Communication configuration method, device and medium based on DPU centralized service mesh

Abstract

The application relates to a communication configuration method and device based on a DPU centralized service grid and a medium, in particular to the technical field of centralized service grids. The application is applied to a client node, the client node comprises a client host and a client data processing unit (DPU), the client host deploys a client preset adaptation component, and the client DPU deploys a client data plane agent; the method comprises the following steps: the client preset adaptation component receives a key discovery service request sent by the client data plane agent, generates a certificate signature request and sends the certificate signature request to a server control plane component, so that the server control plane component issues a client certificate; the client preset adaptation component receives the client certificate; and after the client preset adaptation component performs format conversion on the client certificate, the client preset adaptation component sends the client certificate to the client data plane agent, so that the client data plane agent performs bidirectional transport layer security communication by using the client certificate.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of centralized service mesh, in particular to a communication configuration method, device and medium based on DPU centralized service mesh, and a computer program product for implementing the communication configuration method based on DPU centralized service mesh. BACKGROUND

[0002] The DPU centralized service mesh deploys a service mesh data plane (Envoy) to the system on a chip (SOC) side of a data processing unit (DPU), and uses an application container engine (Docker) to isolate containers, which are separated from the host side service cluster (Kubernetes) environment. The DPU does not occupy host resources, thereby improving the number of microservice deployments on the host side; in addition, the DPU can directly process traffic without sending it to the host, thereby greatly improving network latency and forwarding efficiency. However, the traditional DPU centralized service mesh scheme has the problems of poor security, such as not supporting encrypted communication, lacking identity verification, and not meeting the zero-trust security model, and cannot meet the high requirements of modern cloud-native applications for security. SUMMARY

[0003] In order to solve the above technical problems or at least partially solve the above technical problems, the present application provides a communication configuration method, device and medium based on DPU centralized service mesh, which can improve the security of communication, support encrypted communication, and meet the zero-trust security model.

[0004] In order to achieve the above purpose, the technical scheme provided by the embodiments of the present application is as follows:

[0005] In a first aspect, the present application provides a communication configuration method based on DPU centralized service mesh, applied to a client node, the client node comprising a client host and a client data processing unit (DPU), the client host deploying a client preset adaptation component, and the client DPU deploying a client data plane proxy; the method comprising: the client preset adaptation component receiving a key discovery service request sent by the client data plane proxy, generating a certificate signing request and sending it to a server control plane component to issue a client certificate by the server control plane component; the client preset adaptation component receiving the client certificate; the client preset adaptation component sends the client certificate to the client data plane proxy after format conversion, so that the client data plane proxy uses the client certificate for bidirectional transport layer security communication.

[0006] As an optional implementation of the embodiment of the present application, the method further comprises: before the client preset adaptation component receives the key discovery service request sent by the client data plane agent, and generates the certificate signing request and sends it to the server control plane component, the client preset adaptation component receives the external data service configuration information sent by the server control plane component; and the client preset adaptation component sends the external data service configuration information to the client data plane agent.

[0007] As an optional implementation of the embodiment of the present application, the client host further comprises a client service; after the client data plane agent receives the target service request initiated by the client service, the client data plane agent sends a connection request to the server data plane agent according to the external data service configuration information, so that the server data plane agent returns the server certificate in response to the connection request; the client data plane agent receives the server certificate and obtains the service account information contained in the server certificate, verifies whether the service account indicated by the service account information is authorized to run the target service, and if so, sends the client certificate to the server data plane agent for certificate verification by the server data plane agent; after receiving the authorization message sent by the server data plane agent, the client data plane agent establishes a bidirectional transport layer security communication connection between the client data plane agent and the server data plane agent.

[0008] As an optional implementation of the embodiment of the present application, the method further comprises: after establishing the bidirectional transport layer security communication connection between the client data plane agent and the server data plane agent, the client data plane agent sends the target service request to the server data plane agent, so that the server data plane agent forwards the target service request to the target service.

[0009] Second aspect. The present application provides another communication configuration method based on DPU centralized service grid, applied to a server node, the server node comprising a server host deploying a control plane component; the method comprises: the control plane component receives a certificate signing request sent by a client preset adaptation component; the control plane component generates a client certificate in response to the certificate signing request and sends it to the client preset adaptation component.

[0010] As an optional implementation of the embodiment of the present application, the server node further comprises a server DPU, and the server DPU deploys a server data plane agent; the method further comprises: the server data plane agent receives a connection request sent by a client data plane agent, sends a server certificate to the client data plane agent, and the server certificate contains service account information for certificate verification by the client data plane agent; after the server data plane agent receives a client certificate sent by the client data plane agent, the server data plane agent verifies the client certificate; if the verification is passed, the server data plane agent sends an authorization message to the client data plane agent to establish a bidirectional transport layer security communication between the server data plane agent and the client data plane agent.

[0011] As an optional implementation of the embodiment of the application, the server host also deploys a server service; the method further comprises: after the two-way transport layer security communication connection between the server data plane agent and the client data plane agent is established, the server data plane agent receives the target service request sent by the client data plane agent; and the server data plane agent forwards the target service request to the corresponding server service to provide the target service for the client data plane agent.

[0012] In a third aspect, the application provides an electronic device, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, and when the computer program is executed by the processor, the communication configuration method based on the DPU centralized service mesh is realized.

[0013] In a fourth aspect, the application provides a computer readable storage medium, comprising: a computer program stored on the computer readable storage medium, and when the computer program is executed by a processor, the communication configuration method based on the DPU centralized service mesh is realized.

[0014] In a fifth aspect, the application provides a computer program product, comprising: the computer program product comprises a computer program, when the computer program runs on a computer, so that the computer realizes the communication configuration method based on the DPU centralized service mesh as described in the first aspect or any one of the optional implementation.

[0015] The technical scheme provided by the embodiments of the application has the following advantages compared with the prior art:

[0016] The embodiments of the application provide a communication configuration method, device and medium based on a DPU centralized service mesh, which is applied to a client node, the client node comprises a client host deploying a client preset adaptation component and a client DPU deploying a client data plane agent, the method first receives a key discovery service request sent by the client data plane agent, generates a certificate signing request and sends it to the server control plane component to sign the client certificate, the client receives the client certificate and performs format conversion, and then sends it to the client data plane agent, so that the client data plane agent can use the client certificate for two-way transport layer security transmission communication. In this way, the embodiments of the application deploy the client preset adaptation component and the client data plane agent, which work together to complete certificate signing, and then apply two-way transport layer security transmission communication to realize encrypted communication, improve the security of the service, and meet the zero trust security model. BRIEF DESCRIPTION OF DRAWINGS

[0017] The accompanying drawings, which are incorporated herein and constitute part of the specification, illustrate embodiments consistent with the application and, together with the description, serve to explain the principles of the application.

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the accompanying drawings required to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, for those of ordinary skill in the art, other drawings can also be obtained based on these drawings without any creative effort.

[0019] Figure 1 A flowchart of a communication configuration method based on a DPU centralized service mesh provided by an embodiment of the present application Figure 1 ;

[0020] Figure 2 A system architecture schematic diagram provided by an embodiment of the present application

[0021] Figure 3 A flowchart of a communication configuration method based on a DPU centralized service mesh provided by an embodiment of the present application Figure 2 ;

[0022] Figure 4 A flowchart of a communication configuration method based on a DPU centralized service mesh provided by an embodiment of the present application Figure 3 ;

[0023] Figure 5 A structure schematic diagram of a client node provided by an embodiment of the present application

[0024] Figure 6 A structure schematic diagram of a server node provided by an embodiment of the present application

[0025] Figure 7 A structure schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the technical terms required to be used in the embodiments or prior art description will be briefly introduced as follows:

[0027] Data Processing Unit (DPU) is a new type of specialized processor that has been developed recently. It is the third important computing chip in the data center scenario after the Central Processing Unit (CPU) and the graphics processing unit (GPU). It provides a computing engine for high-bandwidth, low-latency, and data-intensive computing scenarios. It is centered on data, input / output (I / O) intensive, and uses software-defined technology to support infrastructure resource layer virtualization. It can improve the efficiency of the computing system, reduce the total cost of ownership of the overall system, and improve the data processing efficiency and reduce the performance loss of other computing chips.

[0028] DPU network card is a network card installed on the cloud server node in the data center. It provides a high-bandwidth, low-latency heterogeneous network computing acceleration engine for the cloud server node. After installing the DPU network card correctly on the node, the DPU network card resources appear in the kernel network space of the node in the form of virtual function (VF) network ports and physical function (PF) network ports.

[0029] DPU system on chip (SOC) is an operating system deployed on the DPU network card.

[0030] Kubernetes (K8s) is an open-source system for automatically deploying, scaling, and managing containerized applications. It combines containers that make up an application into logical units for easy management and service discovery. K8s is usually used to build a multi-container network interface (CNI) network. Linux containers provide a lightweight virtualization method that can run multiple virtual environments (containers) on a single host machine. Containers provide virtualization at the operating system level, where the kernel controls isolated containers.

[0031] Istio is an open-source service mesh platform that connects, secures, controls, and observes services. Istio reduces the complexity of deployment and management by providing a unified solution for microservice architecture. It automatically manages network communication between services by introducing a transparent proxy layer in the microservice architecture, thereby achieving traffic control, security assurance, and metric collection.

[0032] Envoy is a component of the data plane, all requests are sent to Envoy, and then forwarded to the backend server by Envoy. It is a core part of the Istio architecture, responsible for handling network request routing, load balancing, service discovery, health checking, and other functions. Envoy supports HTTP / 1.1 and HTTP / 2 protocols, and can act as a bidirectional transparent proxy, bridging the two protocols between clients and servers. It is recommended to use the HTTP / 2 protocol to create a persistent connection mesh and implement request and response multiplexing. In addition, Envoy also supports gRPC request and response routing and load balancing, as well as L7 sniffing, statistics, and logging for database (MongoDB) connections based on distributed file storage, providing extensive support for key components in modern web applications.

[0033] With the rapid development of cloud-native technology, microservices architecture has become a popular choice for building modern applications. However, microservices architecture also brings new challenges, such as complex communication between services, network management, and observability. Service mesh (Service Mesh) emerges as the times require, providing unified traffic management, security, and observability functions for microservices.

[0034] Traditional service mesh usually adopts the sidecar proxy mode, each service instance is accompanied by a proxy that handles traffic in and out of the service. Although the sidecar proxy mode simplifies communication between services, it introduces additional resource overhead, such as additional CPU and memory for each service instance to run the proxy. In addition, under the sidecar proxy mode, traffic needs to pass through the host network protocol stack twice, increasing the delay.

[0035] To overcome the shortcomings of the sidecar proxy mode, centralized service mesh (Centralized Service Mesh) emerges as the times require. Centralized service mesh centralizes all proxy functions to one or more dedicated nodes, thereby reducing resource overhead and providing higher performance.

[0036] The emergence of DPU provides new possibilities for building high-performance, low-latency centralized service mesh. DPU centralized service mesh deploys service mesh data plane (Envoy) to the SOC side of DPU and uses Docker containers for isolation, separate from the host-side Kubernetes environment. DPU does not occupy host resources, increasing the number of microservices deployed on the host side; in addition, DPU can directly process traffic without sending it to the host, greatly improving network latency and forwarding efficiency.

[0037] However, the traditional DPU centralized service mesh solution has security problems, such as not supporting encrypted communication, lacking identity verification, not meeting the zero-trust security model, and the like, and cannot meet the high requirements of modern cloud-native applications on security. Zero trust is a network security strategy, the core idea of which is to distrust any internal or external network entity, and to protect data and resources through strict identity verification, access control and encryption technology, always authenticate and authorize all users and devices, and can effectively deal with various threats.

[0038] To solve some or all of the technical problems in the related art, the embodiments of the present application provide a communication configuration method, device and medium based on a DPU centralized service mesh, wherein the method is applied to a client node, the client node includes a client host deployed with a client preset adaptation component, and a client DPU deployed with a client data plane agent. First, the client preset adaptation component receives a key discovery service request sent by the client data plane agent, generates a certificate signing request and sends it to the server control plane component to issue a client certificate, the client receives the client certificate and performs format conversion, and then sends it to the client data plane agent, so that the client data plane agent can use the client certificate for two-way transport layer security transmission communication. In this way, the embodiments of the present application deploy the client preset adaptation component and the client data plane agent, which work together to complete certificate issuance, and then apply two-way transport layer security transmission communication to realize encrypted communication and improve the security of the service. And it can offload two-way transport layer security transmission to DPU for processing, thereby releasing the client host resources and improving the resource utilization.

[0039] In order to more clearly understand the above-mentioned purposes, features and advantages of the present application, the solutions of the present application will be further described below. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0040] In the following description, many specific details are set forth in order to provide a thorough understanding of the present application, but the present application can also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some of the embodiments of the present application, not all the embodiments.

[0041] This application provides a communication configuration method based on a DPU-centric centralized service mesh, which can be implemented through worker nodes (such as client nodes and server nodes) or electronic devices. These electronic devices include, but are not limited to, in-vehicle terminals, servers, personal computers, laptops, tablets, and smartphones. The operating system of the electronic device can include Android, Apple's iOS, Microsoft's Windows operating system, etc., and this application does not limit this. The electronic device can operate independently to implement this application, or it can connect to a network and implement this application through interaction with other computer devices on the network. The network where the electronic device is located includes, but is not limited to, the Internet, wide area networks (WANs), metropolitan area networks (MANs), local area networks (LANs), and virtual private networks (VPNs).

[0042] It should be noted that the scope of protection of the communication configuration method based on DPU centralized service mesh described in this application embodiment is not limited to the execution order of the steps listed in this embodiment. Any solution implemented by adding, deleting, or replacing steps in the prior art based on the principles of this application is included within the scope of protection of this application.

[0043] like Figure 1 As shown, Figure 1 A flowchart illustrating a communication configuration method based on a DPU-centralized service mesh provided in this application embodiment. Figure 1 This method can be applied to, for example Figure 2 The system shown includes client nodes and server nodes. The method mainly includes the following steps S101 to S103:

[0044] S101. The client-side pre-configured adaptation component receives the key discovery service request sent by the client data plane proxy, generates a certificate signing request, and sends it to the control plane component.

[0045] like Figure 2In the illustrated system, the client node includes a client host (Host) 201 and a client DPU 202, the client Host 201 and the client DPU 202 are connected through a high-speed serial computer expansion bus (peripheral component interconnect express, PCIE), the client Host 201 runs a container orchestration platform (kubernetes), and the container orchestration platform is deployed with a client preset adaptation component (Istio-dpu-adapter) and a client service (client). Among them, the client preset adaptation component Istio-dpu-adapter is responsible for forwarding external data service (External Discovery Service, xDS) configuration information to the client data plane agent (Envoy) on the client DPU 202, and processing tasks such as certificate issuance and distribution, the client Istio-dpu-adapter includes a key discovery service (sds) module and an external data service proxy (xds_proxy) module. The client service is mounted with a root certificate. The client DPU 202 includes a forwarding plane and a client Envoy. The client Envoy is responsible for processing inter-service communication and is configured to use the mutual transport layer security communication protocol (Mutual Transport Layer Security, mTLS).

[0046] The server node includes a server Host 211 and a server DPU 212, the server Host 211 runs a container orchestration platform, and the container orchestration platform is deployed with a control plane component (istiod), a server preset adaptation component (Istio-dpu-adapter) and a server service. Among them, the istiod includes a certificate authority (Certificate Authority, ca) module and a discovery (discovery) module; the preset adaptation component includes an sds module and an xds_proxy module.

[0047] In step S101, the client Host side Istio-dpu-adapter receives the key discovery service (Service Discovery Service, SDS) request sent by the DPU side client Envoy, generates a certificate signing request (Certificate Signing Request, CSR) request through the sds module and sends it to the control plane component istiod deployed on the server node, so that the client certificate is issued by the istiod and returned to the client Istio-dpu-adapter.

[0048] The CSR is mainly used to request a signature from a certificate authority (CA) in a digital certificate authentication process to obtain a trusted digital certificate. The CSR contains a public key for issuing a certificate, distinguished name information (e.g., a domain name) for identification, and authenticity and integrity protection (e.g., a digital signature).

[0049] Reference Figure 2 As shown, the sds module of the Istio-dpu-adapter on the client side Host 201 receives an SDS request sent by the client-side Envoy on the DPU 202 side, and generates a CSR request in response to the SDS request, and sends the CSR request to the ca module of the istiod component in the container orchestration environment on the server side Host 211. The ca module generates a client certificate (signed certificate) according to the CSR request, and returns the client certificate to the Istio-dpu-adapter on the client side Host 201.

[0050] In some embodiments, before step S101 is performed, the method further includes: the client-side preset adaptation component receiving external data service configuration information sent by the server-side control plane component, and sending the external data service configuration information to the client-side data plane proxy. The external data service (xDS) configuration information includes, but is not limited to, service discovery and routing rules.

[0051] Reference Figure 2 As shown, the xds_proxy module of the Istio-dpu-adapter on the client side Host 201 obtains aggregated discovery service information (ADS) sent by the discovery module of the istiod component in the container orchestration environment on the server side Host 211, and forwards the ADS to the client-side Envoy.

[0052] It should be noted that in Istio, the xDS (External Discovery Service) protocol is used to dynamically provide network configuration information to data plane proxies such as Envoy. The xDS protocol includes Cluster Discovery Service (CDS), Listener Discovery Service (LDS), Route Discovery Service (RDS), Endpoint Discovery Service (EDS), etc. These services work together to provide various configuration information required by Envoy proxy to ensure correct routing and communication of services, providing support for service discovery and configuration management in microservice architecture. ADS is a unified encapsulation of these services, providing a centralized way to manage and distribute data plane configuration information.

[0053] The above embodiments work with the client data plane proxy Envoy by deploying a client preset adaptation component on the client host side.

[0054] S102, the client preset adaptation component receives a client certificate issued by a server control plane component.

[0055] Reference Figure 2 As shown, the client Host 201 side Istio-dpu-adapter receives a client certificate (signed certificate) issued by the control plane component istiod on the server node Host 211 side. The client certificate is a Transport Layer Security (TLS) certificate that can be used for identity verification and encrypted communication.

[0056] S103, the client preset adaptation component sends the certificate after format conversion to the client data plane proxy, so that the client data plane proxy uses the certificate for bidirectional Transport Layer Security communication.

[0057] The client preset adaptation component converts the format of the certificate into a preset format, which is a format that can be recognized by the data plane proxy Envoy, such as the x.509 format. After format conversion, a certificate signed in the SPIFFE format is obtained. SPIFFE is an abbreviation of Security Permissions and Identity for Flatcar Containers, which is a framework that provides identity and permission management for container and function workloads. SPIFFE aims to provide a standardized method for workloads in cloud-native environments to authenticate and authorize, to ensure their security and manageability. The implementation of SPIFFE can enhance the security of cloud-native applications, reduce the attack surface, and provide more fine-grained access control.

[0058] The mutual Transport Layer Security communication mTLS provides higher security for network communication through mutual authentication and encryption technology, ensuring that only authorized devices or services can participate in communication, thereby protecting the confidentiality, integrity and availability of data.

[0059] In some embodiments, the client preset adaptation component also sends the private key to the client data plane proxy. Referring to Figure 2 As shown, the client Host 201 side Istio-dpu-adapter sends the certificate and the private key after format conversion to the client DPU 202 side Envoy.

[0060] Through the above embodiments, the mTLS is offloaded to the DPU for processing, thereby reducing the load of the host CPU and improving the service performance.

[0061] The communication configuration method based on the DPU centralized service mesh provided by the embodiments of the present application further includes Figure 3 As shown in the flow, the following steps S301-S303 are performed:

[0062] S301, after the client data plane proxy receives the target service request initiated by the client service, the client data plane proxy sends a connection request to the server data plane proxy according to the external data service configuration information, so that the server data plane proxy returns a certificate in response to the connection request.

[0063] Referring to Figure 2As shown, the client Host 201 side client initiates a target service request, and the client Envoy intercepts the target service request. Then, the client Envoy determines the service Envoy address corresponding to the target service request according to external data service configuration information (xDS), initiates a connection to the service Envoy based on the service Envoy proxy address, and responds to the connection request by the service Envoy to present a certificate.

[0064] The above embodiment redirects the target service request initiated by the client service to the client Envoy, so that the service access is more flexible and efficient, and the security of the service is enhanced.

[0065] S302, the client data plane agent receives the service end data plane agent returned service end certificate, and obtains the service account information contained in the service end certificate, verifies whether the service account indicated by the service account information is authorized to run the target service, if yes, sends the client certificate to the service end data plane agent for certificate verification by the service end data plane agent.

[0066] The client data plane agent verifies the validity and authenticity of the service end certificate, and checks whether the service account is authorized to run the target service, so as to prevent unauthorized service accounts from accessing the target service. After verification, the client data plane agent presents its own certificate to the service end data plane agent.

[0067] On the service end node side, after the service end data plane agent receives the client certificate, the service end data plane agent verifies the client certificate to verify the authenticity and validity of the client certificate. At this time, the certificate verification of both parties is passed, and the service end data plane agent sends an authorization message to the client data plane agent, which indicates that the client data plane agent is granted access rights.

[0068] The above embodiment realizes bidirectional TLS handshake, increases security, and helps to prevent attacks. Identity management is realized by using SPIFFE standard, which enhances the security of the service and effectively prevents unauthorized access.

[0069] S303, after receiving the authorization message sent by the service end data plane agent, the client data plane agent establishes bidirectional transport layer security communication between the client data plane agent and the service end data plane agent.

[0070] In some embodiments, after establishing the bidirectional transport layer security communication between the two data plane proxies, the client data plane proxy forwards the target service request to the service data plane proxy to provide the target service by the service data plane proxy. On the service node side, after receiving the target service request, the service data plane proxy forwards the target service request to the target service in the service host according to the external data service configuration information (xDS) issued by the control plane component.

[0071] The above embodiments perform service identity authentication in the centralized service mesh, ensure that the traffic between the client node and the service node is secure and reliable, can reduce security risks, improve service security, and achieve accurate inter-service access control; implement mTLS communication to encrypt inter-service communication data, avoid being attacked by a man-in-the-middle to steal, and also can identify and isolate malicious services. Offload mTLS communication to DPU to release host resources, thereby improving resource utilization and reducing hardware costs. It conforms to the zero trust security model and meets the compliance requirements.

[0072] Figure 4 A communication configuration method based on a DPU centralized service mesh provided by an embodiment of the present application Figure 3 The method is applied to a service node, and the service node includes a service host, and the service host is deployed with a control plane component, as shown in Figure 4 The method includes the following steps S401-S402:

[0073] S401, the control plane component receives a certificate signing request sent by a client preset adaptation component.

[0074] Referring to Figure 2 The ca module of the control plane component istiod receives a certificate signing request CSR sent by the client Host 201 side preset adaptation component Istio-dpu-adapter.

[0075] S402, the control plane component generates a client certificate in response to the certificate signing request and sends it to the client preset adaptation component.

[0076] Referring to Figure 2 The ca module of the control plane component istiod generates a client certificate (signed certificate) in response to the certificate signing request CSR and returns it to the client Host 201 side preset adaptation component Istio-dpu-adapter.

[0077] The above embodiments simplify the certificate management and distribution process, thereby reducing the operation and maintenance complexity and reducing the deployment and management cost.

[0078] In some embodiments, the service-side node further includes a service-side DPU, and the service-side DPU is deployed with a service-side data plane proxy Envoy. The above method further includes:

[0079] S403, the service-side Envoy receives the connection request sent by the client-side data plane proxy, sends a service-side certificate to the client-side data plane proxy, and the service-side certificate contains service account information for certificate verification by the client-side data plane proxy.

[0080] In some embodiments, before step S403 is performed, the method further includes: the service-side preset adaptation component receives a key discovery service request sent by the service-side data plane proxy, generates a certificate signing request and sends it to the control plane component; the control plane component generates a service-side certificate and returns it to the service-side preset adaptation component, which converts the format of the service-side certificate and sends it to the service-side data plane proxy for bidirectional transport layer security communication using the service-side certificate. Realize the issuance of the certificate on the service-side node.

[0081] After the service-side data plane proxy obtains the service-side certificate, step S403 is performed. The service-side preset adaptation component is deployed on the service-side host to work with the service-side data plane proxy.

[0082] S404, after receiving the client-side certificate sent by the client-side Envoy, the service-side Envoy verifies the client-side certificate. If the verification is passed, it means that the client-side certificate is authentic and valid, and sends an authorization message to the client-side data plane proxy to establish bidirectional transport layer security communication between the service-side Envoy and the client-side data plane proxy.

[0083] The above embodiment realizes bidirectional TLS handshake, performs service identity verification in the centralized service mesh, ensures that the traffic between the client-side node and the service-side node is secure and reliable, increases security, and helps prevent attacks. Identity management is performed using SPIFFE standard, which enhances the security of the service and effectively prevents unauthorized access.

[0084] In some embodiments, the service node host also has a service-side service, and the above method further includes:

[0085] S405, after establishing the bidirectional transport layer security communication connection between the service-side data plane proxy and the client-side data plane proxy, the service-side data plane proxy receives a target service request sent by the client-side data plane proxy;

[0086] S406, the service-side data plane proxy forwards the target service request to the corresponding service-side service to provide the target service to the client-side data plane proxy.

[0087] In some embodiments, before step S406 is performed, the method further includes that the service-side preset adaptation component receives the external data service configuration information sent by the control plane component and sends the external data service configuration information to the service-side data plane agent. When step S406 is performed, the service-side data plane agent forwards the target service request to the corresponding service-side service according to the external data service configuration information.

[0088] The above embodiments implement mTLS communication to encrypt inter-service communication data, avoid being stolen by man-in-the-middle attacks, and also identify malicious services for isolation. The mTLS communication is offloaded to the DPU, releasing host resources, thereby improving resource utilization and reducing hardware costs. The method conforms to the zero-trust security model and meets compliance requirements.

[0089] To more clearly illustrate the method provided by the present application, an optional implementation will be introduced below, which can realize communication configuration between a client node and a service-side node. The client node includes a client host and a client DPU, the client host is deployed with a client service and a client preset adaptation component, and the client DPU is deployed with a client data plane agent. The service-side node includes a service-side host and a service-side DPU, the service-side host is deployed with a control plane component, a service-side preset adaptation component and a service-side service, and the service-side DPU is deployed with a service-side data plane agent.

[0090] The method includes a service deployment configuration phase and a traffic processing phase, as follows:

[0091] 1. Service deployment configuration phase

[0092] S501, The preset adaptation component receives the key discovery service request sent by the data plane agent, generates a certificate signing request and sends it to the service-side control plane component.

[0093] When step S501 is performed, the client Istio-dpu-adapter receives the SDS request sent by the client Envoy, generates a CSR request, and sends it to istiod.

[0094] The service-side Istio-dpu-adapter receives the SDS request sent by the service-side Envoy, generates a CSR request, and sends it to istiod.

[0095] S502, The service-side control plane component issues a certificate and returns it to the preset adaptation component.

[0096] The service-side control plane component istiod issues a client certificate and returns it to the client preset adaptation component Istio-dpu-adapter.

[0097] The service-end control plane component istiod issues a service-end certificate, and returns the service-end preset adaptation component Istio-dpu-adapter.

[0098] In step S503, the preset adaptation component performs format conversion on the certificate and sends it to the data plane agent.

[0099] In step S503, the client Istio-dpu-adapter receives the client certificate issued by the service-end control plane component istiod, performs format conversion on it, and sends it to the client data plane agent Envoy on the client DPU side.

[0100] The service-end Istio-dpu-adapter receives the service-end certificate issued by the control plane component istiod, performs format conversion on it, and sends it to the service-end data plane agent Envoy on the service-end DPU side. This enables the data plane agent to apply the certificate for mTLS communication.

[0101] In step S504, the preset adaptation component receives external data service configuration information sent by the service-end control plane.

[0102] In step S504, the client preset adaptation component Istio-dpu-adapter receives the xDS configuration information sent by the service-end control plane component istiod.

[0103] The service-end preset adaptation component Istio-dpu-adapter receives the xDS configuration information sent by the control plane component istiod.

[0104] In step S505, the preset adaptation component sends external data service configuration information to the data plane agent.

[0105] In step S505, the client preset adaptation component Istio-dpu-adapter sends the xDS configuration information to the client Envoy.

[0106] The service-end preset adaptation component Istio-dpu-adapter sends the xDS configuration information to the service-end Envoy.

[0107] 2. Traffic processing phase

[0108] In step S506, the client service initiates a target service request.

[0109] The target service is a certain service-end service on the service-end node. The client service initiates a request for the target service, and the centralized service mesh re-routes the traffic to the Envoy agent deployed on the DPU.

[0110] S507: The client data plane proxy intercepts the target service request, determines the server data plane proxy address corresponding to the target service based on the xDS configuration information, and sends a connection request to the server data plane proxy.

[0111] S508: Upon receiving a connection request, the server-side data plane proxy sends the server certificate to the client-side data plane proxy.

[0112] The centralized service mesh directs connection requests to the server-side Envoy on the server-side DPU. Upon receiving a connection request, the server-side Envoy first presents its TLS certificate for authentication and encrypted communication.

[0113] S509, the client data plane proxy verifies the server certificate.

[0114] The server certificate contains service account information.

[0115] S510, the client data plane proxy verification service account information indicates whether the service account is authorized to run the target service.

[0116] S511. If so, the client data plane proxy sends the client certificate to the server data plane proxy.

[0117] S512, the server-side data plane proxy verifies the client's certificate.

[0118] S513. If the verification is successful, the server-side data plane proxy sends an authorization message to the client-side data plane proxy.

[0119] Once both parties' certificates are verified, an authorization message is sent to the client's data plane proxy to grant the client's data plane proxy access permissions.

[0120] S514. Establish a bidirectional transport layer secure communication connection.

[0121] S515: The server-side data plane proxy forwards the target service request to the target service based on the xDS configuration information.

[0122] The client data plane proxy and the server data plane proxy have established mTLS communication. The client data plane proxy transmits the previously intercepted target service request to the server data plane proxy through mTLS encryption. The server data plane proxy then locates the target service request to the corresponding server service according to the xDS configuration information, thereby realizing secure communication between the client service and the server service.

[0123] like Figure 5 As shown, Figure 5A structural schematic diagram of a client node provided by an embodiment of the present application, the client node comprising: a client host 501 and a client DPU 502, the client host 501 comprising a client preset adaptation component 503 and a client service 504, and the client DPU 502 comprising a client data plane agent 505;

[0124] The client data plane agent 505 is configured to send a key discovery service request.

[0125] The client preset adaptation component 503 is configured to receive the key discovery service request sent by the client data plane agent 505, generate a certificate signing request, and send the certificate signing request to the server control plane component to enable the server control plane component to issue a client certificate; and further configured to receive the client certificate, perform format conversion on the client certificate, and send the client certificate to the client data plane agent 505.

[0126] The client data plane agent 505 is further configured to perform two-way transport layer security communication using the client certificate.

[0127] As an optional embodiment of the present application, before the client preset adaptation component 503 receives the key discovery service request sent by the client data plane agent 505, generates a certificate signing request, and sends the certificate signing request to the server control plane component, the client preset adaptation component 503 is further configured to receive external data service configuration information sent by the server control plane component, and forward the external data service configuration information to the client data plane agent 505.

[0128] As an optional embodiment of the present application, the client service 504 initiates a target service request, and the client data plane agent 505 is further configured to determine a server data plane agent address corresponding to the target service request according to the external data service configuration information, send a connection request to the server data plane agent based on the server data plane agent address, to enable the server data plane agent to return a server certificate in response to the connection request; receive the server certificate, obtain service account information contained in the server certificate, verify whether a service account indicated by the service account information is authorized to run the target service, and if so, send the client certificate to the server data plane agent to enable the server data plane agent to perform certificate verification; and after receiving an authorization message sent by the server data plane agent, establish a two-way transport layer security communication connection between the client data plane agent and the server data plane agent.

[0129] As an optional embodiment of the present application, the client data plane agent 505 is further configured to, after establishing the two-way transport layer security communication connection between the client data plane agent and the server data plane agent, send the target service request to the server data plane agent, to enable the server data plane agent to forward the target service request to the target service.

[0130] The specific definition of the client node can refer to the definition of the communication configuration method based on the DPU centralized service grid in the foregoing, and details are not described herein again. Each device in the client node can be implemented by software, hardware, and a combination thereof, in whole or in part. The devices can be embedded in the processor in the computer device in hardware form or independent of the processor, or stored in the memory in the computer device in software form, so as to be called and executed by the processor.

[0131] As shown in Figure 6 Figure 6 A structural schematic diagram of a server node provided by an embodiment of the application is shown in the figure. The server node includes a server host 601 and a server DPU 602. The server host includes a control plane component 603.

[0132] The control plane component 603 is configured to receive a certificate signing request sent by a client preset adaptation component, and generate a client certificate and send the client certificate to the client preset adaptation component in response to the certificate signing request.

[0133] As an optional embodiment of the application, the server DPU 602 includes a server data plane agent 604, configured to receive a connection request sent by a client data plane agent, send a server certificate to the client data plane agent, the server certificate containing service account information, for certificate verification by the client data plane agent, and after receiving a client certificate sent by the client data plane agent, verify the client certificate, and if the verification is passed, send an authorization message to the client data plane agent to establish a two-way transport layer security communication between the server data plane agent 604 and the client data plane agent.

[0134] As an optional embodiment of the application, the server host includes a server service 605, and the server data plane agent 604 is further configured to, after establishing the two-way transport layer security communication between the server data plane agent 604 and the client data plane agent, receive a target service request sent by the client data plane agent, and forward the target service request to the corresponding server service 605 to provide the target service to the client data plane agent.

[0135] The specific definition of the server node can refer to the definition of the communication configuration method based on the DPU centralized service grid in the foregoing, and details are not described herein again. Each device in the server node can be implemented by software, hardware, and a combination thereof, in whole or in part. The devices can be embedded in the processor in the computer device in hardware form or independent of the processor, or stored in the memory in the computer device in software form, so as to be called and executed by the processor.

[0136] ​In one embodiment, the present application provides an electronic device, which can be a terminal, and an internal structure diagram thereof can be as shown in FIG. 1. Figure 7 The electronic device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. The processor of the electronic device is configured to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for running the operating system and the computer program in the non-volatile storage medium. The communication interface of the electronic device is configured to perform wired or wireless communication with an external terminal. The wireless communication can be achieved through WIFI, a carrier network, near field communication (NFC) or other technologies. The computer program is executed by the processor to implement a communication configuration method based on a DPU centralized service grid. The display screen of the electronic device can be a liquid crystal display screen or an electronic ink display screen. The input device of the electronic device can be a touch layer overlaid on the display screen, or a key, trackball or touchpad arranged on the shell of the electronic device, or an external keyboard, touchpad or mouse, etc.

[0137] Those skilled in the art can understand that Figure 7 The structure shown in FIG. 1 is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. Specifically, the electronic device can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0138] The embodiment of the present application provides a computer readable storage medium, which stores a computer program. The computer program is executed by a processor to implement each process of the communication configuration method based on the DPU centralized service grid in the method embodiment, and can achieve the same technical effects.

[0139] The computer readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0140] The embodiment of the present application provides a computer program product, which stores a computer program. The computer program is executed by a processor to implement each process of the communication configuration method based on the DPU centralized service grid in the method embodiment, and can achieve the same technical effects. To avoid repetition, details are not described here.

[0141] Those skilled in the art will appreciate that embodiments of the present application can be readily used as a method, a system or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application can take the form of a computer program product on one or more computer readable storage media having computer readable program code embodied in the medium.

[0142] It is to be understood that the embodiments provided by the present application can be implemented in other specific forms without departing from the spirit or essential character thereof. The exemplary embodiments described above are to be considered in a descriptive sense only and not for purposes of limitation. The apparatus described above are solely for purposes of illustration and are not intended to limit the scope of the present application. The described embodiments are not meant to imply that other embodiments cannot be utilized or that other embodiments are not no longer warranted or permitted. The scope of the present application is defined by the appended claims and their equivalents.

[0143] In the present application, the processor can be a central processing unit (CPU), and can also be other general-purpose processors, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor.

[0144] In the present application, the memory can include a non-persistent memory in a computer readable medium, a random access memory (RAM) and / or a non-volatile memory, etc., such as a read-only memory (ROM) or a flash memory (flash RAM). The memory is an example of the computer readable medium.

[0145] In this application, computer readable medium includes permanent and non-permanent, removable and non-removable storage media. Storage media can be implemented by any method or technology to store information, which can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic disk storage or other magnetic storage device, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer readable medium does not include transitory media such as modulated data signals and carriers.

[0146] It should be noted that, in this text, relational terms such as "first" and "second" and the like are used only to distinguish one entity or operation from another, and do not necessarily require or imply there is any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or device including the element.

[0147] The above is only the specific embodiment of the present application, which enables those skilled in the art to understand or implement the present application. Various modifications of these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to these embodiments herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A communication configuration method based on DPU centralized service mesh, characterized in that, The application is applied to a client node, which comprises a client host and a client data processing unit (DPU), wherein the client host deploys a client preset adaptation component, and the client DPU deploys a client data plane agent; The method comprises: The client preset adaptation component receives a key discovery service request sent by the client data plane agent, generates a certificate signing request and sends the certificate signing request to a server control plane component, so that the server control plane component issues a client certificate; The client preset adaptation component receives the client certificate; After the client preset adaptation component converts the format of the client certificate, the client preset adaptation component sends the client certificate to the client data plane agent, so that the client data plane agent performs bidirectional transport layer security communication by using the client certificate; The method further comprises: Before the client preset adaptation component receives a key discovery service request sent by the client data plane agent, generates a certificate signing request and sends the certificate signing request to a server control plane component, the client preset adaptation component receives external data service configuration information sent by the server control plane component; The client preset adaptation component sends the external data service configuration information to the client data plane agent; The client host further comprises a client service; After the client data plane agent receives a target service request initiated by the client service, the client data plane agent sends a connection request to a server data plane agent according to the external data service configuration information, so that the server data plane agent returns a server certificate in response to the connection request; The client data plane agent receives the server certificate and obtains service account information contained in the server certificate, verifies whether a service account indicated by the service account information is authorized to run a target service, and if so, sends the client certificate to the server data plane agent, so that the server data plane agent performs certificate verification; After the client data plane agent receives an authorization message sent by the server data plane agent, the client data plane agent establishes a bidirectional transport layer security communication connection between the client data plane agent and the server data plane agent.

2. The method of claim 1, wherein, The method further comprises: After the bidirectional transport layer security communication connection between the client data plane agent and the server data plane agent is established, the client data plane agent sends the target service request to the server data plane agent, so that the server data plane agent forwards the target service request to a target service.

3. A communication configuration method based on DPU centralized service mesh, characterized in that, The application is applied to a server node, which comprises a server host that deploys a control plane component; The method comprises: The control plane component receives a certificate signing request sent by a client preset adaptation component; The control plane component generates a client certificate in response to the certificate signing request and sends the client certificate to the client preset adaptation component; The server node further comprises a server DPU, and the server DPU deploys a server data plane agent; The method further comprises: The service end data plane agent receives a connection request sent by the client data plane agent, sends a service end certificate to the client data plane agent, the service end certificate contains service account information, and the service end certificate is verified by the client data plane agent; After the service end data plane agent receives the client certificate sent by the client data plane agent, the client certificate is verified, if the verification is passed, an authorization message is sent to the client data plane agent, and bidirectional transport layer security communication between the service end data plane agent and the client data plane agent is established.

4. The method of claim 3, wherein, The service end host also deploys a service end service; The method further comprises: After the bidirectional transport layer security communication connection between the service end data plane agent and the client data plane agent is established, the service end data plane agent receives a target service request sent by the client data plane agent; The service end data plane agent forwards the target service request to the corresponding service end service to provide the target service for the client data plane agent.

5. An electronic device, comprising: Comprise: A processor, a memory, and a computer program stored on the memory and executable on the processor, when the computer program is executed by the processor, the communication configuration method based on the DPU centralized service grid is realized as claimed in any one of claims 1 to 2, or, claims 3 to 4.

6. A computer-readable storage medium, characterized in that, Comprise: The computer program is stored on the computer readable storage medium, and when the computer program is executed by the processor, the communication configuration method based on the DPU centralized service grid is realized as claimed in any one of claims 1 to 2, or, claims 3 to 4.

7. A computer program product, characterised in that, Comprise: The computer program product comprises a computer program, when the computer program is executed on the computer, the computer realizes the communication configuration method based on the DPU centralized service grid as claimed in any one of claims 1 to 2, or, claims 3 to 4.

Images