Network flow limiting control method and device based on DPU

Abstract

The invention provides a network flow limiting control method and device based on a DPU (Data Processing Unit), and the method comprises the steps: receiving a virtual switch flow limiting configuration command transmitted by a virtual switch agent unit corresponding to the DPU in a virtual switch in the DPU, setting a target network flow control strategy corresponding to the virtual switch based on the virtual switch flow-limiting configuration command, wherein the virtual switch speed-limiting flow-limiting configuration command is obtained by converting speed-limiting configuration data of a service grid data plane by a virtual switch proxy unit in advance; and according to the target network flow control strategy, performing network flow speed-limiting control on the data packet transmitted to the DPU in the virtual switch. According to the method and the device, the network flow limiting control can be unloaded to hardware to be executed on the basis of not passing through the L4TCP layer flow limiting filter of an Envoy agent, so that the CPU load can be effectively reduced, the efficiency and the reliability of the network flow limiting control can be improved, and the overall performance and the manageability of the network can be remarkably improved.

Description

Technical Field

[0001] The present application relates to the field of network traffic control and management technology, and in particular to a DPU-based network traffic limiting control method and device. Background Art

[0002] In modern data centers and high-performance computing networks, the management and control of network traffic has become critical. Although the traffic control policies implemented by the Envoy software of traditional service meshes are flexible, they may encounter performance bottlenecks in high-traffic and high-throughput environments. To overcome these bottlenecks, hardware offload technology has emerged, which can offload part or all of the network data processing tasks to dedicated DPU hardware, thereby improving performance and reducing latency.

[0003] A service mesh is an infrastructure layer designed to handle communication between microservices. It typically includes a data plane and a control plane. The data plane consists of proxies (such as Envoy), and the control plane is responsible for managing and configuring proxies (such as Istio's Pilot). Envoy uses the xDS protocol to obtain dynamic configurations, including listeners (LDS), routes (RDS), clusters (CDS), and endpoints (EDS). Pilot, as a control plane component, delivers these configurations through the xDS protocol. Envoy's L4 TCP layer flow limiting filter is responsible for controlling traffic according to predefined policies and rate limits. When a packet arrives at the Envoy proxy, the filter checks whether it exceeds the set rate limit and decides whether to pass or drop the packet. L4 TCP layer flow limiting is implemented at the software level. Envoy, as a user space proxy, enforces the L4 TCP layer flow limiting policy by intercepting and processing network traffic. In the existing service mesh architecture, the process of sending xDS protocol (for example: LDS, RDS, CDS, EDS) configuration to the Envoy proxy through Pilot and using L4 TCP layer current limiting filter for flow control relies on the CPU to execute complex inspection and decision logic.

[0004] However, in the existing solution, each data packet needs to be inspected and processed by the L4 TCP layer flow limiting filter of the Envoy proxy, which introduces additional processing delays. Since Envoy runs in user space, data packets need to be context-switched between kernel space and user space, which further increases latency. In addition, the L4 TCP layer flow limiting policy requires frequent rate checks and decisions, which are CPU-intensive and may increase CPU load, especially in high-traffic situations. Summary of the invention

[0005] In view of this, the embodiments of the present application provide a DPU-based network traffic limiting control method and device to eliminate or improve one or more defects existing in the prior art.

[0006] One aspect of the present application provides a DPU-based network traffic limiting control method, including:

[0007] In a virtual switch in a data processor DPU, a virtual switch current limiting configuration command issued by a virtual switch agent unit corresponding to the DPU is received, and a target network traffic control policy corresponding to the virtual switch is set based on the virtual switch current limiting configuration command, wherein the virtual switch speed limiting and current limiting configuration command is obtained in advance by the virtual switch agent unit after converting the speed limiting configuration data of the service grid data plane;

[0008] According to the target network traffic control policy, network traffic rate limiting control is performed on the data packets transmitted to the DPU in the virtual switch.

[0009] In some embodiments of the present application, the rate limit configuration data of the service mesh data plane is obtained in advance by the virtual switch rate limit coordinator from the service mesh data plane filter, and a custom resource corresponding to the rate limit configuration data is created;

[0010] The virtual switch rate limit coordinator sends the custom resource corresponding to the rate limit configuration data to the virtual switch agent unit.

[0011] In some embodiments of the present application, when or after receiving the custom resource corresponding to the speed limit configuration data, the virtual switch agent unit determines whether the speed limit configuration data in the custom resource belongs to the DPU corresponding to itself. If so, the speed limit configuration data is converted into the virtual switch current limiting configuration command for configuring the virtual switch in the DPU.

[0012] In some embodiments of the present application, the step of setting a target network traffic control policy corresponding to the virtual switch based on the virtual switch current limiting configuration command includes:

[0013] According to the egress flow control policy data corresponding to the virtual switch specified by the virtual switch current limiting configuration command, adding service quality configuration data and queue data to the preset interfaces corresponding to the virtual switch respectively;

[0014] And, according to the inlet flow control policy data corresponding to the virtual switch specified by the virtual switch current limiting configuration command, the interface data corresponding to the preset interface is set, so that the quality of service configuration data, queue data and the interface data constitute the target network flow control policy corresponding to the virtual switch.

[0015] In some embodiments of the present application, the egress flow control policy data includes: values ​​corresponding to a committed information rate CIR, a committed burst data maximum transmission amount CBS, an excess information rate EIR, and an excess burst data maximum transmission amount EBS;

[0016] Correspondingly, the export flow control policy data corresponding to the virtual switch specified by the virtual switch current limiting configuration command respectively adds the quality of service configuration data and queue data for the preset interface corresponding to the virtual switch, including:

[0017] Adding a quality of service configuration entry and a queue table for a preset interface corresponding to the virtual switch, and setting an association between the quality of service configuration table and the queue table;

[0018] Add the values ​​corresponding to the committed information rate CIR, the committed burst data maximum transmission amount CBS, the excess information rate EIR and the excess burst data maximum transmission amount EBS to the service quality configuration table and the queue table respectively;

[0019] And, setting a service level identifier of the data packet in the queue table.

[0020] In some embodiments of the present application, the inlet traffic control strategy data includes: the rate and size of the inlet departure traffic.

[0021] In some embodiments of the present application, the network traffic rate limiting control of the data packets transmitted to the DPU in the virtual switch according to the target network traffic control policy includes:

[0022] According to the corresponding values ​​of the committed information rate CIR, the committed burst data maximum transmission amount CBS, the excess information rate EIR, and the excess burst data maximum transmission amount EBS recorded in the quality of service configuration entry and the queue table, the data packets transmitted to the DPU are respectively initially marked and colored marked in the virtual switch in a preset two-rate three-color marking manner to obtain the corresponding marks of each of the data packets;

[0023] The network traffic speed limit control is performed on each of the data packets according to the mark corresponding to each of the data packets.

[0024] In some embodiments of the present application, the data packets transmitted to the DPU are respectively initially marked and colored marked in the virtual switch in a preset two-rate three-color marking manner according to the corresponding values ​​of the committed information rate CIR, the committed burst data maximum transmission amount CBS, the excess information rate EIR, and the excess burst data maximum transmission amount EBS recorded in the quality of service configuration entry and the queue table, so as to obtain the marks corresponding to each of the data packets, including:

[0025] Performing preset marking steps in the virtual switch in the initial marking phase and the colored marking phase respectively corresponding to the data packets transmitted to the DPU in a preset two-rate three-color marking manner;

[0026] Wherein, the marking step comprises:

[0027] If the current transmission rate of the data packet is less than or equal to the value of the committed information rate CIR, and the current transmission volume of the data packet is less than or equal to the value of the committed burst data maximum transmission volume CBS, the data packet is preliminarily marked as green;

[0028] If the current transmission rate of the data packet is between the value of the committed information rate CIR and the value of the excess information rate EIR, or the current transmission volume of the data packet is between the value of the committed burst data maximum transmission volume CBS and the value of the excess burst data maximum transmission volume EBS, the data packet is preliminarily marked as yellow;

[0029] If the current transmission rate of the data packet is greater than the value of the excess information rate EIR, and the current transmission volume of the data packet is greater than the value of the maximum transmission volume of excess burst data EBS, the data packet is preliminarily marked as red.

[0030] Another aspect of the present application provides a network traffic flow limiting control device based on a DPU, comprising:

[0031] A flow control strategy generation module is used to receive, in a virtual switch in a data processor DPU, a virtual switch current limiting configuration command issued by a virtual switch agent unit corresponding to the DPU, and set a target network flow control strategy corresponding to the virtual switch based on the virtual switch current limiting configuration command, wherein the virtual switch speed limiting and current limiting configuration command is obtained in advance by the virtual switch agent unit after converting the speed limiting configuration data of the service grid data plane;

[0032] The traffic rate limiting control module is used to perform network traffic rate limiting control on data packets transmitted to the DPU in the virtual switch according to the target network traffic control policy.

[0033] The third aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the DPU-based network traffic limiting control method.

[0034] The fourth aspect of the present application provides a computer program product, including a computer program, which implements the DPU-based network traffic limiting control method when executed by a processor.

[0035] The DPU-based network traffic flow limiting control method provided in the present application receives, in a virtual switch in a data processor DPU, a virtual switch flow limiting configuration command issued by a virtual switch agent unit corresponding to the DPU, and sets a target network traffic control policy corresponding to the virtual switch based on the virtual switch flow limiting configuration command, wherein the virtual switch speed and flow limiting configuration command is obtained in advance by the virtual switch agent unit after converting the speed limit configuration data of the service grid data plane; according to the target network traffic control policy, network traffic speed limiting control is performed on the data packets transmitted to the DPU in the virtual switch, and the network traffic flow limiting control can be offloaded to the hardware for execution without passing through the L4 TCP layer flow limiting filter of the Envoy agent, which can effectively reduce the CPU load, improve the efficiency and reliability of the network traffic flow limiting control, and significantly improve the overall performance and manageability of the network.

[0036] Additional advantages, purposes, and features of the present application will be partially described in the following description, and will become partially apparent to those skilled in the art after studying the following, or may be learned from the practice of the present application. The purposes and other advantages of the present application can be achieved and obtained by the structures specifically pointed out in the specification and the drawings.

[0037] Those skilled in the art will understand that the purposes and advantages that can be achieved by the present application are not limited to the above specific description, and the above and other purposes that can be achieved by the present application will be more clearly understood based on the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The drawings described herein are used to provide a further understanding of the present application, constitute a part of the present application, and do not constitute a limitation of the present application. The components in the drawings are not drawn to scale, but are only for the purpose of illustrating the principles of the present application. In order to facilitate the illustration and description of some parts of the present application, the corresponding parts in the drawings may be enlarged, that is, they may become larger relative to other components in the exemplary device actually manufactured according to the present application. In the drawings:

[0039] Figure 1This is a first flow chart of a DPU-based network traffic limiting control method in an embodiment of the present application.

[0040] Figure 2 This is a second flow chart of a DPU-based network traffic limiting control method in an embodiment of the present application.

[0041] Figure 3 This is a third flow chart of a DPU-based network traffic limiting control method in an embodiment of the present application.

[0042] Figure 4 This is a schematic diagram of the structure of a DPU-based network traffic limiting control device in one embodiment of the present application.

[0043] Figure 5 This is a schematic diagram of the system architecture for implementing a DPU-based network traffic limiting control method in an application example of the present application.

[0044] Figure 6 This is a schematic diagram of a two-rate three-color marking process in an application example of the present application. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the implementation modes and the accompanying drawings. Here, the illustrative implementation modes and descriptions of the present application are used to explain the present application, but are not intended to limit the present application.

[0046] It should also be noted here that in order to avoid obscuring the present application due to unnecessary details, only the structures and / or processing steps closely related to the scheme according to the present application are shown in the accompanying drawings, while other details that are not very relevant to the present application are omitted.

[0047] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0048] It should also be noted that, unless otherwise specified, the term “connection” herein may refer not only to a direct connection but also to an indirect connection involving an intermediate.

[0049] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0050] In order to solve the technical shortcomings of high latency and high CPU overhead of the traditional service grid using the Envoy proxy to perform software-defined L4 TCP layer flow limiting in scenarios with high performance and low latency requirements, the embodiments of the present application respectively provide a DPU-based network traffic flow limiting control method, a DPU-based network traffic flow limiting control device for executing the DPU-based network traffic flow limiting control method, a physical device, a computer-readable storage medium and a computer program product, which can solve the above technical problems by hardware unloading of the OVS rate limiting filter.

[0051] The details are described in detail through the following examples.

[0052] Based on this, the embodiment of the present application provides a DPU-based network traffic flow limiting control method that can be implemented by a DPU-based network traffic flow limiting control device, see Figure 1 The DPU-based network traffic limiting control method specifically includes the following contents:

[0053] Step 100: In the virtual switch in the data processor DPU, a virtual switch current limiting configuration command issued by a virtual switch agent unit corresponding to the DPU is received, and a target network traffic control policy corresponding to the virtual switch is set based on the virtual switch current limiting configuration command, wherein the virtual switch speed limiting and current limiting configuration command is obtained in advance by the virtual switch agent unit after converting the speed limiting configuration data of the service grid data plane.

[0054] It should be noted that the DPU-based network traffic limiting control device is set in the virtual switch OVS of the data processor DPU, and may include a network traffic manager (tc policy) and a limiting filter (tc filter) that are communicatively connected to each other. The network traffic manager (tc policy) is used to execute step 100, and the limiting filter (tc filter) is used to execute the following step 200.

[0055] The virtual switch agent unit (OVS Agent) pre-receives the rate limiting configuration data (OVS Ratelimiting) of the service mesh data plane (Envoy) sent by the service mesh data plane filter (Envoy Filter), and then converts the rate limiting configuration data of the service mesh data plane into a virtual switch rate limiting and current limiting configuration command (OVS cmd), which is an L4 TCP layer current limiting configuration command of the virtual switch OVS.

[0056] It is understandable that the data processor DPU (Data Processing Unit) is a processor dedicated to network and storage acceleration, which is usually used in high-performance computing (HPC) and data centers. It can reduce the burden of the CPU and provide higher network throughput and lower latency.

[0057] The virtual switch OVS (OpenvSwitch) is a virtual switching software, mainly used in virtual machine VM environments. As a virtual switch, it supports multiple virtualization technologies such as Xen / XenServer, KVM, and VirtualBox. In such a virtualized environment of a certain machine, a virtual switch (vswitch) has two main functions: passing traffic between virtual machines VM and realizing communication between VM and the external network. It provides some important functions and drivers for VPP. VPP (FD.io's Vector Packet Processor) is a fast, scalable layer 2-4 multi-platform network stack. It can run in the Linux user space of multiple architectures including x86, ARM and Power architectures. As a high-performance and flexible virtual switch, the virtual switch OVS supports hardware offload technology. The virtual switch OVS can offload some network packet processing tasks to the hardware, thereby achieving more efficient traffic control.

[0058] In one or more embodiments of the present application, the target network traffic control policy refers to policy data used to perform network traffic speed limit control on data packets transmitted to the DPU within the virtual switch, and may include, for example, the corresponding values ​​of the committed information rate CIR, the committed maximum burst data transmission amount CBS, the excess information rate EIR, the maximum excess burst data transmission amount EBS, as well as the rate of ingress departure traffic (ingress_policing_rate) and the size of ingress departure traffic (ingress_policing_burst).

[0059] Among them, the committed information rate (CIR) indicates the basic guaranteed rate of traffic. The committed burst size (CBS) refers to the maximum amount of data that the system promises to transmit continuously within a certain period of time. The excess information rate (EIR) indicates the additional rate at which traffic can be transmitted without exceeding the network capacity. The excess burst size (EBS) refers to the maximum amount of burst data allowed to exceed the committed transmission rate.

[0060] Step 200: According to the target network traffic control policy, network traffic rate limit control is performed on the data packets transmitted to the DPU in the virtual switch.

[0061] That is to say, the control method provided in the embodiment of the present application can synchronously convert the speed limit configuration of the filter (Envoy Filter) of the original service grid data plane into the flow control policy of OVS, and define which flows need to be flow-limited by configuring filter rules for OVS. Configure flow control policies such as CIR (committed information rate), EIR (excess information rate), CBS (committed burst size), and EBS (excess burst size). These policies will be implemented in hardware to make data packet processing more efficient. The configured filters and flow control policies will be executed on DPU devices that support hardware offloading. The DPU hardware limits the flow rate according to these policies, and marks or discards data packets that exceed the limit. Thereby achieving efficient flow limitation and management. This is particularly important in network environments that require high performance and low latency, and can significantly improve the overall performance and manageability of the network.

[0062] From the above description, it can be seen that the DPU-based network traffic limiting control method provided in the embodiment of the present application can offload the network traffic limiting control to the hardware for execution without passing through the L4 TCP layer limiting filter of the Envoy agent, which can effectively reduce the CPU load, and can improve the efficiency and reliability of the network traffic limiting control, and can significantly improve the overall performance and manageability of the network.

[0063] In order to further improve the efficiency and reliability of DPU-based network traffic limiting control, in a DPU-based network traffic limiting control method provided in an embodiment of the present application, the rate limiting configuration data (OVS Ratelimiting) of the service grid data plane in the DPU-based network traffic limiting control method is obtained in advance by the virtual switch rate limiting coordinator (OVS Ratelimit Reconciler, also abbreviated as Reconciler) from the service grid data plane filter (Envoy Filter), and a custom resource (OVSRatelimiting CRD, or abbreviated as CRD) corresponding to the rate limiting configuration data (OVS Ratelimiting) is created;

[0064] The virtual switch rate limit coordinator (OVS Ratelimit Reconciler) sends the custom resource (OVSRatelimiting CRD) corresponding to the rate limit configuration data (OVS Ratelimiting) to the virtual switch agent unit (OVS Agent).

[0065] Specifically, a virtual switch rate limit coordinator (OVSRatelimit Reconciler) that is respectively communicated with the service grid data plane filter (EnvoyFilter) and the virtual switch agent unit (OVS Agent) can be created in advance in the system, so that the virtual switch rate limit coordinator extracts matching information (match information) according to the rate limit filter of the native EnvoyFilter; queries the OVS database to find the preset interface (port) corresponding to the virtual switch; sets the CIR and other information of the virtual switch OVS according to the filtering value of the service grid data plane filter (Envoy Filter); and then creates a custom resource (OVSRatelimiting CRD) corresponding to the rate limit configuration data (OVS Ratelimiting).

[0066] In order to further improve the application reliability and effectiveness of the virtual switch current limiting configuration command generated by the virtual switch agent unit, in a DPU-based network traffic current limiting control method provided in an embodiment of the present application, the virtual switch agent unit determines whether the speed limit configuration data in the custom resource belongs to the DPU corresponding to itself when or after receiving the custom resource corresponding to the speed limit configuration data. If so, the speed limit configuration data is converted into the virtual switch current limiting configuration command for configuring the virtual switch in the DPU.

[0067] Specifically, the virtual switch agent unit (OVS Agent) of the DPU obtains the custom resource (OVSRatelimiting CRD) corresponding to the rate limit configuration data (OVSRatelimiting), and then determines whether the CRD belongs to the local configuration. If it is a local configuration, it converts it into the virtual switch current limiting configuration command such as the L4 TCP layer current limiting configuration command of OVS, and then sends it to the virtual switch OVS in the DPU through the interface (OVSDB socket) of the virtual switch database, and is received by the network traffic manager (tc policy) in the virtual switch OVS.

[0068] In order to further improve the application reliability and effectiveness of the target network traffic control strategy corresponding to the virtual switch set based on the virtual switch current limiting configuration command, in a network traffic current limiting control method based on DPU provided in an embodiment of the present application, see Figure 2 , step 100 in the DPU-based network traffic limiting control method specifically includes the following contents:

[0069] Step 110: In a virtual switch in a data processor DPU, a virtual switch current limiting configuration command issued by a virtual switch agent unit corresponding to the DPU is received.

[0070] Step 120: According to the egress flow control policy data corresponding to the virtual switch specified by the virtual switch current limiting configuration command, add service quality configuration data and queue data to the preset interfaces corresponding to the virtual switch.

[0071] Step 130: According to the inlet flow control policy data corresponding to the virtual switch specified by the virtual switch current limiting configuration command, set the interface data corresponding to the preset interface, so that the quality of service configuration data, queue data and the interface data constitute the target network flow control policy corresponding to the virtual switch.

[0072] Specifically, the quality of service configuration data may be a quality of service Qos entry, that is, a quality of service Qos table; the queue data may be a queue entry, that is, a queue table; and the interface data may be an interface entry.

[0073] In order to further improve the application reliability and effectiveness of the export traffic control strategy, in a DPU-based network traffic limiting control method provided in an embodiment of the present application, the export traffic control strategy data specifically includes: the corresponding values ​​of the committed information rate CIR, the committed maximum burst data transmission amount CBS, the excess information rate EIR, and the excess burst data maximum transmission amount EBS.

[0074] For the corresponding Figure 3 , step 120 in the DPU-based network traffic limiting control method specifically includes the following contents:

[0075] Step 121: Add a quality of service configuration entry and a queue table for a preset interface corresponding to the virtual switch, and set an association between the quality of service configuration table and the queue table.

[0076] Step 122: Add the corresponding values ​​of the committed information rate CIR, the committed burst data maximum transmission amount CBS, the excess information rate EIR and the excess burst data maximum transmission amount EBS to the service quality configuration table and the queue table respectively.

[0077] And, step 123: setting the service level identifier of the data packet in the queue table.

[0078] Specifically, you can first add a QoS entry for a specific interface (port) as follows:

[0079] (1) Add a QoS entry on a specific interface (port) and set the L4 TCP layer flow limiting policy in the outbound direction, that is, the egress traffic control policy.

[0080] (2) Set the queues field of the QoS entry to associate the QoS entry with the queue entry.

[0081] (3) Set other configurations (other_config) in the QoS entry and mark the L4 TCP layer current limiting configurations such as CIR, CBS, EIR, and EBS.

[0082] On this basis, further add queue entries for specific interfaces (ports) as follows:

[0083] (1) Add a queue entry to a specific port and set the L4 TCP layer current limiting policy in the outbound direction.

[0084] (2) Set CIR, CBS, EBS, EIR and other parameters in other_config.

[0085] (3) Set the DSCP of the queue: DSCP is a field in the IP header that is used to identify the service level of the data packet.

[0086] Assume that a queue is created and the DSCP value is set to 46 (decimal), indicating the Expedited Forwarding (EF) service, which is usually used for high-priority real-time traffic, such as voice or video traffic.

[0087] In order to further improve the application reliability and effectiveness of the inlet traffic control strategy, in a DPU-based network traffic limiting control method provided in an embodiment of the present application, the inlet traffic control strategy data includes: the rate and size of the inlet departure traffic.

[0088] Specifically, set the size of the ingress traffic (ingress_policing_burst) and the rate of the ingress traffic (ingress_policing_rate) for a specific interface (port) as follows:

[0089] Set the size of the ingress traffic (ingress_policing_burst) and the rate of the ingress traffic (ingress_policing_rate) in the interface data (interface entry) of a specific interface (port).

[0090] Then, before step 100, a flow limiting filter (tc filter) may be added to OVS and hardware offloading may be enabled. Then, the packet priority of all protocols may be set to 1 (higher priority), and match all may be used, so that the previously set speed limiting function configuration may be limited, marked, and discarded through the hardware filter.

[0091] In order to further improve the efficiency and reliability of network traffic rate limiting control of data packets transmitted to the DPU in the virtual switch, in a network traffic rate limiting control method based on DPU provided in an embodiment of the present application, see Figure 2 , step 200 in the DPU-based network traffic limiting control method specifically includes the following contents:

[0092] Step 210: According to the corresponding values ​​of the committed information rate CIR, the committed maximum burst data transmission size CBS, the excess information rate EIR and the excess burst data maximum transmission size EBS recorded in the quality of service configuration entry and the queue table, the data packets transmitted to the DPU are respectively initially marked and colored marked in the virtual switch in a preset two-rate three-color marking manner to obtain the corresponding marks of each of the data packets.

[0093] Step 220: Perform network traffic speed limit control on each of the data packets according to the tags corresponding to each of the data packets.

[0094] The specific process of the two-rate three-color marking method (RFC 4115trTCM) is as follows: the virtual switch OVS performs RFC 4115trTCM marking (Two-Rate Three-Color Marker, two-rate three-color marking) according to the configuration of the quality of service (QoS) data and queue data. Among them, the two-rate three-color marking method (RFC 4115trTCM) is a two-rate, three-color marking flow control mechanism, commonly known as "Two-Rate Three-Color Marker (Two-Rate Three-ColorMarker, trTCM)". It is a flow control-based mechanism used to classify and mark data packets in the network to achieve bandwidth management and flow control.

[0095] It is understandable that QoS (Quality of Service) is a data structure used to manage and configure traffic control policies in the OVSDB database table. It is usually used to define how to schedule and process network traffic to ensure appropriate priority and bandwidth allocation for different types of traffic (such as real-time streaming, data downloads, control messages, etc.).

[0096] In order to ensure the effectiveness and reliability of respectively performing initial marking and colored marking on the data packets transmitted to the DPU in the virtual switch in a preset two-rate three-color marking manner, in a DPU-based network traffic flow limiting control method provided in an embodiment of the present application, see Figure 3 , step 210 in the DPU-based network traffic limiting control method specifically includes the following contents:

[0097] Step 211: Perform preset marking steps in the virtual switch for the initial marking phase and the colored marking phase corresponding to the data packets transmitted to the DPU in a preset two-rate three-color marking method; wherein the marking steps include: if the current transmission rate of the data packet is less than or equal to the value of the committed information rate CIR, and the current transmission volume of the data packet is less than or equal to the value of the committed burst data maximum transmission volume CBS, then the data packet is preliminarily marked as green; if the current transmission rate of the data packet is between the value of the committed information rate CIR and the value of the excess information rate EIR, or the current transmission volume of the data packet is between the value of the committed burst data maximum transmission volume CBS and the value of the excess burst data maximum transmission volume EBS, then the data packet is preliminarily marked as yellow; if the current transmission rate of the data packet is greater than the value of the excess information rate EIR, and the current transmission volume of the data packet is greater than the value of the excess burst data maximum transmission volume EBS, then the data packet is preliminarily marked as red.

[0098] Specifically, the two-rate three-color marking method marks packets through a two-level marking process as follows:

[0099] (1) Stage 1: Color-Blind Marking:

[0100] Traffic is initially marked based on CIR and CBS (committed burst size).

[0101] If the packet is within the CIR and CBS limits, it is marked green.

[0102] If a packet exceeds the CIR and CBS limits, but is within the EIR and EBS (excess burst size), it is marked in yellow.

[0103] If the packet exceeds the EIR and EBS limits, it is marked in red.

[0104] (2) Stage 2: Color-Aware Marking:

[0105] Based on the previous colorless marking results, further adjust the marking.

[0106] If a packet previously marked green is still within the CIR and CBS limits, it remains green.

[0107] If the packet previously marked as yellow is within the EIR and EBS limits, it remains yellow, otherwise it is marked red.

[0108] Based on this, in step 220, the DPU hardware performs flow limitation, that is, performs L4 TCP layer flow limitation. Finally, the DPU hardware limits the flow rate according to the policy, marks or discards the data packets that exceed the limit, realizes efficient flow limitation and management, and improves the overall performance and manageability of the network.

[0109] These steps combine the capabilities of software and hardware to achieve efficient traffic control by coordinating OVS and DPU in a container orchestration system (Kubernetes) cluster environment.

[0110] From the software level, the present application also provides a DPU-based network traffic flow limiting control device for executing all or part of the DPU-based network traffic flow limiting control method, see Figure 4 The DPU-based network traffic flow limiting control device specifically includes the following contents:

[0111] The flow control policy generation module 10 is used to receive, in the virtual switch in the data processor DPU, a virtual switch current limiting configuration command issued by a virtual switch agent unit corresponding to the DPU, and set a target network flow control policy corresponding to the virtual switch based on the virtual switch current limiting configuration command, wherein the virtual switch speed limiting and current limiting configuration command is obtained in advance by the virtual switch agent unit after converting the speed limiting configuration data of the service grid data plane.

[0112] The traffic rate limiting control module 20 is used to perform network traffic rate limiting control on the data packets transmitted to the DPU in the virtual switch according to the target network traffic control policy.

[0113] The embodiment of the DPU-based network traffic limiting control device provided in the present application can be specifically used to execute the processing flow of the embodiment of the DPU-based network traffic limiting control method in the above-mentioned embodiment. Its functions will not be repeated here, and reference can be made to the detailed description of the above-mentioned DPU-based network traffic limiting control method embodiment.

[0114] The DPU-based network traffic flow limiting control device performs the DPU-based network traffic flow limiting control part in the server or client device. It can be selected according to the processing capacity of the client device and the limitations of the user's usage scenario. This application is not limited to this. If all operations are completed in the client device, the client device may also include a processor for specific processing of the DPU-based network traffic flow limiting control device.

[0115] The client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission with the server. The server may include a server on the task scheduling center side, and other implementation scenarios may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, or a server cluster consisting of multiple servers, or a server structure of a distributed device.

[0116] The server and the client device may communicate with each other using any suitable network protocol, including network protocols that have not yet been developed on the date of filing this application. The network protocols may include, for example, TCP / IP, UDP / IP, HTTP, HTTPS, etc. Of course, the network protocols may also include, for example, RPC (Remote Procedure Call Protocol) and REST (Representational State Transfer) protocols used on top of the above protocols.

[0117] From the above description, it can be seen that the DPU-based network traffic limiting control device provided in the embodiment of the present application can offload the network traffic limiting control to the hardware for execution on the basis of the L4 TCP layer limiting filter without passing through the Envoy agent, which can effectively reduce the CPU load, and can improve the efficiency and reliability of the network traffic limiting control, and can significantly improve the overall performance and manageability of the network.

[0118] To further illustrate the above embodiment, the present application also provides an application example of a network traffic flow limiting control method based on a DPU, which uses DPU hardware to implement the four-layer flow limiting function of the service grid. The network traffic flow limiting control method based on the DPU can be implemented as follows: Figure 5 The architecture implementation shown includes the following:

[0119] S1: The network between one business container group PodA and another business container group PodB changes from the original green line (envoy software L4 TCP layer current limiting) to the red line (ovs hardware L4 TCP layer current limiting). The outgoing traffic of PodA no longer enters the outbound software L4 TCP layer current limiting filter of envoy, but enters the DPU OVS on the same node as envoy for L4 layer hardware egress L4 TCP layer current limiting filtering. Before entering PodB, it was necessary to enter the inbound of envoy for decoding judgment software L4 TCP layer current limiting filter, but now it enters the DPU OVS of the opposite node for L4 layer hardware ingress L4 TCP layer current limiting filtering.

[0120] Among them, the container group Pod is the smallest deployment unit of Kubernetes. It is the encapsulation of the container and provides some shared resources and contexts. The Data Plane Development Kit (DPDK) is an open source software project managed by the Linux Foundation. It provides a set of data plane libraries and network interface controller polling mode drivers for offloading TCP packet processing from the operating system kernel to processes running in user space. This offloading can achieve higher computing efficiency and higher packet throughput than using interrupt-driven processing provided in the kernel.

[0121] S2: Add the DPU service mesh OVS rate limiting controller (Reconciler). Reconciler extracts match information based on the rate limiting filter corresponding to the native service mesh filter (Envoy Filter), queries the OVS database to find the corresponding interface (port), and sets the OVS committed data transmission rate CIR and other information based on the filtering value of the rate limiting filter. Create a virtual switch rate limiting custom resource (OVS Ratelimiting CRD (Custom Resource Definition)) to add the above information to the k8s cluster.

[0122] S3: The virtual switch agent unit (OVS Agent) of the data processor DPU obtains the virtual switch rate limit custom resource (OVSRatelimiting CRD) and determines whether it belongs to the local DPU configuration. If so, it converts it into the L4 TCP layer current limiting configuration command of the virtual switch OVS, and communicates through the virtual switch database communication interface (ovsdb socket) to send the L4TCP layer current limiting configuration command to the virtual switch in the DPU. The details are as follows:

[0123] Add a QoS entry to a specific interface (port) and set the L4 TCP layer current limiting policy in the outbound direction:

[0124] a) Set the queues field and associate the queue table;

[0125] b) Set other configurations (other_config) and mark the L4 TCP layer current limiting configurations such as committed information rate CIR, committed burst data transmission capacity CBS, excess information rate EIR, and excess burst data transmission capacity EBS.

[0126] The contents of the QoS table are shown in Table 1:

[0127] Table 1: QoS table

[0128]

[0129]

[0130] S4: Add a queue entry to a specific port and set the L4 TCP layer current limiting policy in the outbound direction:

[0131] a) Set other configurations of queue entries (other_config): Set parameters such as cir, cbs, ebseir, etc. in other configurations.

[0132] b) Set the service level identifier DSCP of the packet of the queue entry: DSCP is a field in the IP header that is used to identify the service level of the data packet. It is part of the Differentiated Services (DiffServ) model and is used to implement Quality of Service (QoS) control. DSCP is part of the "Differentiated Services" field in the IP header and uses 6 bits to indicate the priority and processing requirements of the data packet. It defines 64 possible service levels. Differentiated services is a network traffic management method that allows network devices to classify and manage data packets based on DSCP values ​​to achieve priority scheduling and bandwidth allocation for different service levels. Suppose you want to create a queue and set the DSCP value to 46 (decimal), indicating the Expedited Forwarding (EF) service, which is typically used for high-priority real-time traffic such as voice or video traffic.

[0133] The contents of the queue table are shown in Table 2:

[0134] Table 2: queue table

[0135]

[0136]

[0137] The DSCP description is shown in Table 3:

[0138] Table 3: DSCP Description

[0139]

[0140]

[0141] S5: Set the ingress_policing_burst in the interface entry of the port to set the ingress policing burst size and ingress_policing_rate: the ingress policing rate.

[0142] S6: Add a filter to OVS and enable hardware offloading: Set the packet priority of all protocols to 1 (higher priority), use global matching (matchall), so that the previously set speed limit function configuration can be limited through the hardware filter and packet marking, discarding, etc.

[0143] S7: OVS performs RFC4115 trTCM marking (Two-Rate Three-Color Marker) according to the configuration in the QoS and queue config. The trTCM marking process is performed by the OVS software according to the pre-configured QoS policy when the data packet passes. The two-rate three-color marking is shown in Table 4:

[0144] Table 4 Two-rate three-color marking

[0145]

[0146] Specifically, see Figure 6 ,The process of trTCM marking packets through a two-level marking process is as follows:

[0147] (1) Color-Blind Marking: First, the traffic is preliminarily marked based on CIR and CBS (committed burst size):

[0148] If the packet is within the CIR and CBS limits, it is marked green.

[0149] If a packet exceeds the CIR and CBS limits, but is within the EIR and EBS (Excess Burst Size), it is marked in yellow.

[0150] If a packet exceeds the EIR and EBS limits, it is marked in red.

[0151] (2) Color-Aware Marking: Then, based on the previous colorless marking results, further adjust the marking:

[0152] If a packet previously marked green is still within the CIR and CBS limits, it remains green.

[0153] If the packet previously marked as yellow is within the EIR and EBS limits, it remains yellow, otherwise it is marked red.

[0154] S8: Finally, the DPU hardware limits the traffic rate according to the policy, and marks or discards packets that exceed the limit. This enables efficient traffic limitation and management. This is particularly important in network environments that require high performance and low latency, and can significantly improve the overall performance and manageability of the network.

[0155] Based on this, the application example of this application changes the traditional service grid's software L4 TCP layer current limiting method to use DPU technology, which reduces software processing delays and CPU overhead through hardware accelerated packet processing and L4 TCP layer current limiting. Since the DPU is designed to efficiently perform specific network tasks, this hardware unit can usually complete matching and forwarding actions within a single clock cycle, which is much more efficient than the processing efficiency of a general-purpose CPU. Dedicated hardware is usually able to process multiple data streams in parallel without the need to perform context switching between multiple tasks like a CPU. And DPU hardware often adopts a pipeline design, which can process different data packets in parallel at different pipeline stages, further improving processing efficiency.

[0156] The embodiment of the present application also provides an electronic device, which may include a processor, a memory, a receiver and a transmitter, wherein the processor is used to execute the DPU-based network traffic limiting control method mentioned in the above embodiment, wherein the processor and the memory may be connected via a bus or other means, such as by bus connection. The receiver may be connected to the processor and the memory via wired or wireless means.

[0157] The processor may be a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0158] As a non-transient computer-readable storage medium, the memory can be used to store non-transient software programs, non-transient computer executable programs and modules, such as the program instructions / modules corresponding to the DPU-based network traffic flow limiting control method in the embodiment of the present application. The processor executes various functional applications and data processing of the processor by running the non-transient software programs, instructions and modules stored in the memory, that is, the DPU-based network traffic flow limiting control method in the above method embodiment is implemented.

[0159] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0160] The one or more modules are stored in the memory, and when executed by the processor, perform the DPU-based network traffic limiting control method in the embodiment.

[0161] In some embodiments of the present application, the user equipment may include a processor, a memory, and a transceiver unit, which may include a receiver and a transmitter. The processor, memory, receiver, and transmitter may be connected through a bus system. The memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to send and receive signals.

[0162] As an implementation method, the functions of the receiver and the transmitter in the present application can be considered to be implemented through a transceiver circuit or a dedicated chip for transceiver, and the processor can be considered to be implemented through a dedicated processing chip, a processing circuit or a general chip.

[0163] As another implementation method, it is possible to use a general-purpose computer to implement the server provided in the embodiment of the present application, that is, to store the program code for implementing the functions of the processor, receiver, and transmitter in a memory, and the general-purpose processor implements the functions of the processor, receiver, and transmitter by executing the code in the memory.

[0164] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the aforementioned DPU-based network traffic flow limiting control method are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0165] An embodiment of the present application also provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of the aforementioned DPU-based network traffic limiting control method.

[0166] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is specifically performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0167] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0168] In the present application, features described and / or illustrated for one embodiment may be used in the same manner or in a similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.

[0169] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the embodiments of the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A network traffic limiting control method based on DPU, characterized in that: include: In a virtual switch in a data processor DPU, a virtual switch current limiting configuration command issued by a virtual switch agent unit corresponding to the DPU is received, and a target network traffic control policy corresponding to the virtual switch is set based on the virtual switch current limiting configuration command, wherein the virtual switch speed limiting and current limiting configuration command is obtained by converting the speed limiting configuration data of the service mesh data plane by the virtual switch agent unit in advance; According to the target network traffic control policy, network traffic rate limiting control is performed on the data packets transmitted to the DPU in the virtual switch.

2. The DPU-based network traffic limiting control method according to claim 1 is characterized in that: The rate limit configuration data of the service grid data plane is obtained in advance by the virtual switch rate limit coordinator from the service grid data plane filter, and a custom resource corresponding to the rate limit configuration data is created; The virtual switch rate limit coordinator sends the custom resource corresponding to the rate limit configuration data to the virtual switch agent unit.

3. The DPU-based network traffic limiting control method according to claim 2 is characterized in that: When or after receiving the custom resource corresponding to the speed limit configuration data, the virtual switch agent unit determines whether the speed limit configuration data in the custom resource belongs to the DPU corresponding to itself. If so, the speed limit configuration data is converted into the virtual switch current limiting configuration command for configuring the virtual switch in the DPU.

4. The DPU-based network traffic limiting control method according to claim 1 is characterized in that: The step of setting a target network traffic control policy corresponding to the virtual switch based on the virtual switch current limiting configuration command includes: According to the egress flow control policy data corresponding to the virtual switch specified by the virtual switch current limiting configuration command, adding service quality configuration data and queue data to the preset interfaces corresponding to the virtual switch respectively; And, according to the inlet flow control policy data corresponding to the virtual switch specified by the virtual switch current limiting configuration command, the interface data corresponding to the preset interface is set, so that the quality of service configuration data, queue data and the interface data constitute the target network flow control policy corresponding to the virtual switch.

5. The DPU-based network traffic limiting control method according to claim 4 is characterized in that: The egress flow control strategy data includes: the values ​​corresponding to the committed information rate CIR, the committed burst data maximum transmission amount CBS, the excess information rate EIR, and the excess burst data maximum transmission amount EBS; Correspondingly, the export flow control policy data corresponding to the virtual switch specified by the virtual switch current limiting configuration command respectively adds the quality of service configuration data and queue data for the preset interface corresponding to the virtual switch, including: Adding a quality of service configuration entry and a queue table for a preset interface corresponding to the virtual switch, and setting an association between the quality of service configuration table and the queue table; Add the values ​​corresponding to the committed information rate CIR, the committed burst data maximum transmission amount CBS, the excess information rate EIR and the excess burst data maximum transmission amount EBS to the service quality configuration table and the queue table respectively; And, setting a service level identifier of the data packet in the queue table.

6. The DPU-based network traffic limiting control method according to claim 4 is characterized in that: The inlet flow control strategy data includes: the rate and size of the inlet departure flow.

7. The DPU-based network traffic limiting control method according to claim 5 is characterized in that: The performing network traffic speed limit control on the data packets transmitted to the DPU in the virtual switch according to the target network traffic control strategy includes: According to the corresponding values ​​of the committed information rate CIR, the committed burst data maximum transmission amount CBS, the excess information rate EIR, and the excess burst data maximum transmission amount EBS recorded in the quality of service configuration entry and the queue table, the data packets transmitted to the DPU are respectively initially marked and colored marked in the virtual switch in a preset two-rate three-color marking manner to obtain the corresponding marks of each of the data packets; The network traffic speed limit control is performed on each of the data packets according to the mark corresponding to each of the data packets.

8. The DPU-based network traffic limiting control method according to claim 7 is characterized in that: The method of performing initial marking and colored marking on the data packets transmitted to the DPU in the virtual switch in a preset two-rate three-color marking manner according to the values ​​corresponding to the committed information rate CIR, the committed burst data maximum transmission amount CBS, the excess information rate EIR, and the excess burst data maximum transmission amount EBS recorded in the quality of service configuration entry and the queue table, respectively, to obtain the marks corresponding to the respective data packets, including: Performing preset marking steps in the virtual switch in the initial marking phase and the colored marking phase respectively corresponding to the data packets transmitted to the DPU in a preset two-rate three-color marking manner; Wherein, the marking step comprises: If the current transmission rate of the data packet is less than or equal to the value of the committed information rate CIR, and the current transmission volume of the data packet is less than or equal to the value of the committed burst data maximum transmission volume CBS, the data packet is preliminarily marked as green; If the current transmission rate of the data packet is between the value of the committed information rate CIR and the value of the excess information rate EIR, or the current transmission volume of the data packet is between the value of the committed burst data maximum transmission volume CBS and the value of the excess burst data maximum transmission volume EBS, the data packet is preliminarily marked as yellow; If the current transmission rate of the data packet is greater than the value of the excess information rate EIR, and the current transmission volume of the data packet is greater than the value of the maximum transmission volume of excess burst data EBS, the data packet is preliminarily marked as red.

9. A network traffic flow limiting control device based on DPU, characterized in that: include: A flow control strategy generation module is used to receive, in a virtual switch in a data processor DPU, a virtual switch current limiting configuration command issued by a virtual switch agent unit corresponding to the DPU, and set a target network flow control strategy corresponding to the virtual switch based on the virtual switch current limiting configuration command, wherein the virtual switch speed limiting and current limiting configuration command is obtained in advance by the virtual switch agent unit after converting the speed limiting configuration data of the service grid data plane; The traffic rate limiting control module is used to perform network traffic rate limiting control on data packets transmitted to the DPU in the virtual switch according to the target network traffic control policy.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the DPU-based network traffic limiting control method as described in any one of claims 1 to 8 is implemented.

Images