Network traffic throttling control method and apparatus based on DPU

Abstract

The application provides a DPU-based network traffic flow control method and device. The method comprises the following steps: in a virtual switch in a data processor (DPU), a virtual switch flow control configuration command issued by a virtual switch agent unit corresponding to the DPU is received, and a target network traffic control strategy corresponding to the virtual switch is set based on the virtual switch flow control configuration command, wherein the virtual switch flow control configuration command is obtained by converting speed limit configuration data of a service mesh data plane by the virtual switch agent unit in advance; and network traffic speed control is performed on data packets transmitted to the DPU in the virtual switch according to the target network traffic control strategy. The application can unload network traffic flow control to hardware for execution without the need of an L4 TCP layer flow control filter of an Envoy agent, can effectively reduce CPU load, can improve the efficiency and reliability of network traffic flow control, and can significantly improve the overall performance and manageability of the network.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network traffic control and management, and particularly relates to a network traffic flow control method and device based on DPU. BACKGROUND

[0002] In modern data centers and high-performance computing networks, the management and control of network traffic become crucial. Although the traffic control strategy implemented by the Envoy software of the traditional service mesh is flexible, it may encounter performance bottlenecks in high-traffic and high-throughput environments. To overcome these bottlenecks, hardware offload technology emerges, which can offload part or all of the network data processing tasks to a dedicated DPU hardware, thereby improving performance and reducing latency.

[0003] A service mesh is an infrastructure layer designed to handle communication between microservices. It usually includes a data plane and a control plane. The data plane consists of proxies (such as Envoy), and the control plane is responsible for managing and configuring the proxies (such as Pilot of Istio). Envoy uses the xDS protocol to obtain dynamic configurations, including listeners (LDS), routes (RDS), clusters (CDS), and endpoints (EDS). Pilot, as a control plane component, issues these configurations through the xDS protocol. The L4 TCP layer throttling filter of Envoy is responsible for controlling traffic according to predefined policies and rate limits. When a data packet arrives at the Envoy proxy, the filter checks whether the set rate limit is exceeded and decides whether to pass or discard the data packet. L4 TCP layer throttling is implemented at the software level, and Envoy, as a user space proxy, performs L4 TCP layer throttling policies by intercepting and processing network traffic. In the existing service mesh architecture, the process of issuing xDS protocol (e.g., LDS, RDS, CDS, EDS) configurations to Envoy proxies through Pilot and using L4 TCP layer throttling filters for traffic control relies on CPU to perform complex checking and decision-making logic.

[0004] However, in the existing scheme, each data packet needs to be checked and processed by the L4 TCP layer throttling filter of the Envoy proxy, which introduces additional processing delay. Since Envoy runs in user space, the data packet needs to be context-switched between kernel space and user space, which further increases the delay. And the L4 TCP layer throttling policy needs to perform frequent rate checks and decisions, which are CPU-intensive operations, and may cause CPU load to increase, especially in high-traffic situations. SUMMARY

[0005] In view of this, the embodiments of the present application provide a DPU-based network traffic flow control method and device to eliminate or improve one or more defects in the prior art.

[0006] One aspect of the present application provides a DPU-based network traffic flow control method, comprising:

[0007] In a virtual switch in a data processor DPU, a virtual switch flow control configuration command issued by a virtual switch agent unit corresponding to the DPU is received, and a target network traffic control policy corresponding to the virtual switch is set based on the virtual switch flow control configuration command, wherein the virtual switch flow control configuration command is obtained by pre-converting rate limiting configuration data of a service mesh data plane by the virtual switch agent unit;

[0008] According to the target network traffic control policy, network traffic rate limiting control is performed on data packets transmitted to the DPU in the virtual switch.

[0009] In some embodiments of the present application, the rate limiting configuration data of the service mesh data plane is obtained by a virtual switch rate limiting coordinator from a service mesh data plane filter in advance, and a custom resource corresponding to the rate limiting configuration data is created;

[0010] The virtual switch rate limiting coordinator sends the custom resource corresponding to the rate limiting configuration data to the virtual switch agent unit.

[0011] In some embodiments of the present application, when or after the virtual switch agent unit receives the custom resource corresponding to the rate limiting configuration data, it determines whether the rate limiting configuration data in the custom resource belongs to the DPU corresponding to itself, and if so, converts the rate limiting configuration data into the virtual switch flow control configuration command for configuring the virtual switch in the DPU.

[0012] In some embodiments of the present application, the setting of the target network traffic control policy corresponding to the virtual switch based on the virtual switch flow control configuration command comprises:

[0013] According to the egress traffic control policy data corresponding to the virtual switch specified by the virtual switch flow control configuration command, quality of service configuration data and queue data are added to a preset interface corresponding to the virtual switch, respectively;

[0014] And, according to the ingress traffic control policy data corresponding to the virtual switch specified by the virtual switch flow control configuration command, interface data corresponding to the preset interface is set, so that the quality of service configuration data, the queue data and the interface data constitute the target network traffic control policy corresponding to the virtual switch.

[0015] In some embodiments of the present application, the egress traffic control policy data includes values of committed information rate (CIR), committed burst data maximum transmission (CBS), excess information rate (EIR), and excess burst data maximum transmission (EBS) respectively;

[0016] Correspondingly, the egress traffic control policy data corresponding to the virtual switch specified by the virtual switch traffic limiting configuration command is used to add quality of service (QoS) configuration data and queue data to the preset interface of the virtual switch respectively, including:

[0017] The QoS configuration entry and the queue table are added to the preset interface of the virtual switch, and the association between the QoS configuration table and the queue table is set;

[0018] The values of the CIR, CBS, EIR, and EBS respectively are added to the QoS configuration table and the queue table;

[0019] In the queue table, the service level identifier of the data packet is set.

[0020] In some embodiments of the present application, the ingress traffic control policy data includes the rate and size of the ingress traffic.

[0021] In some embodiments of the present application, the network traffic rate limiting control of the data packet transmitted to the DPU in the virtual switch according to the target network traffic control policy includes:

[0022] According to the values of the CIR, CBS, EIR, and EBS respectively recorded in the QoS configuration entry and the queue table, the data packet transmitted to the DPU in the virtual switch is initially marked and colored in a preset two-rate three-color marking manner, so as to obtain the corresponding mark of each data packet;

[0023] According to the corresponding mark of each data packet, the network traffic rate limiting control of each data packet is performed.

[0024] In some embodiments of the present application, the values of the committed information rate CIR, the committed burst data maximum transmission amount CBS, the excess information rate EIR and the excess burst data maximum transmission amount EBS are respectively marked in the virtual switch according to the preset two-rate three-color marking manner, to obtain the corresponding marking of each data packet, including:

[0025] The marking steps are performed in the initial marking stage and the colored marking stage of each data packet in the virtual switch according to the preset two-rate three-color marking manner.

[0026] The marking steps include:

[0027] If the current transmission rate of the data packet is less than or equal to the value of the committed information rate CIR, and the current transmission amount of the data packet is less than or equal to the value of the committed burst data maximum transmission amount CBS, the data packet is initially marked as green.

[0028] If the current transmission rate of the data packet is between the value of the committed information rate CIR and the value of the excess information rate EIR, or the current transmission amount of the data packet is between the value of the committed burst data maximum transmission amount CBS and the value of the excess burst data maximum transmission amount EBS, the data packet is initially marked as yellow.

[0029] If the current transmission rate of the data packet is greater than the value of the excess information rate EIR, and the current transmission amount of the data packet is greater than the value of the excess burst data maximum transmission amount EBS, the data packet is initially marked as red.

[0030] Another aspect of the present application provides a DPU-based network traffic flow control device, including:

[0031] A traffic control policy generation module is configured to receive a virtual switch flow control configuration command issued by a virtual switch agent unit corresponding to the DPU in a virtual switch in the data processor DPU, and set a target network traffic control policy corresponding to the virtual switch based on the virtual switch flow control configuration command, wherein the virtual switch flow control configuration command is obtained by converting the speed limit configuration data of the service mesh data plane by the virtual switch agent unit in advance.

[0032] A traffic speed control module is configured to control the network traffic speed of the data packet transmitted to the DPU in the virtual switch according to the target network traffic control policy.

[0033] The third aspect of the present application provides a computer readable storage medium, having stored thereon a computer program which, when executed by a processor, implements the DPU-based network traffic flow control method.

[0034] The fourth aspect of the present application provides a computer program product comprising a computer program which, when executed by a processor, implements the DPU-based network traffic flow control method.

[0035] The DPU-based network traffic flow control method provided by the present application receives a virtual switch flow control configuration command issued by a virtual switch agent unit corresponding to the DPU in the virtual switch in the data processor DPU, and sets a target network traffic control policy corresponding to the virtual switch based on the virtual switch flow control configuration command, wherein the virtual switch flow control configuration command is obtained by pre-converting the flow control configuration data of the service mesh data plane by the virtual switch agent unit; according to the target network traffic control policy, the network traffic flow control of the data packet transmitted to the DPU in the virtual switch is controlled, which can offload the network traffic flow control to the hardware for execution without the L4 TCP layer flow control filter of the Envoy agent, effectively reduce the CPU load, improve the efficiency and reliability of the network traffic flow control, and significantly improve the overall performance and manageability of the network.

[0036] Additional advantages, objects, and features of the application will be set forth in part by the description that follows, and will in part be apparent to those of ordinary skill in the art upon examination of the following or can be learned from a practice of the application. The advantages and objects of the application can be realized and attained by the structure particularly pointed out in the written description and claims hereof as well as the appended drawings.

[0037] It will be appreciated by persons skilled in the art that the objects and advantages of the application can not be limited to what has been specifically described hereinabove and a minimum of the above and other objects and advantages of the application can be learned by a fair study of the drawing and the accompanying description. BRIEF DESCRIPTION OF DRAWINGS

[0038] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the application and together with the description serve to explain the principles of the application. The components in the drawings are not necessarily to scale, emphasis instead being placed upon illustrating the principles of the application. For purposes of clarity and understanding, portions of some portions may have been exaggerated in some drawings, and portions of some portions may be shown in greatly simplified - form as compared to actual implementations, such as exemplary devices, of the application. In the drawings:

[0039] Figure 1A first flowchart of a DPU-based network traffic flow control method in an embodiment of the present application.

[0040] Figure 2 A second flowchart of a DPU-based network traffic flow control method in an embodiment of the present application.

[0041] Figure 3 A third flowchart of a DPU-based network traffic flow control method in an embodiment of the present application.

[0042] Figure 4 A structure diagram of a DPU-based network traffic flow control device in an embodiment of the present application.

[0043] Figure 5 A system architecture diagram of a DPU-based network traffic flow control method in an application example of the present application.

[0044] Figure 6 A two-rate three-color marking flowchart in an application example of the present application. DETAILED DESCRIPTION

[0045] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the embodiments and drawings. Herein, the illustrative embodiments of the present application and their descriptions are used to explain the present application, but not as a limitation of the present application.

[0046] It should be noted that, in order to avoid the present application being obscured by unnecessary details, only the structures and / or processing steps closely related to the solutions according to the present application are shown in the drawings, and other details not closely related to the present application are omitted.

[0047] It should be emphasized that the term "comprise / comprising" is used herein to mean that a feature, element, step or component is present, but not excluding the presence or addition of one or more other features, elements, steps or components.

[0048] It should be noted that, if not specifically stated, the term "connected" herein can not only mean direct connection, but also indirect connection with an intermediate object.

[0049] Hereinafter, the embodiments of the present application will be described with reference to the drawings. In the drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0050] To solve the technical defects of high latency and high CPU overhead of traditional service mesh through Envoy proxy for software-defined L4 TCP layer throttling in scenarios with high performance and low latency requirements, the embodiments of the present application respectively provide a DPU-based network traffic throttling control method, a DPU-based network traffic throttling control device for executing the DPU-based network traffic throttling control method, an entity device, a computer readable storage medium and a computer program product, which can solve the above technical problems through the rate limiting filter hardware offload of OVS.

[0051] The embodiments are specifically described as follows.

[0052] Based on this, the embodiments of the present application provide a DPU-based network traffic throttling control method that can be implemented by a DPU-based network traffic throttling control device, as shown in Figure 1 , the DPU-based network traffic throttling control method specifically includes the following contents:

[0053] Step 100: In a virtual switch in a data processor DPU, a virtual switch throttling configuration command issued by a virtual switch agent unit corresponding to the DPU is received, and a target network traffic control policy corresponding to the virtual switch is set based on the virtual switch throttling configuration command, wherein the virtual switch rate limiting configuration command is obtained by pre-converting rate limiting configuration data of a service mesh data plane by the virtual switch agent unit.

[0054] It should be noted that the DPU-based network traffic throttling control device is arranged in the virtual switch OVS of the data processor DPU, and can include a network traffic manager (tc policy) and a throttling filter (tc filter) in communication connection with each other, the network traffic manager (tc policy) is used to execute step 100, and the throttling filter (tc filter) is used to execute the following step 200.

[0055] Among them, the virtual switch agent unit (OVS Agent) pre-receives the rate limiting configuration data (OVS Ratelimiting) of the service mesh data plane (Envoy) sent by the service mesh data plane filter (Envoy Filter), and then converts the rate limiting configuration data of the service mesh data plane into a virtual switch rate limiting configuration command (OVS cmd), which is a L4 TCP layer throttling configuration command of the virtual switch OVS.

[0056] It can be understood that the data processor DPU (Data Processing Unit) is a processor specially used for network and storage acceleration, and is usually used in high-performance computing (HPC) and data centers. It can reduce the burden of the CPU, provide higher network throughput and lower latency.

[0057] The virtual switch OVS (OpenvSwitch) is a virtual switching software, mainly used in the virtual machine VM environment, as a virtual switch, supporting Xen / XenServer, KVM, and VirtualBox multiple virtualization technologies. In the virtualization environment of a certain machine, a virtual switch (vswitch) mainly has two functions: transmitting traffic between virtual machines VMs and realizing communication between the VMs and the outside network. It provides some important functions and drivers for VPP. VPP (Vector Packet Processor of FD.io) is a fast, scalable Layer 2-4 multi-platform network stack. It can run in the Linux user space of multiple architectures including x86, ARM, and Power architecture. As a high-performance and flexible virtual switch, the virtual switch OVS supports hardware offloading technology, and the virtual switch OVS can offload part of the network packet processing task to the hardware, thereby realizing more efficient traffic control.

[0058] In one or more embodiments of the present application, the target network traffic control policy refers to policy data for controlling the network traffic rate of the data packets transmitted into the DPU in the virtual switch, which may, for example, contain the respective values of the committed information rate CIR, the committed burst data maximum transmission amount CBS, the excess information rate EIR, the excess burst data maximum transmission amount EBS, the ingress departure traffic rate (ingress_policing_rate), and the ingress departure traffic size (ingress_policing_burst).

[0059] Among them, the committed information rate CIR (Committed Information Rate) represents the basic guaranteed rate of traffic. The committed burst data maximum transmission amount CBS (Committed Burst Size) refers to the maximum amount of data that the system promises to continuously transmit within a certain time. The excess information rate EIR (Excess Information Rate) represents the additional rate that the traffic is allowed to exceed under the condition of not exceeding the network capacity. The excess burst data maximum transmission amount EBS (Excess Burst Size) refers to the maximum burst data amount allowed to exceed the committed transmission rate.

[0060] Step 200: according to the target network traffic control policy, performing network traffic rate limiting control on the data packets transmitted into the DPU in the virtual switch.

[0061] That is, the control method provided by the embodiments of the present application can synchronously convert the rate limiting configuration of the original service mesh data plane filter (Envoy Filter) into the traffic control policy of OVS, and define which traffic needs to be limited by configuring the filter rules for OVS. The traffic control policy is configured, such as CIR (Committed Information Rate), EIR (Excess Information Rate), CBS (Committed Burst Size), and EBS (Excess Burst Size). These policies are implemented in hardware, making the data packet processing more efficient. The configured filter and traffic control policy are executed on a DPU device supporting hardware offloading. The DPU hardware limits the rate of traffic according to these policies, marks or discards packets exceeding the limit. Thus, efficient traffic limitation and management are achieved. This is particularly important in network environments that require high performance and low latency, and can significantly improve the overall performance and manageability of the network.

[0062] As can be seen from the above description, the DPU-based network traffic flow control method provided by the embodiments of the present application can offload network traffic flow control to hardware for execution based on the L4 TCP layer flow limiting filter of the Envoy proxy, which can effectively reduce CPU load and improve the efficiency and reliability of network traffic flow control, and can significantly improve the overall performance and manageability of the network.

[0063] In order to further improve the efficiency and reliability of the DPU-based network traffic flow control, in a DPU-based network traffic flow control method provided by an embodiment of the present application, the rate limiting configuration data (OVS Ratelimiting) of the service mesh data plane in the DPU-based network traffic flow control method is obtained from the service mesh data plane filter (Envoy Filter) by a virtual switch rate limiting reconciler (OVS Ratelimit Reconciler, which can also be abbreviated as Reconciler), and a custom resource (OVSRatelimiting CRD, or CRD for short) corresponding to the rate limiting configuration data (OVS Ratelimiting) is created.

[0064] The virtual switch rate limiting reconciler (OVS Ratelimit Reconciler) sends the custom resource (OVSRatelimiting CRD) corresponding to the rate limiting configuration data (OVS Ratelimiting) to the virtual switch agent unit (OVS Agent).

[0065] Specifically, a virtual switch rate limiting reconciler, which is communicatively connected between the service mesh data plane filter (EnvoyFilter) and the virtual switch agent unit (OVS Agent) respectively, can be created in advance in the system, so that the virtual switch rate limiting reconciler extracts match information according to the rate limiting filter of the native EnvoyFilter; queries the OVS database to find the preset interface (port) corresponding to the virtual switch; sets the CIR and other information of the virtual switch OVS according to the filtering value of the service mesh data plane filter (EnvoyFilter); and then creates a custom resource (OVSRatelimiting CRD) corresponding to the rate limiting configuration data (OVS Ratelimiting).

[0066] In order to further improve the application reliability and effectiveness of the virtual switch rate limiting configuration command generated by the virtual switch agent unit, in the network traffic rate limiting control method based on DPU provided in the embodiment of the present application, when or after the virtual switch agent unit receives the custom resource corresponding to the rate limiting configuration data, it judges whether the rate limiting configuration data in the custom resource belongs to the DPU corresponding to itself. If yes, the rate limiting configuration data is converted into the virtual switch rate limiting configuration command for configuring the virtual switch in the DPU.

[0067] Specifically, the virtual switch agent unit (OVS Agent) of the DPU obtains the custom resource (OVSRatelimiting CRD) corresponding to the rate limiting configuration data (OVS Ratelimiting), and then judges whether the CRD is a local configuration. If it is a local configuration, it is converted into the virtual switch rate limiting configuration command such as the L4 TCP layer rate limiting configuration command of OVS, and then is communicated and issued to the virtual switch OVS in the DPU through the interface (OVSDB socket) of the virtual switch database, and is received by the network traffic manager (tc policy) in the virtual switch OVS.

[0068] In order to further improve the application reliability and effectiveness of the virtual switch rate limiting configuration command setting the target network traffic control policy corresponding to the virtual switch, in the network traffic rate limiting control method based on DPU provided in the embodiment of the present application, referring to Figure 2 The step 100 in the network traffic rate limiting control method based on DPU specifically contains the following contents:

[0069] Step 110: receiving, in a virtual switch in the data processor DPU, a virtual switch rate limiting configuration command issued by a virtual switch agent unit corresponding to the DPU.

[0070] Step 120: adding, for a preset interface corresponding to the virtual switch, service quality configuration data and queue data according to the egress traffic control policy data corresponding to the virtual switch specified in the virtual switch rate limiting configuration command.

[0071] Step 130: setting interface data corresponding to the preset interface according to the ingress traffic control policy data corresponding to the virtual switch specified in the virtual switch rate limiting configuration command, so that the service quality configuration data, the queue data, and the interface data constitute a target network traffic control policy corresponding to the virtual switch.

[0072] Specifically, the service quality configuration data can be a quality of service Qos entry, i.e., a quality of service Qos table; the queue data can be a queue entry, i.e., a queue table, and the interface data is an interface entry.

[0073] To further improve the application reliability and effectiveness of the egress traffic control policy, in an embodiment of the application, the egress traffic control policy data specifically includes values corresponding to a committed information rate CIR, a committed burst data maximum transmission amount CBS, an excess information rate EIR, and an excess burst data maximum transmission amount EBS.

[0074] Correspondingly, referring to Figure 3 , step 120 in the DPU-based network traffic rate limiting control method specifically includes the following contents:

[0075] Step 121: adding a quality of service configuration entry and a queue table for a preset interface corresponding to the virtual switch, and setting an association between the quality of service configuration table and the queue table.

[0076] Step 122: adding values corresponding to the committed information rate CIR, the committed burst data maximum transmission amount CBS, the excess information rate EIR, and the excess burst data maximum transmission amount EBS in the quality of service configuration table and the queue table, respectively.

[0077] And, step 123: setting a service level identifier of a data packet in the queue table.

[0078] Specifically, a QoS entry can be added for a specific interface (port) first, as follows:

[0079] (1) Add a QoS entry on a specific port, set the L4 TCP layer throttling policy in the out direction, that is, the export traffic control policy.

[0080] (2) Set the queues field of the QoS entry to associate the QoS entry with the queue entry.

[0081] (3) Set other configurations in the QoS entry, mark L4 TCP layer throttling configurations such as CIR, CBS, EIR, and EBS.

[0082] On this basis, further add a queue entry for a specific port as follows:

[0083] (1) Add a queue entry on a specific port, set the L4 TCP layer throttling policy in the out direction.

[0084] (2) Set CIR, CBS, EBS, EIR, and other parameters in other_config.

[0085] (3) Set the DSCP of the queue: DSCP is a field in the IP header, used to identify the service level of the data packet.

[0086] Suppose a queue is created and the DSCP value is set to 46 (decimal), indicating the Expedited Forwarding (EF) service, which is usually used for high-priority real-time traffic such as voice or video traffic.

[0087] In order to further improve the application reliability and effectiveness of the ingress traffic control policy, in the network traffic throttling control method based on DPU provided in the embodiments of the present application, the ingress traffic control policy data includes: the rate and size of the ingress outgoing traffic.

[0088] Specifically, the size of the ingress outgoing traffic (ingress_policing_burst) and the rate of the ingress outgoing traffic (ingress_policing_rate) of a specific port are set as follows:

[0089] The size of the ingress outgoing traffic (ingress_policing_burst) and the rate of the ingress outgoing traffic (ingress_policing_rate) of the interface data (interface entry) of a specific port are set.

[0090] Then, before step 100, a tc filter can be added to the OVS and hardware offload is enabled, and then the packet priority of all protocols is set to 1 (higher priority), match all is used, and the configuration of the previously set rate limiting function is enabled to limit the rate and mark, discard, etc. of the packet through the hardware filter.

[0091] To further improve the efficiency and reliability of network traffic rate limiting control of the data packets transmitted into the DPU in the virtual switch, in an embodiment of the present application, a DPU-based network traffic rate limiting control method is provided, as shown in Figure 2 , the step 200 of the DPU-based network traffic rate limiting control method specifically includes the following content:

[0092] Step 210: According to the respective values of the committed information rate CIR, the committed burst data maximum transmission amount CBS, the excess information rate EIR and the excess burst data maximum transmission amount EBS corresponding to the service quality configuration item and the queue record, the initial marking and colored marking of the data packets transmitted into the DPU in the virtual switch are performed respectively in a preset two-rate three-color marking manner, to obtain the respective marking corresponding to each of the data packets.

[0093] Step 220: Network traffic rate limiting control is performed on each of the data packets according to the respective marking corresponding to each of the data packets.

[0094] Among them, the specific process of the two-rate three-color marking manner (RFC 4115trTCM) is that the virtual switch OVS performs RFC 4115trTCM marking (Two-Rate Three-Color Marker, double-rate three-color marking) according to the configuration of the quality of service (QoS) data and the queue (queue) data. Among them, the two-rate three-color marking manner (RFC 4115trTCM) is a double-rate, three-color marking flow control mechanism, commonly known as "Two-Rate Three-Color Marker (Two-Rate Three-Color Marker, trTCM)". It is a flow control-based mechanism for classifying and marking data packets in a network to achieve bandwidth management and flow control.

[0095] It can be understood that QoS (Quality of Service) is a database table of OVSDB, which is a data structure for managing and configuring flow control policies. It is usually used to define how to schedule and process network traffic to ensure appropriate priority and bandwidth allocation for different types of traffic (such as real-time streaming media, data download, control messages, etc.).

[0096] In order to improve the effectiveness and reliability of initial marking and color-aware marking of data packets transmitted into the DPU in the virtual switch in the preset two-rate three-color marking manner, in the DPU-based network traffic flow control method provided in the embodiment of the present application, referring to Figure 3 , the step 210 in the DPU-based network traffic flow control method specifically contains the following contents:

[0097] Step 211: performing preset marking steps in the initial marking stage and the color-aware marking stage of the data packets transmitted into the DPU in the virtual switch in the preset two-rate three-color marking manner; wherein, the marking steps include: if the current transmission rate of the data packet is less than or equal to the value of the committed information rate CIR, and the current transmission amount of the data packet is less than or equal to the value of the committed burst data maximum transmission amount CBS, the data packet is initially marked as green; if the current transmission rate of the data packet is between the value of the committed information rate CIR and the value of the excess information rate EIR, or the current transmission amount of the data packet is between the value of the committed burst data maximum transmission amount CBS and the value of the excess burst data maximum transmission amount EBS, the data packet is initially marked as yellow; if the current transmission rate of the data packet is greater than the value of the excess information rate EIR, and the current transmission amount of the data packet is greater than the value of the excess burst data maximum transmission amount EBS, the data packet is initially marked as red.

[0098] Specifically, the specific process of marking the data packet by the two-rate three-color marking manner through two-stage marking process is as follows:

[0099] (1) Stage One: Color-Blind Marking:

[0100] Preliminary marking of traffic according to CIR and CBS (committed burst size).

[0101] If the data packet is within the CIR and CBS limit, it is marked as green.

[0102] If the data packet exceeds the CIR and CBS limit but is within the EIR and EBS (excess burst size), it is marked as yellow.

[0103] If the data packet exceeds the EIR and EBS limit, it is marked as red.

[0104] (2) Stage Two: Color-Aware Marking:

[0105] Further adjustment of marking based on the previous color-blind marking result.

[0106] If the data packet previously marked green is still within the CIR and CBS limits, remain green.

[0107] If the data packet previously marked yellow is within the EIR and EBS limits, remain yellow, otherwise mark red.

[0108] Based on this, in step 220, the DPU hardware performs traffic limiting, that is, performs L4 TCP layer throttling, finally, the DPU hardware limits the rate of traffic according to the policy, marks or discards data packets exceeding the limit, realizes efficient traffic limiting and management, and improves the overall performance and manageability of the network.

[0109] These steps combine the capabilities of software and hardware, and can realize efficient traffic control by coordinating OVS and DPU in a container orchestration system (Kubernetes) cluster environment.

[0110] From the software level, the application also provides a DPU-based network traffic throttling control device for executing all or part of the DPU-based network traffic throttling control method, see Figure 4 , the DPU-based network traffic throttling control device specifically includes the following contents:

[0111] The traffic control policy generation module 10 is configured to receive a virtual switch throttling configuration command issued by a virtual switch agent unit corresponding to the DPU in the virtual switch in the data processor DPU, and set a target network traffic control policy corresponding to the virtual switch based on the virtual switch throttling configuration command, wherein the virtual switch rate limiting configuration command is obtained by converting rate limiting configuration data of a service mesh data plane by the virtual switch agent unit in advance.

[0112] The traffic rate limiting control module 20 is configured to perform network traffic rate limiting control on data packets transmitted to the DPU in the virtual switch according to the target network traffic control policy.

[0113] The embodiments of the DPU-based network traffic throttling control device provided by the application can be specifically used to execute the processing flow of the embodiments of the DPU-based network traffic throttling control method described above, and the functions thereof will not be repeated here, and the detailed description can be referred to the detailed description of the above-mentioned embodiments of the DPU-based network traffic throttling control method.

[0114] The part of the DPU-based network traffic flow control device performing DPU-based network traffic flow control can be completed in a server or a client device. Specifically, it can be selected according to the processing capability of the client device and the limitation of the user's use scenario. The present application does not limit this. If all operations are completed in the client device, the client device can also include a processor for specific processing of the DPU-based network traffic flow control device.

[0115] The client device described above can have a communication module (i.e., a communication unit) that can be in communication connection with a remote server to realize data transmission with the server. The server can include a server on the task scheduling center side, and in other implementation scenarios, it can also include a server of an intermediate platform, such as a server of a third-party server platform that is in communication link with the task scheduling center server. The server can include a single computer device, or a server cluster composed of multiple servers, or a server structure of a distributed device.

[0116] The server and the client device can use any suitable network protocol to communicate, including a network protocol that has not been developed as of the filing date of the present application. The network protocol can include, for example, a TCP / IP protocol, a UDP / IP protocol, an HTTP protocol, an HTTPS protocol, etc. Of course, the network protocol can also include, for example, a RPC protocol (Remote Procedure Call Protocol) used on the basis of the above-mentioned protocols, a REST protocol (Representational State Transfer), etc.

[0117] As can be seen from the above description, the DPU-based network traffic flow control device provided by the embodiments of the present application can unload network traffic flow control to hardware for execution without going through the L4 TCP layer flow filter of the Envoy proxy, which can effectively reduce CPU load, improve the efficiency and reliability of network traffic flow control, and significantly improve the overall performance and manageability of the network.

[0118] In order to further illustrate the above-mentioned embodiments, the present application also provides an application example of a DPU-based network traffic flow control method, which uses DPU hardware to realize four-layer flow control function of a service mesh. The DPU-based network traffic flow control method can be implemented by the architecture as shown in Figure 5 The specific contents include the following:

[0119] S1: The network of one service container group PodA and another service container group PodB is changed from the original green line (envoy software L4 TCP layer limiting) to the red line (ovs hardware L4 TCP layer limiting). The traffic out of PodA no longer enters the software L4 TCP layer limiting filter of the envoy outbound, but enters the DPU OVS on the same node of the envoy for L4 layer hardware egress L4 TCP layer limiting filtering. The traffic entering PodB used to enter the envoy inbound for decode judgment software L4 TCP layer limiting filter, and now enters the DPU OVS of the opposite node (node) for L4 layer hardware ingress L4 TCP layer limiting filtering.

[0120] Among them, the container group Pod is the smallest deployment unit of Kubernetes, which is the encapsulation of containers and provides some shared resources and contexts. The data plane development kit (DPDK) is an open source software project managed by the Linux Foundation. It provides a set of data plane libraries and network interface controller polling mode drivers for offloading TCP packet processing from the operating system kernel to processes running in user space. This offloading can achieve higher computing efficiency and higher packet throughput than using the interrupt-driven processing provided in the kernel.

[0121] S2: Add DPU service mesh OVS rate limiting controller (Reconciler). The Reconciler extracts match information according to the rate limiting filter corresponding to the original service mesh filter (Envoy Filter), queries the OVS database to find the corresponding interface (port), and sets the committed data transmission rate CIR and other information of the OVS according to the filtering value of the rate limiting filter. A virtual switch rate limiting custom resource (OVS Ratelimiting CRD (Custom Resource Definition)) is created to add the above information to the k8s cluster.

[0122] S3: The virtual switch agent unit (OVS Agent) of the data processor DPU acquires the virtual switch rate limiting custom resource (OVS Ratelimiting CRD), judges whether it belongs to the local DPU configuration, and if so, converts it into a L4 TCP layer limiting configuration command of the virtual switch OVS, communicates through the virtual switch database communication interface (ovsdb socket), and issues the L4 TCP layer limiting configuration command to the virtual switch in the DPU, which is specifically as follows:

[0123] A specific port adds a QoS entry to set the L4 TCP layer throttling policy in the out direction:

[0124] a) Set the queues field to associate the queue table;

[0125] b) Set other configurations (other_config) to mark L4 TCP layer throttling configurations such as committed information rate (CIR), committed burst size (CBS), excess information rate (EIR), and excess burst size (EBS).

[0126] Wherein the content of the QoS table is shown in Table 1:

[0127] Table 1: QoS table

[0128]

[0129]

[0130] S4: Add a queue entry to a specific port to set the L4 TCP layer throttling policy in the out direction:

[0131] a) Set the other configurations (other_config) of the queue entry: Set cir cbs ebseir parameters in other configurations.

[0132] b) Set the service level identification (DSCP) of the queue entry: DSCP is a field in the IP header that identifies the service level of the packet. It is part of the Differentiated Services (DiffServ) model, which is used to implement Quality of Service (QoS) control. DSCP is part of the "Differentiated Services" field in the IP header, using 6 bits to represent the priority and processing requirements of the packet. It defines 64 possible service levels. Differentiated Services is a network traffic management method that allows network devices to classify and manage packets based on DSCP values to achieve priority scheduling and bandwidth allocation for different service levels. Suppose you want to create a queue and set the DSCP value to 46 (decimal), indicating Expedited Forwarding (EF) service, which is usually used for high-priority real-time traffic such as voice or video traffic.

[0133] Wherein the content of the queue table is shown in Table 2:

[0134] Table 2: queue table

[0135]

[0136]

[0137] Where DSCP description is shown in Table 3:

[0138] Table 3: DSCP description

[0139]

[0140]

[0141] S5: Set the burst size of ingress policing for the interface entry of port. And ingress policing rate: the rate of ingress policing.

[0142] S6: Add filter to OVS and start hardware offload: Set the priority of all protocol packets to 1 (higher priority), use match all, so that the configuration of the previously set rate limiting function is limited by the hardware filter. Packet marking, discarding, etc.

[0143] S7: OVS performs RFC4115 trTCM marking (Two-Rate Three-Color Marker) according to the configuration in the QoS and queue config. The trTCM marking process is performed by OVS software when the packet passes, according to the pre-configured QoS policy. The two-rate three-color marking is shown in Table 4:

[0144] Table 4 Two-rate three-color marking

[0145]

[0146] Specifically, referring to Figure 6 , the process of trTCM marking packets through a two-stage marking process is as follows:

[0147] (1) Color-Blind Marking: First, the traffic is preliminarily marked according to CIR and CBS (committed burst size):

[0148] If the packet is within the CIR and CBS limit, it is marked green.

[0149] If the packet exceeds the CIR and CBS limit, but is within the EIR and EBS (excess burst size), it is marked yellow.

[0150] If the packet exceeds the EIR and EBS limit, it is marked red.

[0151] (2) Color-Aware Marking: Then, further adjust the marking based on the previous colorless marking result:

[0152] If the data packet previously marked as green is still within the CIR and CBS limits, keep green.

[0153] If the data packet previously marked as yellow is within the EIR and EBS limits, keep yellow, otherwise mark as red.

[0154] S8: Finally, the DPU hardware rate limits the traffic according to the policy, marks or drops the data packets exceeding the limit. Thus, efficient traffic limiting and management are achieved. This is particularly important in network environments requiring high performance and low latency, which can significantly improve the overall performance and manageability of the network.

[0155] Based on this, the application changes the traditional service mesh software L4 TCP layer throttling method to use DPU technology, reduces the delay and CPU overhead of software processing through hardware accelerated packet processing and L4 TCP layer throttling. Since the DPU is designed to efficiently perform specific network tasks, this hardware unit can usually complete matching and forwarding actions in a single clock cycle, much higher than the processing efficiency of general-purpose CPUs. Specialized hardware can often handle multiple data streams in parallel without the need for context switching between multiple tasks like CPUs. And the DPU hardware often adopts pipeline design, which can process different data packets in different pipeline stages in parallel, further improving the processing efficiency.

[0156] The embodiment of the application also provides an electronic device, which can include a processor, a memory, a receiver and a transmitter, the processor is used to execute the DPU-based network traffic throttling control method mentioned in the above embodiment, wherein the processor and the memory can be connected through a bus or other means, taking the bus connection as an example. The receiver can be connected with the processor and the memory through wired or wireless means.

[0157] The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. chips, or combinations of the above various chips.

[0158] The memory, as a non-transitory computer readable storage medium, can be configured to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the DPU-based network traffic flow control method in the embodiments of the present application. The processor can execute various functions and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory, that is, implement the DPU-based network traffic flow control method in the above method embodiments.

[0159] The memory can include a program storage area and a data storage area, wherein the program storage area can store an operating system and application programs required by at least one function; and the data storage area can store data created by the processor and the like. In addition, the memory can include a high-speed random access memory, and can also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state memory device. In some embodiments, the memory can optionally include a memory remotely arranged with respect to the processor, and these remote memories can be connected to the processor through a network. Examples of the above network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0160] The one or more modules are stored in the memory and, when executed by the processor, perform the DPU-based network traffic flow control method in the embodiments.

[0161] In some embodiments of the present application, a user equipment can include a processor, a memory and a transceiver unit which can include a receiver and a transmitter, the processor, the memory, the receiver and the transmitter can be connected through a bus system, the memory is configured to store computer instructions, and the processor is configured to execute the computer instructions stored in the memory to control the transceiver unit to transceive signals.

[0162] As an implementation manner, the functions of the receiver and the transmitter in the present application can be implemented by considering a transceiver circuit or a transceiver dedicated chip, and the processor can be implemented by considering a dedicated processing chip, a processing circuit or a general-purpose chip.

[0163] As another implementation manner, the server provided by the embodiments of the present application can be implemented by considering using a general-purpose computer. That is, program codes for implementing the functions of the processor, the receiver and the transmitter are stored in the memory, and the general-purpose processor implements the functions of the processor, the receiver and the transmitter by executing the codes in the memory.

[0164] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the steps of the foregoing DPU-based network traffic flow control method. The computer readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0165] The embodiments of the present application also provide a computer program product, which contains a computer program. The computer program is executed by a processor to implement the steps of the foregoing DPU-based network traffic flow control method.

[0166] Those skilled in the art should understand that all the exemplary components, systems and methods described in connection with the embodiments disclosed herein can be implemented or realized in hardware, software or a combination thereof. The particular implementation is dependent on the specific application and design constraints imposed on the overall system. Skilled persons can use various methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a functional card, etc. When implemented in software, the elements of the present application are program or code segments used to perform the required tasks. The program or code segments can be stored in a machine readable medium or transmitted through a data signal carried in a carrier wave in a transmission medium or communication link.

[0167] It should be noted that the present application is not limited to the specific configurations and processes described above and shown in the drawings. For the sake of brevity, detailed descriptions of well-known methods are omitted. In the above embodiments, several specific steps are described and shown as examples. However, the method processes of the present application are not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order of the steps, after understanding the spirit of the present application.

[0168] In the present application, the features described and / or illustrated for one embodiment can be used in the same way or in a similar way in one or more other embodiments, and / or in combination with or instead of features of other embodiments.

[0169] The above descriptions are only the preferred embodiments of the present application, and are not intended to limit the present application. The embodiments of the present application can be variously changed and modified by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the scope of protection of the present application.

Claims

1. A network traffic limiting control method based on DPU, characterized in that, include: Within the virtual switch in the data processor (DPU), a virtual switch rate limiting configuration command is received from the virtual switch agent unit corresponding to the DPU. Based on the virtual switch rate limiting configuration command, the target network traffic control policy corresponding to the virtual switch is set. The virtual switch rate limiting configuration command is obtained in advance by the virtual switch agent unit after converting the rate limiting configuration data of the service mesh data plane. According to the target network traffic control policy, network traffic rate limiting control is performed on data packets transmitted to the DPU within the virtual switch; The rate limiting configuration data for the service mesh data plane is pre-obtained from the service mesh data plane filter by the virtual switch rate limiting coordinator, and a custom resource corresponding to the rate limiting configuration data is created. The virtual switch rate limiting coordinator sends the custom resource corresponding to the rate limiting configuration data to the virtual switch agent unit. When the virtual switch agent unit receives the custom resource corresponding to the rate limiting configuration data, it determines whether the rate limiting configuration data in the custom resource belongs to its own DPU. If so, it converts the rate limiting configuration data into a virtual switch rate limiting configuration command for configuring the virtual switch in the DPU.

2. The network traffic limiting control method based on DPU according to claim 1, characterized in that, The step of setting the target network traffic control policy corresponding to the virtual switch based on the virtual switch rate limiting configuration command includes: Based on the outbound traffic control policy data of the virtual switch specified by the virtual switch rate limiting configuration command, add quality of service configuration data and queue data to the preset interface of the virtual switch respectively. Furthermore, based on the ingress traffic control policy data corresponding to the virtual switch specified by the virtual switch rate limiting configuration command, interface data corresponding to the preset interface is set, so that the quality of service configuration data, queue data, and interface data constitute the target network traffic control policy corresponding to the virtual switch.

3. The network traffic limiting control method based on DPU according to claim 2, characterized in that, The outbound flow control strategy data includes the values ​​of the Committed Information Rate (CIR), Committed Burst Data Maximum Transmission (CBS), Excess Information Rate (EIR), and Excess Burst Data Maximum Transmission (EBS). Correspondingly, according to the outbound traffic control policy data of the virtual switch specified by the virtual switch rate limiting configuration command, service quality configuration data and queue data are added to the preset interfaces corresponding to the virtual switch, including: Add a Quality of Service (QoS) configuration entry and a queue list to the preset interface corresponding to the virtual switch, and associate the QoS configuration table with the queue list; Add the corresponding values ​​of the Committed Information Rate (CIR), Committed Burst Data Size (CBS), Excess Information Rate (EIR), and Excess Burst Data Size (EBS) to the Quality of Service (QoS) configuration table and the queue list, respectively. Additionally, a service level identifier for the data packet is set in the queue list.

4. The network traffic limiting control method based on DPU according to claim 2, characterized in that, The ingress flow control strategy data includes the rate and magnitude of the ingress outgress flow.

5. The network traffic limiting control method based on DPU according to claim 3, characterized in that, The step of performing network traffic rate limiting control on data packets transmitted to the DPU within the virtual switch according to the target network traffic control policy includes: Based on the service quality configuration entries and the values ​​of the committed information rate (CIR), committed burst data volume (CBS), excess information rate (EIR), and excess burst data volume (EBS) recorded in the queue list, the data packets transmitted to the DPU are initially marked and colored in the virtual switch using a preset two-rate three-color marking method to obtain the corresponding mark for each data packet. Network traffic rate limiting is applied to each data packet based on its corresponding tag.

6. The network traffic limiting control method based on DPU according to claim 5, characterized in that, The steps involve, based on the service quality configuration entries and the values ​​corresponding to the Committed Information Rate (CIR), Committed Burst Data Size (CBS), Excess Information Rate (EIR), and Excess Burst Data Size (EBS) recorded in the queue list, performing initial and colored marking on the data packets transmitted to the DPU within the virtual switch using a preset two-rate, three-color marking method to obtain the marking corresponding to each data packet, including: In the virtual switch, preset marking steps are performed on the initial marking stage and the colored marking stage corresponding to the data packets transmitted to the DPU, respectively, using a preset two-rate three-color marking method. The marking step includes: If the current transmission rate of the data packet is less than or equal to the value of the Committed Information Rate (CIR), and the current transmission volume of the data packet is less than or equal to the value of the Committed Burst Data Maximum (CBS), then the data packet is initially marked as green. If the current transmission rate of the data packet is between the value of the Committed Information Rate (CIR) and the value of the Excess Information Rate (EIR), or if the current transmission amount of the data packet is between the value of the Committed Burst Data Maximum (CBS) and the value of the Excess Burst Data Maximum (EBS), then the data packet is initially marked as yellow. If the current transmission rate of the data packet is greater than the value of the Excess Information Rate (EIR) and the current transmission volume of the data packet is greater than the value of the Excess Burst Data Maximum (EBS), then the data packet is initially marked as red.

7. A network traffic limiting control device based on DPU, characterized in that, include: The traffic control policy generation module is used to receive a virtual switch rate limiting configuration command issued by the virtual switch agent unit corresponding to the DPU within the virtual switch in the data processor DPU, and to set the target network traffic control policy corresponding to the virtual switch based on the virtual switch rate limiting configuration command. The virtual switch rate limiting configuration command is obtained in advance by the virtual switch agent unit after converting the rate limiting configuration data of the service mesh data plane. The traffic rate limiting control module is used to perform network traffic rate limiting control on data packets transmitted to the DPU within the virtual switch according to the target network traffic control policy. The rate limiting configuration data for the service mesh data plane is pre-obtained from the service mesh data plane filter by the virtual switch rate limiting coordinator, and a custom resource corresponding to the rate limiting configuration data is created. The virtual switch rate limiting coordinator sends the custom resource corresponding to the rate limiting configuration data to the virtual switch agent unit. When the virtual switch agent unit receives the custom resource corresponding to the rate limiting configuration data, it determines whether the rate limiting configuration data in the custom resource belongs to its own DPU. If so, it converts the rate limiting configuration data into a virtual switch rate limiting configuration command for configuring the virtual switch in the DPU.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the DPU-based network traffic limiting control method as described in any one of claims 1 to 6.

Images