Step 1), if the policy does not allow the packet to be transmitted across the cloud, VEG will drop it by returning TC_ACT_SHOT directly (in TCHook) or XDP_DROP in XDP, or by using bpf_redirect() to direct the packet to a drop interface.

[0113] Step 2) Use eBPF kernel helper functions to add a VXLAN header and outer UDP and IP headers to the packet header, and update the checksum with bpf_l3_csum_replace() and bpf_l4_csum_replace().

[0114] After encapsulation, the VXLAN encapsulated data packet is sent to the local node's Internet interface card via bpf_redirect(Internet interface card ifindex,0), so that it can reach the VEG in the remote cloud domain through the public network and the corresponding VXLAN tunnel path.

[0115] In this embodiment, the information changes of this node include changes in the IP address of the node's Internet network interface card, as well as changes in the virtual machine IP / MAC information caused by the cloud controller's creation, deletion, modification, and migration operations on virtual machines; the virtual network controller stores and distributes the changed Internet IP address information and virtual machine IP / MAC information.

[0116] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Therefore, any simple modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A dynamic networking method for distributed edge clouds, characterized in that, The method includes the following steps: Deploy a cloud network scheduling server on a public network server with a fixed public IP address to connect multiple geographically dispersed and independently operating edge clouds to form a distributed edge cloud; The cloud network scheduling server communicates with each cloud node via the Internet to receive Internet IP information and virtual machine address information reported by the cloud nodes, and caches and distributes the received Internet IP information and virtual machine address information. The cloud node obtains a dynamic Internet IP address by deploying dial-up software and using a dial-up protocol, and then binds the IP address to the cloud node's Internet network card. The virtual network controller deployed on the cloud node listens for changes in the information of the local node, reports the changes to the cloud network scheduling server by calling the reporting interface of the cloud network scheduling server, and obtains relevant update information of other cloud nodes through the subscription interface. It records the global node IP and virtual machine IP / MAC mapping data in the eBPF Map, thereby realizing the synchronization of Internet network card IP and virtual machine IP / MAC address. A distributed virtual switch and a virtual edge gateway are built on each cloud node based on eBPF technology. The virtual switch and virtual edge gateway run as eBPF programs in kernel mode. By querying the node Internet IP and virtual machine IP / MAC information cached in the eBPF Map, as well as cross-cloud access policies, dynamic networking is achieved to enable Layer 2 network interconnection and cross-cloud access between virtual machines.

2. The dynamic networking method for distributed edge cloud as described in claim 1, characterized in that: The cloud network scheduling server provides the following HTTP interfaces: The cloud node Internet IP address reporting interface is used to receive Internet IP address change information reported by cloud nodes. The cloud node Internet IP address change subscription interface is used to distribute IP change information of other cloud nodes; The cloud node virtual machine IP / MAC address reporting interface is used to receive IP / MAC change information of virtual machines reported by the cloud node; The cloud node virtual machine IP / MAC address change subscription interface is used to distribute IP / MAC address change information of virtual machines on other cloud nodes.

3. The dynamic networking method for distributed edge cloud as described in claim 2, characterized in that: The specific steps for synchronizing the Internet network card IP are as follows: Call the "Cloud Node Internet IP Address Reporting Interface" provided by the cloud network scheduling server to report the cloud ID, cloud node ID and current Internet IP of this node to the cloud network scheduling server; Simultaneously, the "Cloud Node Internet IP Address Change Subscription Interface" is invoked to subscribe to the Internet IP change information of other cloud nodes; The cloud network scheduling server collects and summarizes the information reported by each cloud node in the background, and distributes the full amount of cloud node Internet IP information to all subscribed nodes. The virtual network controller writes the received full node IDs and their corresponding Internet IP addresses into a local eBPFMap for subsequent forwarding decisions by the Distributed Virtual Switch (DVS) and Virtual Edge Gateway (VEG).

4. The dynamic networking method for distributed edge cloud as described in claim 3, characterized in that: The specific steps for synchronizing virtual machine IP / MAC information are as follows: The virtual network controller also monitors the node cloud controller's operations on virtual machines, including creation, deletion, modification, and migration. When the virtual machine's IP / MAC address information changes, the virtual network controller calls the cloud network scheduling server's "cloud node virtual machine IP / MAC address reporting interface" to report the virtual machine's IP / MAC change information, including cloud ID, node ID, virtual machine IP, and virtual machine MAC. The "Cloud Node Virtual Machine IP / MAC Address Change Subscription Interface" is called to subscribe to the virtual machine IP / MAC change information of other cloud nodes. After receiving the virtual machine IP / MAC information change reported by any node, the cloud network scheduling server distributes the change to all subscribed cloud nodes. After receiving the update information, each cloud node writes the latest VM IP / MAC data to its local eBPF Map.

5. The dynamic networking method for distributed edge cloud as described in claim 4, characterized in that: The construction of a distributed virtual switch based on eBPF technology on each cloud node includes: 1) ARP request processing: When the source virtual machine sends an ARP request to resolve the MAC address of the target virtual machine, the ARP packet first enters the eBPF program processing logic of the distributed virtual switch. After parsing the ARP header, the eBPF program of the distributed virtual switch looks up the MAC address corresponding to the IP of the target VM in the eBPF Map. If the record exists in the Map, that is, the MAC of the target VM is known, the eBPF program uses bpf_redirect() or bpf_clone_redirect() to generate an ARP reply packet and send it back to the virtual network card of the source VM to complete the unicast reply. 2) Unicast packet forwarding: Once the source VM knows the target VM's MAC address, when it sends a unicast data packet, the DVS's eBPF program searches the eBPF Map for the node and cloud domain information of the target VM by parsing the Ethernet header and IP header. If the target VM is on this node, the eBPF program calls bpf_redirect, ifindex,0 to redirect the data packet to the corresponding virtual network interface, where ifindex is the index of the target VM's network interface. Layer 2 forwarding can be completed in kernel mode. If the target VM is on another node in the same cloud, the eBPF program uses a Map lookup to determine that the data packet should be sent out from the physical service network card of this node. Through bpf_redirect, physical service network card ifindex,0, the data packet is sent to the underlying network. After arriving at the target node, the DVS eBPF program on the target node will look up the table again and finally deliver the data packet to the target VM. If the target VM is located in another cloud domain, DVS will not forward the data packet directly to the physical service network card, but will redirect the data packet to VEG for processing. DVS can use bpf_redirect,vegw_ifindex,0 to redirect the data packet to the dedicated virtual network card or internal interface of the virtual edge gateway for cross-cloud encapsulation and policy detection.

6. The dynamic networking method for distributed edge cloud as described in claim 5, characterized in that: The specific steps for implementing the Virtual Edge Gateway (VEG) using eBPF are as follows: 1) Cross-cloud access policy check: VEG's eBPF program parses the IP, MAC, protocol, and port in the packet header and matches them with cross-cloud access policy rules in the eBPF Map; 2) VXLAN tunnel encapsulation and peer selection: If the policy allows, VEG queries the target cloud node's internet IP address and tunnel information from the eBPF Map, and then encapsulates the data packets using VXLAN: When the remote VEG receives VXLAN packets, its eBPF program decapsulates the packets and redirects the decapsulated original Ethernet frame back to the DVS for final delivery to the target VM.

7. The dynamic networking method for distributed edge cloud as described in claim 6, characterized in that: In step 1), if the policy does not allow the packet to be transmitted across clouds, VEG will drop it by returning TC_ACT_SHOT directly in TC Hook or returning XDP_DROP in XDP, or by using bpf_redirect to direct the packet to a drop interface.

8. The dynamic networking method for distributed edge cloud as described in claim 6, characterized in that: In step 2), the eBPF kernel helper function is used to add a VXLAN header and outer UDP and IP headers to the packet header, and the checksum is updated using bpf_l3_csum_replace and bpf_l4_csum_replace. After encapsulation, the VXLAN encapsulated data packet is sent to the local node's Internet interface via the bpf_redirect Internet interface card ifindex,0, so that it can reach the VEG in the remote cloud domain through the public network and the corresponding VXLAN tunnel path.

9. The dynamic networking method for distributed edge cloud as described in claim 6, characterized in that: The information changes at this node include changes to the IP address of the node's Internet interface card, as well as changes to the virtual machine IP / MAC information caused by the cloud controller's creation, deletion, modification, and migration operations on virtual machines; and changes to the Internet IP address information and virtual machine IP / MAC information of the virtual network controller.

Images