Public network traffic forwarding method and device for cloud computing system, equipment and medium

Abstract

The application discloses a public network traffic forwarding method and device for a cloud computing system, equipment and a medium, relates to the technical field of cloud computing, wherein the public network traffic forwarding method for the cloud computing system is configured by deploying a virtual switch and a virtual machine on a host computer and deploying a virtual gateway on a cloud computing gateway, so that the internal public network traffic of the cloud computing network is only the first message that is forwarded and processed by the gateway node and generates a high-speed forwarding table, and the gateway node does not need to participate in the subsequent processing of all other public network traffic messages, and only needs to use the generated high-speed forwarding table and the host computer information table to directly forward the public network traffic between the host computers, thereby solving the technical problems of high load of the gateway node and high delay of public network traffic forwarding, greatly improving the forwarding efficiency of the public network traffic in the cloud computing network, and greatly reducing the loss and load pressure of the gateway node.

Description

TECHNICAL FIELD

[0001] The present disclosure relates generally to the field of cloud computing technology, and in particular, to a public network traffic forwarding method and device for a cloud computing system, equipment and medium. BACKGROUND

[0002] With the rapid development of network, virtualization and storage technology, cloud computing technology has become one of the current popular network technologies, and major Internet vendors and enterprises can build a cloud computing network based on cloud computing technology. The cloud computing network includes different host computers in the same availability zone for communication and auxiliary forwarding middleware. Each host computer has a virtual machine deployed thereon.

[0003] When the auxiliary forwarding middleware is a virtual gateway, the virtual machine A forwards all public network traffic to the virtual gateway through the host computer to which it belongs, and uses the virtual gateway to forward to the host computer where the virtual machine B is located. When the auxiliary forwarding middleware includes a virtual gateway and an intelligent switch, a physical device, the virtual gateway and the intelligent switch are used to complete the forwarding of all public network traffic.

[0004] Since the forwarding of all public network traffic in the existing cloud computing network needs to rely on the virtual gateway, the virtual gateway has a large load pressure and high public network traffic forwarding delay. SUMMARY

[0005] In view of the above-mentioned defects or deficiencies in the prior art, it is desirable to provide a public network traffic forwarding method, device, equipment and medium for a cloud computing system, which realizes that only the first packet of public network traffic in the cloud computing network is forwarded to the gateway node for processing and generating a high-speed forwarding table, and the gateway node does not need to participate in the subsequent forwarding of all other public network traffic packets. Only the generated high-speed forwarding table and host computer information table are used to directly forward the public network traffic between host computers, solving the technical problems of high load of the existing gateway node and high delay of public network traffic forwarding, greatly improving the forwarding efficiency of public network traffic in the cloud computing network, and greatly reducing the loss and load pressure of the gateway node.

[0006] In a first aspect, the present application provides a public network traffic forwarding method for a cloud computing system, the cloud computing system including a first host computer, a second host computer and a plurality of cloud computing gateways for communication in the same availability zone. The first host computer has a first virtual switch and a first virtual machine deployed thereon, and each cloud computing gateway has a virtual gateway deployed thereon. The method comprises:

[0007] the first virtual switch determines, according to the host information table, the first high-speed forwarding table and the destination public network IP of the first public network traffic message, a second mac address corresponding to a management IP of the second host, and adds a message header to the first public network traffic message according to the second mac address and a mac address of a public network IP of a second virtual machine, and then forwards the first public network traffic message to the second host; and the second virtual machine is deployed on the second host.

[0008] the first virtual switch determines, according to the host information table, the first high-speed forwarding table and the destination public network IP of the first public network traffic message, a second mac address corresponding to a management IP of the second host, and adds a message header to the first public network traffic message according to the second mac address and a mac address of a public network IP of a second virtual machine, and then forwards the first public network traffic message to the second host; and the second virtual machine is deployed on the second host.

[0009] The first high-speed forwarding table includes a corresponding relationship among a public network IP, a mac address of a virtual machine public network IP and a management IP of a host where the virtual machine is located, and the host information table includes a corresponding relationship between a management IP of a host and a mac address.

[0010] In combination with the first aspect, in a possible implementation manner, in a case where a security policy script is deployed on the first virtual switch, the method further includes:

[0011] The first virtual switch performs security verification on the received first public network traffic message by using the security policy script, and determines whether the first public network traffic message that passes the security verification is the first message.

[0012] In combination with the first aspect, in a possible implementation manner, the forwarding of the first message by using the first virtualization gateway includes:

[0013] The first virtual switch adds a message header to the first message according to a mac address of the first virtualization gateway, and forwards a target message obtained to the first virtualization gateway.

[0014] The first virtualization gateway parses the first message from the target message, and forwards the first message to the Internet in a case where a public network IP of a second virtual machine does not belong to public network IPs inside the cloud computing system.

[0015] In a case where the public IP of the second virtual machine belongs to a public IP inside the cloud computing system, the first virtualized gateway forwards the first message to the second virtual machine after adding a message header to the first message according to the mac address of the public network card of the second virtual machine and the management IP of the second host obtained from a public IP information table; the public IP information table includes the mac address of the public network card of each virtual machine to which the public IP in the cloud computing system belongs and the management IP of each host to which the public IP belongs.

[0016] With reference to the first aspect, in a possible implementation manner, the method further includes:

[0017] The first virtualized gateway forwards the message to the second virtual machine and simultaneously issues a high-speed forwarding table update instruction to the first virtual switch;

[0018] The first virtual switch queries whether the first high-speed forwarding table exists in response to the high-speed forwarding table update instruction;

[0019] If the first high-speed forwarding table exists, the first virtual switch updates the active time of the first high-speed forwarding table;

[0020] If the first high-speed forwarding table does not exist, the first virtual switch creates the first high-speed forwarding table.

[0021] With reference to the first aspect, in a possible implementation manner, the updating of the active time of the first high-speed forwarding table includes:

[0022] In a case where a first time difference between the latest active time corresponding to the first high-speed forwarding table and the current time of the first host is less than a preset time threshold, the latest active time is modified to the current time.

[0023] With reference to the first aspect, in a possible implementation manner, the method further includes:

[0024] The first virtual machine sends an arp request message to the first virtual switch, and the arp request message is used to request the mac address of the second virtual machine;

[0025] The first virtual switch performs security verification on the arp request message, adds corresponding udp header information to the arp request message that passes the security verification, and sends the obtained udp request message to a second virtualized gateway; the second virtualized gateway is a virtualized gateway that is running normally in the plurality of virtualized gateways;

[0026] The second virtualization gateway parses the ARP request packet from the UDP request packet, adds corresponding UDP header information after replying to the ARP request packet, obtains a UDP response packet, and forwards the UDP response packet to the first host;

[0027] The first virtual switch in the first host parses an ARP response packet from the UDP response packet, forwards the ARP response packet to the first virtual machine, and

[0028] The first virtual machine generates an ARP cache table according to the received ARP response packet, the ARP cache table is used to store the mapping relationship between IP and mac address, and the ARP cache table includes the corresponding relationship between the public IP of the first virtual machine and the default mac address of the virtualization gateway in the same subnet and the corresponding relationship between the default gateway and the default mac address of the virtualization gateway when different subnets are generated.

[0029] In combination with the first aspect, in a possible implementation manner, the method further includes:

[0030] In the case that the cloud computing system includes a plurality of hosts including the first host and the second host, each of the hosts periodically broadcasts current host address information to a plurality of virtualization gateways, the current host address information including the management IP of the corresponding host and the mac address corresponding to the management IP;

[0031] Each of the virtualization gateways statistically aggregates all the received current host address information to obtain the host information table.

[0032] Secondly, the application further provides a public network flow forwarding device for a cloud computing system, the cloud computing system including a first host, a second host and a plurality of cloud computing gateways for communication in the same available area, the first host being provided with a first virtual switch and a first virtual machine, and each of the cloud computing gateways being provided with a virtualization gateway; the device includes:

[0033] The first forwarding unit is configured to, in the case that the first virtual switch determines that the first public network flow packet sent by the first virtual machine is a non-first packet and the source end IP and the opposite end public network IP of the first public network flow packet are in different hosts, determine the second mac address corresponding to the management IP of the second host according to the host information table, the first high-speed forwarding table and the opposite end public network IP of the first public network flow packet, and forward the first public network flow packet to the second host after adding the packet header according to the second mac address and the mac address of the second virtual machine public network IP.

[0034] a second forwarding unit configured to determine, by the first virtual switch, a first virtualized gateway currently running normally from the plurality of virtualized gateways in a case that the first public network traffic message is determined as a first message, and forward the first message through the first virtualized gateway and generate the first high-speed forwarding table;

[0035] The first high-speed forwarding table includes a correspondence relationship between a public network IP, a mac address of the public network IP, and a management IP of a host computer where a virtual machine is located, which are accessed by the first virtual machine, and the host computer information table includes a correspondence relationship between a management IP and a mac address of a host computer.

[0036] In a third aspect, the present application further provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the public network traffic forwarding method for a cloud computing system according to the first aspect.

[0037] In a fourth aspect, the present application further provides a computer program product comprising a computer program, wherein the computer program is executed by a processor to implement the public network traffic forwarding method for a cloud computing system according to the first aspect.

[0038] The embodiment of the present application provides a public network traffic forwarding method, device, equipment and medium for a cloud computing system, wherein the public network traffic forwarding method for a cloud computing system is configured to build a cloud computing system by deploying a virtual switch and a virtual machine on a host computer and deploying a virtualized gateway on a cloud computing gateway, so that only the first message of the public network traffic in the cloud computing network is forwarded and processed by the gateway node to generate a high-speed forwarding table, and the gateway node is not required to participate in the forwarding of all other non-first messages, and the high-speed forwarding table and the host computer information table are directly used to forward the public network traffic between host computers, thereby solving the technical problems of high load of the gateway node and high delay of the public network traffic forwarding, greatly improving the forwarding efficiency of the public network traffic in the cloud computing network, and greatly reducing the loss and load pressure of the gateway node. BRIEF DESCRIPTION OF DRAWINGS

[0039] Other characteristics, objects and advantages of the present application will become more apparent from the following detailed description of non-restrictive embodiments, made with reference to the accompanying drawings:

[0040] Figure 1 FIG. 1 is a flowchart of a public network traffic forwarding method for a cloud computing system according to an embodiment of the present application;

[0041] Figure 2 FIG. 2 is a flowchart of a public network traffic forwarding method for a cloud computing system according to another embodiment of the present application;

[0042] Figure 3 Figure 3 is a flowchart illustrating a method for public network traffic forwarding in a cloud computing system according to an embodiment;

[0043] Figure 4 Figure 4 is a flowchart illustrating a method for public network traffic forwarding in a cloud computing system according to an embodiment;

[0044] Figure 5 Figure 5 is a flowchart illustrating a method for public network traffic forwarding in a cloud computing system according to an embodiment;

[0045] Figure 6 Figure 6 is a sequence diagram illustrating public network traffic forwarding in a cloud computing system according to an embodiment;

[0046] Figure 7 Figure 7 is a step diagram illustrating public network traffic forwarding in a cloud computing system according to an embodiment;

[0047] Figure 8 Figure 8 is a diagram illustrating a public network message structure in a cloud computing system according to an embodiment;

[0048] Figure 9 Figure 9 is a diagram illustrating a public network message structure in a cloud computing system according to an embodiment;

[0049] Figure 10 Figure 10 is a diagram illustrating a public network message structure in a cloud computing system according to an embodiment;

[0050] Figure 11 Figure 11 is a block diagram illustrating a public network traffic forwarding device in a cloud computing system according to an embodiment;

[0051] Figure 12 Figure 12 is a diagram illustrating an internal structure of a computer device according to an embodiment. DETAILED DESCRIPTION

[0052] The application will be further described below in conjunction with the drawings and embodiments. It can be understood that the specific embodiments described herein are merely intended to explain the related application, but not to limit the application. In addition, it should be noted that only the parts related to the application are shown in the drawings for the convenience of description.

[0053] It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict. The application will be described in detail below with reference to the drawings and embodiments. In addition, the term "and / or" herein merely describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which means that there are three cases of A alone, A and B together, and B alone. The terms "first" and "second" in the description and claims of the embodiments of the present application are used to distinguish different objects, not to describe a specific order of the objects.

[0054] First, the relevant terms involved in the present application are explained:

[0055] Availability zone: refers to a physical area within the same region where power and network are independent of each other.

[0056] Host machine: a container that runs cloud instances, including but not limited to kernel-based virtual machines (kvm), xen, hyper-V, etc.; hyper-V is an open-source virtualization technology used to create and run virtual machines; xen is an open-source virtualization solution that allows multiple operating systems to run on a computer hardware simultaneously.

[0057] Virtual machine: a complete computer system with complete hardware system functions.

[0058] Cloud computing gateway: a software method for establishing a communication channel on an Internet Protocol (IP)-based network, located between multiple breakpoints after the same or different Network Address Translation (NAT) or firewalls, and can realize communication between availability zone networks and the Internet according to the forwarding rules on the gateway cluster.

[0059] Virtual switch: a device in the field of cloud computing that provides Ethernet message forwarding for virtual machines or other types of virtual devices, running on a host machine.

[0060] Access Control List (ACL) rule: a series of conditions used to define how a network device filters and controls data packets, allowing or blocking the transmission of specific traffic through permit or deny actions.

[0061] Media Access Control (MAC) address: also known as physical address or hardware address, burned on the flash chip of the Network Interface Card (NIC) by the network device manufacturer, and is the unique network identifier of each device in the network.

[0062] Public network traffic: refers to public network traffic on the Internet, which can be accessed through public networks and is suitable for all users; public network traffic exists widely in various public platforms and channels, such as search engines, social media, and e-commerce platforms; these platforms have a large user base and extensive dissemination channels, which can bring a large amount of access to websites or applications.

[0063] Private network traffic: refers to the traffic in the private network, usually used in enterprise internal or specific user groups; private network traffic is transmitted through private network, not publicly accessible, only for authorized users; private network traffic is mainly used to improve the security of data transmission and control access rights.

[0064] Public IP: an address allocated by an Internet Service Provider (ISP), which can uniquely identify a device on the Internet; every device connected to the Internet needs a public IP address so that other devices can find and communicate with it through the Internet; public IP addresses are globally unique and can be directly accessed by other devices on the Internet.

[0065] Management IP: also known as private IP, usually used for internal addresses in local area networks such as home networks or enterprise intranets; management IP addresses are unique within the internal network but cannot be directly accessed from the Internet; common private IP address ranges include 10.0.0.0 / 8, 172.16.0.0 / 12, and 192.168.0.0 / 16.

[0066] With the rapid development of network, virtualization and storage technologies, cloud computing technology has become one of the current popular network technologies. With the advent of the cloud computing era, major Internet vendors and enterprises have established their own data centers to support and develop their businesses. The network data in the cloud computing data center is generally divided into two categories: one is east-west traffic that does not access the external network, generally referred to as private network, which does not charge; the other is north-south network that accesses internal and external networks, generally referred to as public network, which needs to be charged.

[0067] With the continuous development of cloud computing field, there are more and more different modes of north-south traffic in cloud computing data center, but they can be classified into two categories: one is public network traffic accessed within the cloud computing system, which does not go out of the cloud computing system; the other is public network traffic accessed outside the cloud computing system, which interacts with the external Internet. Generally, under the same configuration, the east-west network performance is better than the north-south network, and when the north-south traffic needs to pass through the gateway node for processing, the gateway node is easy to reach the performance bottleneck, which affects the network performance and business expansion of the entire cloud computing system, and it is difficult to adapt to the data transmission requirements of the cloud computing system. Therefore, how to realize the fast forwarding of public network traffic within the cloud computing system is particularly important.

[0068] In order to realize the fast forwarding of public network traffic within the cloud computing system, the existing technology adopts the following two solutions:

[0069] Method 1, the virtual machine A forwards all public network traffic to the gateway through the host A, and the gateway performs security policy (such as security group, ACL, etc.) verification and forwards to the host B where the virtual machine B is located.

[0070] Scheme 2, through the cooperation of the gateway node and the intelligent switch, the traffic of each computing node is distributed and processed, the intelligent switch is responsible for the interaction of network data between the computing nodes and is a physical device, which internally includes multiple virtual routers to distribute the traffic of different network segments to different virtual bridges, and can judge the traffic type. For north-south public network traffic, the intelligent switch and the gateway node function need to be processed, that is, the intelligent switch hands over the traffic message to the gateway node for processing, and then forwards to the opposite end.

[0071] It can be understood in combination with the above two solutions that the cloud computing network includes different hosts in the same availability zone and auxiliary forwarding middleware (such as a gateway node or a gateway node and an intelligent switch), and each host is deployed with a virtual machine. All public network traffic forwarding needs to rely on a virtual gateway, which causes the virtual gateway to have a large load pressure and high public network traffic forwarding delay.

[0072] To solve the above technical problems, the application provides a public network traffic forwarding method, device, equipment and medium for a cloud computing system. The public network traffic not going out of the cloud computing is processed in a manner similar to east-west traffic to overcome the technical problems of high load of the gateway node and high delay of public network traffic forwarding.

[0073] The following will be described in combination with Figures 1 to 12 The public network traffic forwarding method, device, equipment and medium for a cloud computing system provided by the application are described, wherein the public network traffic forwarding method for a cloud computing system is applied to a cloud computing system, the cloud computing system includes a first host, a second host and a plurality of cloud computing gateways in the same availability zone for communication. The first host is deployed with a first virtual switch and a first virtual machine, and each cloud computing gateway is deployed with a virtualized gateway.

[0074] In order to facilitate understanding of the public network traffic forwarding method for a cloud computing system provided by the embodiments of the application, the following will be described in detail by the following several exemplary embodiments. It can be understood that the following several exemplary embodiments can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments.

[0075] Reference Figure 1 One of the flowcharts of the public network traffic forwarding method for a cloud computing system provided by the embodiments of the application is as follows Figure 1As shown, the public network traffic forwarding method for the cloud computing system comprises steps 101 and 102.

[0076] Step 101, in the case that the first virtual machine sends the first public network traffic message as a non-first message and the source IP and the opposite end public IP of the first public network traffic message are in different host computers, the first virtual switch determines the second mac address corresponding to the management IP of the second host computer according to the host computer information table, the first high-speed forwarding table and the opposite end public IP of the first public network traffic message, and adds a message header to the first public network traffic message according to the second mac address and the mac address of the second virtual machine public IP and then forwards the first public network traffic message to the second host computer.

[0077] In the first high-speed forwarding table, the corresponding relationship among the public IP, the mac address of the virtual machine public IP and the management IP of the host computer where the virtual machine is located is included, and in the host computer information table, the corresponding relationship between the management IP of the host computer and the mac address is included.

[0078] It should be noted that the cloud computing system provided in the embodiment of the application supports multiple cloud computing gateways and multiple host computers, each cloud computing gateway is a gateway node, each host computer is a host computer node, and each gateway node and each host computer node are deployed on a physical server; all nodes support deployment on the same physical server and also support deployment on separate physical servers; if all nodes are deployed separately, the physical servers can be reached through network layer two.

[0079] The virtualized gateway deployed in each cloud computing gateway can manage the communication between the virtualized resources in the corresponding gateway node and provide public network access services for the cloud computing system.

[0080] Each virtual switch is deployed on the corresponding host computer for network isolation and traffic management; at least can be used for traffic management forwarding and high-speed forwarding table maintenance.

[0081] Each virtualized gateway and each virtual switch has a separate data forwarding module and a data receiving module, the data forwarding module is a software module for receiving network data from the cloud computing state, and the data receiving module is a software module for analyzing and encapsulating network data messages and sending the messages to the cloud computing network.

[0082] All virtualized gateways share a same gateway default mac address, and the gateway default mac address is not an actual physical network card mac address.

[0083] Specifically, in step 101, the first host and the second host can be different hosts in a plurality of hosts contained in a cloud computing system. For the first host, when the first virtual machine thereof has the function of packetizing and forwarding a message, the first virtual switch thereof can receive a first public network traffic message sent from the first virtual machine, and determine whether the first public network traffic message is a first message. When the first public network traffic message is determined to be a non-first message, the management IP of the opposite host can be determined based on the opposite end public network IP of the first public network traffic message from the maintained first high-speed forwarding table, that is, the second management IP of the second host. At this time, the destination mac address in the first public network traffic message can be converted from the default mac address of the virtual gateway to the second mac address of the second virtual machine public network IP recorded in the first high-speed forwarding table, and the management IP of the second host where the second virtual machine is located can be obtained from the first high-speed forwarding table.

[0084] Then, the mac address corresponding to the management IP of the opposite host can be found based on the management IP of the second host from the maintained host information table, that is, the second mac address corresponding to the management IP of the second host is determined. In this way, the user datagram protocol (UDP) outer header can be added to the first public network traffic message based on the second mac address, and the inner message header of the first public network traffic message can be modified based on the mac address of the second virtual machine public network IP, such as modifying the destination mac address in the first public network traffic message to the mac address of the second virtual machine public network IP, and then forwarding to the second host.

[0085] It should be noted that the first high-speed forwarding table is used to record the related information of other internal public network IPs accessed by the first virtual machine in the first host, and is used to realize the fast forwarding of public network traffic and has an aging mechanism. Specifically, the first high-speed forwarding table maintains the related information of the accessed public network IP, which includes the public network IP address, the mac address, the virtual network card ID (network card independent identifier), the virtual network card type, the available zone, and the host management IP where it is located.

[0086] In addition, it should be further noted that not only one virtual machine can be deployed on the same host, but also multiple virtual machines can be deployed on the same host. When multiple virtual machines are deployed on the same host, the virtual switch in the host can directly forward the non-first message through the channel between the host and the virtual machine without adding the outer UDP header.

[0087] Exemplarily, in the case that the first virtual machine and the second virtual machine are deployed on the first host computer at the same time and the first public network traffic message is a non-first message, at this time, the opposite end public network IP and the source end public network IP of the first public network traffic message are in the same first host computer, the first virtual switch determines that the opposite end IP is also in the first host computer by inquiring the first high-speed forwarding table, and then directly forwards the first public network traffic message to the opposite end virtual machine through the channel between the first host computer and the opposite end virtual machine, without adding an outer udp header.

[0088] In step 102, the first virtual switch determines the first virtualization gateway currently running normally from the plurality of virtualization gateways in the case that the first public network traffic message is a first message, forwards the first message through the first virtualization gateway, and generates the first high-speed forwarding table.

[0089] Specifically, when the first virtual machine deployed on the first host computer determines that the first public network traffic message is a first message, the first virtualization gateway currently running normally can be used to forward the first message.

[0090] It should be noted that for each host computer in the cloud computing system, when the virtualization process is started, the heartbeat detection message, the ping packet or the udp message is continuously and periodically sent to each gateway node, the virtualization gateway deployed on the gateway node replies to the received message, and the reply message is sent to the corresponding host computer, and the virtual switch of each host computer continuously receives the reply message, and records whether the corresponding virtualization gateway is running normally, generates a gateway running state table and stores it. Therefore, when the first virtual switch determines that the first public network traffic message is a first message, the first virtualization gateway currently running normally can be determined from the stored gateway running state table, so as to use the first virtualization gateway to complete the forwarding operation of the first message and generate the first high-speed forwarding table.

[0091] The public network traffic forwarding method for the cloud computing system provided by the embodiment of the application builds the cloud computing system by deploying the virtual switch and the virtual machine on the host computer and deploying the virtualization gateway on the cloud computing gateway, so that only the first message of the public network traffic in the cloud computing network is forwarded by the gateway node for processing and generates the high-speed forwarding table, and the gateway node does not need to participate in the forwarding of all other non-first messages of the public network traffic, and only the generated high-speed forwarding table and the host computer information table are used to directly forward the public network traffic between the host computers, thereby solving the technical problems of high load of the gateway node and high delay of the public network traffic forwarding, greatly improving the forwarding efficiency of the public network traffic in the cloud computing network, and greatly reducing the loss and load pressure of the gateway node.

[0092] It can be understood that, considering that the security policy commonly deployed by the gateway node in the prior art verifies the security of the public network traffic message sent by the source virtual machine, the network security of the virtual gateway cannot be guaranteed, therefore, in the embodiment of the present application, the security policy can be deployed on the virtual switch of the host computer, so that the public network traffic message can have high network security whether it passes through the virtual gateway. Based on this, in an example embodiment, the public network traffic forwarding method for the cloud computing system provided by the embodiment of the present application can further include a virtual switch security verification process, and the specific process can be implemented through the following steps.

[0093] In the case of deploying the security policy script on the first virtual switch, the first virtual switch uses the security policy script to perform security checking on the received first public network traffic message, and judges whether the first public network traffic message that passes the security checking is the first message.

[0094] Specifically, when the first virtual switch receives the first public network traffic message sent from the first virtual machine, the security of the first public network traffic message can be verified by using the security policy script first, and after the first public network traffic message passes the security verification, it is further determined whether it is the first message.

[0095] It should be noted that the deployed security policy script can be a script with firewall function, or can also be a password policy script, an access control policy script, a backup and recovery policy script, and a vulnerability management policy script, etc. The present application does not make specific limitation on this.

[0096] In addition, it should be noted that whether the first public network traffic message is the first message can be judged based on whether there is a high-speed forwarding table matched therewith, for example, if there is a first high-speed forwarding table, it is determined that the first public network traffic message is not the first message, and if there is no first high-speed forwarding table, it is determined that the first public network traffic message is the first message.

[0097] Based on the above Figure 1 As shown in the method, in an example embodiment, the step 102 of forwarding the first message through the first virtual gateway, the specific process thereof in the present embodiment can be implemented through steps 201 to 203 as shown in the method. Figure 2

[0098] Step 201, the first virtual switch adds a message header to the first message according to the mac address of the first virtual gateway, and forwards the obtained target message to the first virtual gateway.

[0099] Step 202, the first virtual gateway parses the first message from the target message, and in the case that the public IP of the second virtual machine does not belong to the public IP inside the cloud computing system, forwards the first message to the Internet. ​

[0100] Step 203, in the case that the public IP of the second virtual machine belongs to the public IP inside the cloud computing system, the first virtualization gateway forwards the first packet to the second virtual machine after adding a packet header according to the public network card mac address of the second virtual machine and the management IP of the second host obtained from the public IP information table; the public IP information table includes the public network card mac address of each virtual machine to which each public IP in the cloud computing system belongs and the management IP of each host to which each public IP belongs.

[0101] Specifically, when the first virtual machine and the second virtual machine perform public network interaction communication, the first virtual machine group packet generates a first packet which is first sent to the first virtual switch, the source IP in the first packet is the public IP of the first virtual machine, the destination IP is the public IP of the second virtual machine, the source mac address is the mac address of the public network card of the first virtual machine, and the destination mac address is the mac address of the first virtualization gateway, which is a same gateway default mac address commonly used by all virtualization gateways.

[0102] The first virtual switch queries whether the first high-speed forwarding table exists for the first packet that has passed the security verification, that is, according to the opposite public IP of the first packet, it is judged whether the first high-speed forwarding table is maintained on the first virtual switch, if the first high-speed forwarding table does not exist, it is determined according to the packet type of the first packet that the first packet is an arp request packet, the private network management IP of the first virtualization gateway is obtained, and the outer udp header is assembled and forwarded to the first cloud computing gateway for receiving by the data receiving module of the first virtualization gateway.

[0103] Outside the arp request packet, an additional udp three-layer header is encapsulated, including an outer udp header (transport layer), an outer IP header (network layer), and an outer Ethernet header (network interface layer), the source port of the udp header is a random unoccupied port, and the destination port is a fixed receiving port of the data receiving module of the first virtualization gateway; the source IP of the outer IP header is the management IP of the first host, and the destination IP is the management IP of the first cloud computing gateway; the source mac address of the outer Ethernet header does not need to be configured, and the destination mac address is the mac address of the management IP of the first cloud computing gateway; in this way, a public network unicast form target packet is obtained, which is specifically a udp request packet. It should be noted that the source mac address of the outer Ethernet header does not need to be configured, but the format of the source mac address does not need to be modified after being created, and the default character can be used.

[0104] The first virtualization gateway receives the UDP request message from the first host and parses the same to obtain an ARP request message (i.e., a first message). The first virtualization gateway determines whether the public IP of the second virtual machine belongs to the public IP within the cloud computing system according to the maintained public IP information table.

[0105] If the public IP of the second virtual machine does not belong to the public IP within the cloud computing system (i.e., it is an external public IP), the first virtualization gateway modifies the source mac address of the first message to the mac address of the internet card of the first cloud computing gateway and the upper connected physical switch, and the destination address to the port mac address of the upper connected physical switch, and sends the first message to the upper connected physical switch of the cloud computing gateway through the layer 2 forwarding mode, and then to the internet through the physical switch.

[0106] Conversely, if the public IP of the second virtual machine belongs to the public IP within the cloud computing system (i.e., it is a public IP within the cloud computing system), the first virtualization gateway changes the inner data packet header according to the public network card mac address of the second virtual machine and the management IP of the second host obtained from the public IP information table, assembles the outer UDP header, and then forwards the same to the data receiving module of the second virtual switch in the second host; when the data receiving module of the second virtual switch receives the message, the outer UDP header is removed, the first message without the outer UDP header is verified for security by the second virtual switch, and the first message that passes the security verification is injected into the second virtual machine through the channel between the second host and the second virtual machine.

[0107] It should be noted that the public traffic message sent by the first virtual machine is usually a unicast interactive message. When the unicast interactive message reaches the second virtual machine, the second virtual machine replies to the unicast interactive message to obtain a response message. If the second virtual machine does not have an ARP cache table for the interactive message locally, the second virtual machine obtains the mac address of the first virtual machine public IP by sending an ARP request to the first virtual machine, finally obtains the mac address of the first virtualization gateway (i.e., the default mac address of the virtualization gateway), generates an ARP cache table, and the ARP cache table includes the correspondence between the public IP of the first virtual machine and the default mac address of the virtualization gateway obtained in the same subnet, and the correspondence between the default gateway and the default mac address of the virtualization gateway generated when the subnets are different. The default gateway is the IP for interaction between different subnet segments.

[0108] The second virtual machine sends a reply packet to the first virtual machine, the source IP is the public network IP of the second virtual machine, the destination IP is the public network IP of the first virtual machine, and the reply packet is sent to the second virtual switch; when the second virtual switch does not generate the second high-speed forwarding table, the reply packet is encapsulated with a udp outer header and forwarded to the first virtual gateway; the data forwarding module on the first virtual gateway obtains the public network card mac of the first virtual machine from the public network IP information table as the inner packet destination mac header, uses the default mac of the virtual gateway as the inner packet source mac header, and obtains the management IP of the first host through the public network IP information table, encapsulates the reply packet with a corresponding udp outer header, and sends the reply packet to the first virtual switch; meanwhile, the first virtual gateway instructs the second virtual switch to generate the second high-speed forwarding table; the second high-speed forwarding table includes the correspondence among the public network IP accessed by the second virtual machine, the mac address of the virtual machine public network IP, and the management IP of the host where the virtual machine is located.

[0109] When the first virtual switch receives the reply packet, the first virtual switch performs security verification on the reply packet and injects the reply packet into the first virtual machine through the channel between the first host and the first virtual machine.

[0110] Based on the above Figure 2 In an example embodiment, the first virtual gateway in step 203 can instruct the first virtual switch to update the high-speed forwarding table while forwarding the first packet; based on this, in an example embodiment, the public network traffic forwarding method for a cloud computing system provided by the embodiment of the application can further include a high-speed forwarding table updating process, and the specific process of the high-speed forwarding table updating process can be implemented by steps 301 to 304 shown in Figure 3

[0111] Step 301: The first virtual gateway instructs the first virtual switch to update the high-speed forwarding table while forwarding the packet to the second virtual machine.

[0112] Step 302: The first virtual switch responds to the high-speed forwarding table updating instruction and queries whether the first high-speed forwarding table exists.

[0113] Step 303: If the first high-speed forwarding table exists, the first virtual switch updates the active time of the first high-speed forwarding table.

[0114] Step 304: If the first high-speed forwarding table does not exist, the first virtual switch creates the first high-speed forwarding table.

[0115] ​Specifically, when the first virtual switch receives the high-speed forwarding table update instruction issued from the first virtualization gateway, the first virtual switch can query whether the first high-speed forwarding table exists by taking the public IP as an identifier. If the first high-speed forwarding table already exists, the first virtual switch refreshes the active time of the first high-speed forwarding table. Otherwise, if the first high-speed forwarding table does not exist, the first virtual switch can create the first high-speed forwarding table in the process of forwarding the first packet from the first virtual machine to the second virtual machine by using the first virtualization gateway.

[0116] It should be noted that, if the response packet generated by the second virtual machine on the opposite end in reply to the received first packet is a first packet to be sent by the second virtual machine, the second virtual machine can query whether the second high-speed forwarding table exists. If the second high-speed forwarding table exists, the second virtual machine can forward the response packet to the first virtual machine by using the second high-speed forwarding table and the host information table without passing through the gateway node. Otherwise, if the second high-speed forwarding table does not exist, the second virtual machine can create the second high-speed forwarding table in the process of sending the response packet to the first virtual machine by using the first virtualization gateway.

[0117] In this way, when the first virtual machine continues to transmit the public network traffic packet to the second virtual machine, the first virtual switch obtains the opposite public IP of the public network traffic packet, finds that the first high-speed forwarding table exists, and converts the destination mac address in the packet from the default mac address of the virtualization gateway to the mac address of the public IP of the second virtual machine according to the information of the first high-speed forwarding table. Then, the first virtual switch obtains the management IP of the second host in which the second virtual machine is located from the first high-speed forwarding table, obtains the mac address corresponding to the IP of the second host by using the host information table, encapsulates the outer header of the udp, and directly forwards the packet to the second host.

[0118] The data receiving module of the second virtual switch in the second host receives the packet, performs security verification on the packet, and forwards the packet to the second virtual machine in the second host

[0119] The packet transmitted by the second virtual machine to the first virtual machine is also forwarded based on the second high-speed forwarding table maintained on the second virtual switch.

[0120] It should be noted that, if it is determined by the first high-speed forwarding table and the second high-speed forwarding table that the first virtual machine and the second virtual machine are located on the same host, the packet of the first virtual machine is directly injected back to the public network card of the second virtual machine by the first virtual switch.

[0121] Based on the above Figure 1 In an example embodiment, the first virtual switch updates the active time of the first high-speed forwarding table in step 303. The specific process can be implemented by the following steps in this embodiment.

[0122] In a case where a first time difference between the latest active time corresponding to the first high-speed forwarding table and a current time of the first host computer is less than a preset time threshold, the latest active time is modified to the current time.

[0123] The preset time threshold can be a pre-set fixed threshold.

[0124] Specifically, whether the time difference between the latest active time of the high-speed forwarding table and the current time of the host computer is greater than the fixed threshold is judged by a single task. If the time difference is less than the fixed threshold, no operation is performed. If the time difference is greater than or equal to the fixed threshold, the corresponding high-speed forwarding table is directly deleted. In addition, for the first virtual switch, the hit time of each packet forwarding operation completed by using the first high-speed forwarding table can be recorded. Each hit can be considered as one active time of the first high-speed forwarding table. Each hit time is the corresponding active time. In this way, when the first virtual switch responds to the high-speed forwarding table update instruction, it can be considered that the first high-speed forwarding table is hit this time. At this time, only the latest active time needs to be refreshed, that is, the latest active time corresponding to the first high-speed forwarding table is modified to the current time. In this way, the purpose of updating the active time of the first high-speed forwarding table is achieved.

[0125] It can be understood that, before the source host computer and the opposite host computer in the same availability zone communicate, the mac address of the opposite host computer needs to be obtained first. Therefore, the process of obtaining the mac address of the opposite host computer can be performed before step 101. The specific process can be implemented by steps 401 to 405 shown in FIG. 4. Figure 4

[0126] In step 401, the first virtual machine sends an arp request packet to the first virtual switch. The arp request packet is used to request to obtain the mac address of the second virtual machine.

[0127] In step 402, the first virtual switch performs security verification on the arp request packet, adds corresponding udp header information to the arp request packet that passes the security verification, and sends the obtained udp request packet to the second virtualized gateway. The second virtualized gateway is a normally running virtualized gateway in a plurality of virtualized gateways.

[0128] In step 403, the second virtualized gateway parses the arp request packet from the udp request packet, adds corresponding udp header information to the arp request packet after replying to the arp request packet, and forwards the obtained udp response packet to the first host computer.

[0129] In step 404, the first virtual switch in the first host computer parses the arp response packet from the udp response packet, and forwards the arp response packet to the first virtual machine.

[0130] ​Step 405, the first virtual machine generates an ARP cache table according to the received ARP response packet; the ARP cache table is used to store the mapping relationship between IP and mac address, and the ARP cache table includes the corresponding relationship between the public IP of the first virtual machine and the default mac address of the virtual gateway in the same subnet and the corresponding relationship between the default gateway and the default mac address of the virtual gateway generated when the subnets are different.

[0131] It should be noted that the first virtual gateway and the second virtual gateway can be the same or different.

[0132] Specifically, for the ARP request packet sent by the first virtual machine, if the public IP of the second virtual machine and the public IP of the first virtual machine are in the same subnet, the destination IP of the ARP request packet is the public IP of the second virtual machine; otherwise, if the public IP of the second virtual machine and the public IP of the first virtual machine are not in the same subnet, the destination IP of the ARP request packet is the default gateway IP.

[0133] The first virtual switch can perform security verification on the received ARP request packet from the first virtual machine, and obtain the private network management IP of the second virtual gateway for the ARP request packet that passes the security verification, and assemble the outer layer udp header information using the private network management IP of the second virtual gateway, that is, additionally encapsulate the udp three-layer header outside the ARP request packet, including the outer layer udp header (transport layer), the outer layer IP header (network layer), and the outer layer Ethernet header (network interface layer), the source port of the udp header is a random unoccupied port, and the destination port is a fixed receiving port of the data receiving module of the second virtual gateway; the source IP of the outer layer IP header is the management IP of the first host, and the destination IP is the management IP of the first cloud computing gateway; the source mac address of the outer layer Ethernet header does not need to be configured, and the destination mac address is the mac address of the management IP of the second cloud computing gateway obtained by querying the host information table; in this way, the udp request packet is obtained, and the udp request packet is forwarded to the second virtual gateway, which is received by the data receiving module of the second virtual gateway.

[0134] The second virtualization gateway receives the udp request message from the first host, unpacks to obtain the inner packet, that is, an arp request packet, judges that the arp request packet is an arp request message, and generates an arp response packet based on the arp request packet to reply to the arp request packet, that is, sets the source mac of the arp request message as the destination mac of the arp response message, sets the default mac address of the gateway as the source mac of the arp response message, sets the source IP of the arp request message as the destination IP, sets the destination IP of the arp request message as the source IP, changes the type of the arp message from the request message to the response message, assembles an outer udp header to obtain a udp response message, and forwards the udp response message to the first host where the first virtual machine is located.

[0135] For example, the source port of the udp response message is a random unoccupied port, the destination port is a fixed receiving port of a data receiving module of the first virtual switch, the destination mac address queries a host information table, the mac address corresponding to the management IP of the first host where the first virtual machine is located is obtained as the opposite mac address according to the management IP of the first host where the first virtual machine is located, the management IP of the second virtualization gateway where the cloud computing gateway is located is set as the source IP, and the management IP of the first host where the first virtual machine is located is set as the destination IP, and the udp response message is forwarded to the first host where the first virtual machine is located.

[0136] The first virtual machine receives the udp response message sent by the second virtualization gateway, obtains the inner arp response message, and forwards the arp response message to the corresponding first virtual machine according to the destination IP of the arp response message.

[0137] The first virtual machine generates an arp cache table according to the received arp response message, that is, an IP address and mac address correspondence relationship, the IP address is the source IP of the arp response message (different correspondence relationships are generated according to whether the IP addresses are in the same subnet), and the mac address is the default mac address of the virtualization gateway.

[0138] In an example embodiment, the public network traffic forwarding method for a cloud computing system provided by the embodiment of the present application can further include an information table creation process, and the specific process can be implemented by steps 501 and 502 shown in the figure. Figure 5 The steps 501 and 502 are implemented.

[0139] In the case where the cloud computing system includes a plurality of hosts including the first host and the second host, the current host address information of each host is periodically broadcast to the plurality of virtualization gateways, and the current host address information includes the management IP of the corresponding host and the mac address corresponding to the management IP.

[0140] Step 502, each virtualization gateway summarizes all the received current host address information to obtain a host information table.

[0141] It should be noted that the cloud computing system can include a plurality of hosts including the first host and the second host, the host information table can exist on the virtualization gateway and the virtual machine switch at the same time, each host starts a virtualization process and broadcasts the current host information to the virtualization gateway in time, each current host information includes the management IP of the corresponding host and the mac address corresponding to the management IP and other information, the virtualization gateway summarizes all the received current host information to generate the host information table and deliver it to the host and store it on the virtual switch of the host.

[0142] For example, referring to the cloud computing internal public network traffic forwarding sequence diagram shown in Figure 6 and the cloud computing internal public network traffic forwarding step diagram shown in Figure 7 , in Figure 6 and Figure 7 , the host A is the first host, the virtual machine A is the first virtual machine, the virtual switch A is the first virtual switch, the high-speed forwarding table in the virtual switch A is the first high-speed forwarding table, the host B is the second host, the virtual machine B is the second virtual machine, the virtual switch B is the second virtual switch, Figure 6 the virtualization gateway in Figure 7 may be the first virtualization gateway or the second virtualization gateway.

[0143] For example, referring to the cloud computing internal public network message structure change diagram one shown in Figure 8 , the cloud computing internal public network message structure change diagram two shown in Figure 9 and the cloud computing internal public network message structure change diagram three shown in Figure 10 , Figures 8 to 10 the cloud computing internal public network traffic forwarding step shown in Figure 7 is described in detail with a specific public network traffic message instance.

[0144] It should be noted that although the operations of the method of the present application are described in a specific order in the accompanying drawings, this does not require or imply that the operations must be performed in that specific order, or that all of the shown operations must be performed to achieve the desired result. On the contrary, the steps depicted in the flowchart can change the order of execution. Additionally or alternatively, some steps can be omitted, combined into one step, and / or divided into multiple steps.

[0145] In one embodiment, the embodiment of the present application also provides a public network traffic forwarding device for a cloud computing system, wherein the cloud computing system comprises a first host, a second host and a plurality of cloud computing gateways which communicate in the same availability zone, the first host is deployed with a first virtual switch and a first virtual machine, and each cloud computing gateway is deployed with a virtualized gateway; as shown in a structural block diagram of the public network traffic forwarding device, the public network traffic forwarding device 1100 for the cloud computing system comprises a first forwarding unit 1101 and a second forwarding unit 1102. Figure 11 The public network traffic forwarding device 1100 for the cloud computing system comprises a first forwarding unit 1101 and a second forwarding unit 1102.

[0146] The first forwarding unit 1101 is configured to, in a case where the first virtual switch determines that the first public network traffic message sent by the first virtual machine is a non-first message and the source end IP and the opposite end public network IP of the first public network traffic message are located in different hosts, determine a second mac address corresponding to a management IP of the second host according to a host information table, a first high-speed forwarding table and the opposite end public network IP of the first public network traffic message, and add a message header to the first public network traffic message according to the second mac address and a mac address of a second virtual machine public network IP and then forward the first public network traffic message to the second host; the second virtual machine is deployed on the second host.

[0147] The second forwarding unit 1102 is configured to, in a case where the first virtual switch determines that the first public network traffic message is a first message, determine a first virtualized gateway which is currently running normally from the plurality of virtualized gateways, and forward the first message through the first virtualized gateway and generate a first high-speed forwarding table.

[0148] The first high-speed forwarding table comprises a corresponding relationship among a public network IP, a mac address of a virtual machine public network IP and a host management IP where the virtual machine is located, and the host information table comprises a corresponding relationship between a host management IP and a mac address.

[0149] In one embodiment, the device provided by the embodiment of the present application further comprises a security verification unit configured to, in a case where a security policy script is deployed on the first virtual switch, utilize the security policy script by the first virtual switch to perform security verification on the received first public network traffic message, and determine whether the first public network traffic message which passes the security verification is a first message.

[0150] In one embodiment, the second forwarding unit 1102 is specifically configured to add a packet header to the first packet according to the mac address of the first virtualization gateway, and forward the obtained target packet to the first virtualization gateway; the first virtualization gateway parses the first packet from the target packet, and in the case that the public IP of the second virtual machine does not belong to the public IP inside the cloud computing system, forwards the first packet to the Internet; in the case that the public IP of the second virtual machine belongs to the public IP inside the cloud computing system, the first virtualization gateway adds a packet header to the first packet according to the public network card mac address of the second virtual machine and the management IP of the second host obtained from the public IP information table, and forwards the first packet to the second virtual machine; the public IP information table includes the public network card mac address of each virtual machine to which each public IP in the cloud computing system belongs and the management IP of each host to which each public IP belongs.

[0151] In one embodiment, the second forwarding unit 1102 is specifically configured to issue a high-speed forwarding table update instruction to the first virtual switch while forwarding the packet to the second virtual machine; the first virtual switch queries whether the first high-speed forwarding table exists in response to the high-speed forwarding table update instruction; if the first high-speed forwarding table exists, the first virtual switch updates the active time of the first high-speed forwarding table; if the first high-speed forwarding table does not exist, the first virtual switch creates the first high-speed forwarding table.

[0152] In one embodiment, the second forwarding unit 1102 is specifically configured to modify the latest active time to the current time in the case that the first time difference between the latest active time corresponding to the first high-speed forwarding table and the current time of the first host is less than the preset time threshold.

[0153] In one embodiment, the apparatus provided by the embodiments of the present application further comprises a packet assembly and forwarding unit, configured to send, by the first virtual machine, an arp request message to the first virtual switch, the arp request message being used to request the mac address of the second virtual machine; the first virtual switch performs security check on the arp request message, and adds corresponding udp header information to the arp request message that passes the security check, and sends the obtained udp request message to the second virtualized gateway; the second virtualized gateway is a normally running virtualized gateway in the plurality of virtualized gateways; the second virtualized gateway parses the arp request message from the udp request message, adds corresponding udp header information to the arp request message after replying to the arp request message, and forwards the obtained udp response message to the first host; the first virtual switch in the first host parses the arp response message from the udp response message, and forwards the arp response message to the first virtual machine; the first virtual machine generates an arp cache table according to the received arp response message; the arp cache table is used to store the mapping relationship between IP and mac address, and the arp cache table includes the correspondence between the public IP of the first virtual machine and the default mac address of the virtualized gateway in the same subnet, and the correspondence between the default gateway and the default mac address of the virtualized gateway generated in different subnets.

[0154] In one embodiment, the apparatus provided by the embodiments of the present application further comprises an information table creating unit, configured to, in the case that the cloud computing system comprises a plurality of hosts including the first host and the second host, periodically broadcast, by each host, current host address information to the plurality of virtualized gateways, the current host address information including the management IP of the corresponding current host and the mac address corresponding to the management IP; and perform, by each virtualized gateway, statistical summary on all the received current host address information, to obtain a host information table.

[0155] It should be understood that the units described in the public network traffic forwarding apparatus for a cloud computing system correspond to the respective steps in the method described with reference to Figure 1 The operations and features described above with respect to the method also apply to the public network traffic forwarding apparatus for a cloud computing system and the units contained therein, and will not be described here. The public network traffic forwarding apparatus for a cloud computing system can be pre- implemented in the browser or other security application of the computer device, or can be loaded into the browser or security application thereof of the computer device through downloading or the like. The corresponding units in the public network traffic forwarding apparatus for a cloud computing system can cooperate with the units in the computer device to realize the schemes of the embodiments of the present application.

[0156] Reference is made below to Figure 12 which shows a structural schematic diagram of a computer system 1200 of a computer device or server suitable for realizing the embodiments of the present application.

[0157] like Figure 12 As shown, the computer system 1200 includes a central processing unit (CPU) 1201, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 1202 or a program loaded from storage section 1208 into random access memory (RAM) 1203. The RAM 1203 also stores various programs and data required for the operation of the computer system 1200. The CPU 1201, ROM 1202, and RAM 1203 are interconnected via a bus 1204. An input / output (I / O) interface 1205 is also connected to the bus 1204.

[0158] The following components are connected to the input / output (I / O) interface 1205: an input section 1206 including a keyboard, mouse, etc.; an output section 1207 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1208 including a hard disk, etc.; and a communication section 1209 including a network interface card such as a LAN card, modem, etc. The communication section 1209 performs communication processing via a network such as the Internet. A drive 1210 is also connected to the input / output (I / O) interface 1205 as needed. A removable medium 1211, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on the drive 1210 as needed so that computer programs read from it can be installed into the storage section 1208 as needed.

[0159] Specifically, according to embodiments of this application, the above references Figure 1 The described process can be implemented as a computer software program. For example, embodiments of this application include a computer program product comprising a computer program tangibly embodied on a machine-readable medium, the computer program containing instructions for performing... Figure 1 The program code for the method. In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 1209, and / or installed from the removable medium 1211.

[0160] It should be noted that the computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium or a combination thereof. The computer-readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a computer-readable storage medium can include, but are not limited to, the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the present application, a computer-readable storage medium can be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. In the present application, a computer-readable signal medium can include a computer-readable storage medium and can also include a computer-readable propagation medium, which can be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The computer-readable medium can have been made or become, for example, by being processed into a tangible medium from or in connection with one or more computer-readable signal media or transitory media, which can include a computer-readable storage medium or combination of the foregoing. The program code can be transmitted using any suitable medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0161] The computer program product of the present application can be implemented by a hardware component, for example, an integrated circuit or a microprocessor, or by a combination of hardware components and software components. The embodiments of the present application can be implemented by a series of software functions. The software functions can be stored in a computer-readable storage medium, for example, a RAM, a floppy disk, a CD-ROM, a ROM, or a FLASH memory. The software functions can be read by a computer and executed so as to implement the embodiments of the present application.

[0162] The units or modules described in the embodiments of the present application can be implemented in the form of software or in the form of hardware. The described units or modules can also be arranged in a processor. In some cases, the names of the units or modules do not constitute a limitation on the units or modules themselves.

[0163] As another aspect, the present application also provides a computer readable storage medium, which can be included in the computer device described in the above embodiments, or can exist separately and not be assembled into the computer device. The computer readable storage medium stores one or more programs, when the programs are used by one or more processors to execute the methods described in the present application. For example, the computer readable storage medium can store the following programs. Figure 1 Each step of the method shown.

[0164] The embodiments of the present application provide a computer program product, which includes instructions that, when executed, cause the method described in the embodiments of the present application to be performed. For example, the computer program product can store the following programs. Figure 1 Each step of the method shown.

[0165] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when executed, can include the processes of the above-mentioned embodiment methods. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., without being limited thereto. The processor involved in the embodiments provided in the present application can be a general processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., without being limited thereto.

[0166] The above description is merely preferred embodiments of the present application and a description of the principles of the technology used. Those skilled in the art should understand that the scope of the application involved in the present application is not limited to the technical solutions formed by the specific combinations of the above technical features, and also covers other technical solutions formed by any combination of the above technical features or equivalent features without departing from the inventive concept. For example, the above features can be replaced with technical features disclosed in the present application (but not limited to) having similar functions to form technical solutions.

Claims

1. A public network traffic forwarding method for a cloud computing system, characterized in that, The cloud computing system comprises a first host, a second host and a plurality of cloud computing gateways in communication within the same availability zone, wherein the first host is provided with a first virtual switch and a first virtual machine, the second virtual machine is provided on the second host, and each cloud computing gateway is provided with a virtualized gateway; all the virtualized gateways share a same gateway default mac address, which is not an actual physical network card mac address; the method comprises the following steps: In a case where the first virtual switch determines that the first public network traffic message sent by the first virtual machine is a non-first message and the source end IP and the opposite end public network IP of the first public network traffic message are located in different hosts, the second mac address corresponding to the management IP of the second host is determined according to the host information table, the first high-speed forwarding table and the opposite end public network IP, the udp outer header is added to the first public network traffic message according to the second mac address, the destination mac address in the first public network traffic message is modified into the mac address of the public network IP of the second virtual machine, and then the first public network traffic message is forwarded to the second host; the destination mac address is the gateway default mac address; In a case where the first virtual switch determines that the first public network traffic message is a first message, the first message is forwarded through the first virtualized gateway and the first high-speed forwarding table is generated; wherein the first high-speed forwarding table comprises the corresponding relationship among the public network IP, the mac address of the virtual machine public network IP and the management IP of the host where the virtual machine is located, and the host information table comprises the corresponding relationship between the management IP of the host and the mac address; Before the first virtual switch determines whether the first public network traffic message is a first message, the method further comprises the following steps: The first virtual machine sends an arp request message to the first virtual switch, wherein the arp request message is used to request the mac address of the second virtual machine; The first virtual switch performs security check on the arp request message, adds the corresponding udp header information to the arp request message that passes the security check, and sends the obtained udp request message to the second virtualized gateway; The second virtualized gateway parses the arp request message from the udp request message, adds the corresponding udp header information to the reply of the arp request message, obtains the udp response message, and forwards the udp response message to the first host; The first virtual switch in the first host parses the arp response message from the udp response message, and forwards the arp response message to the first virtual machine; The first virtual machine generates an arp cache table according to the received arp response message; wherein the arp cache table is used to store the mapping relationship between IP and mac address, and the arp cache table comprises the corresponding relationship between the public network IP of the second virtual machine in the same subnet and the gateway default mac address and the corresponding relationship between the default gateway IP and the gateway default mac address generated in different subnets; The second virtualized gateway and the second virtualized gateway are normal virtualized gateways in the plurality of virtualized gateways.

2. The method of claim 1, wherein, In the case that the security policy script is deployed on the first virtual switch, the method further comprises: The first virtual switch uses the security policy script to perform security check on the received first public network traffic message, and judges whether the first public network traffic message passing the security check is the first message.

3. The method of claim 1, wherein, The forwarding of the first message through the first virtualization gateway comprises: The first virtual switch adds a message header to the first message according to the mac address of the first virtualization gateway, and forwards the obtained target message to the first virtualization gateway; The first virtualization gateway parses the first message from the target message, and in the case that the public IP of the second virtual machine does not belong to the public IP inside the cloud computing system, forwards the first message to the Internet; In the case that the public IP of the second virtual machine belongs to the public IP inside the cloud computing system, the first virtualization gateway adds a message header to the first message according to the public network card mac address of the second virtual machine and the management IP of the second host obtained from the public IP information table, and forwards the first message to the second virtual machine; the public IP information table includes the public network card mac address of each virtual machine belonging to the cloud computing system and the management IP of each host belonging to it.

4. The method of claim 3, wherein, The method further comprises: The first virtualization gateway issues a high-speed forwarding table update instruction to the first virtual switch while forwarding the message to the second virtual machine; The first virtual switch responds to the high-speed forwarding table update instruction and queries whether the first high-speed forwarding table exists; If the first high-speed forwarding table exists, the first virtual switch updates the active time of the first high-speed forwarding table; If the first high-speed forwarding table does not exist, the first virtual switch creates the first high-speed forwarding table.

5. The method of claim 4, wherein, The updating of the active time of the first high-speed forwarding table comprises: In the case that the first time difference between the latest active time corresponding to the first high-speed forwarding table and the current time of the first host is less than the preset time threshold, the latest active time is modified to the current time.

6. The method according to any one of claims 1 to 5, characterized in that, The method further comprises: In the case that the cloud computing system includes a plurality of hosts including the first host and the second host, each of the hosts periodically broadcasts current host address information to a plurality of virtualization gateways, the current host address information including the management IP of the corresponding host and the mac address corresponding to the management IP; Each of the virtualization gateways aggregates and counts all the received current host address information to obtain the host information table.

7. A public network traffic forwarding device for a cloud computing system, characterized in that, The cloud computing system includes a first host, a second host and a plurality of cloud computing gateways for communication in the same availability zone, a first virtual switch and a first virtual machine are deployed on the first host, and a virtualization gateway is deployed on each of the cloud computing gateways; All the virtualization gateways share a same gateway default mac address, which is not an actual physical network card mac address; The apparatus is configured to perform the method of claim 1; and the apparatus comprises: The first forwarding unit is configured to, in a case where the first virtual switch determines that the first public network traffic message sent by the first virtual machine is a non-first message and source end IP and opposite end public network IP of the first public network traffic message are located in different host computers, determine a second mac address corresponding to a management IP of the second host computer according to a host computer information table, a first high-speed forwarding table and the opposite end public network IP, add a message header to the first public network traffic message according to the second mac address and a mac address of a public network IP of the second virtual machine, and then forward the first public network traffic message to the second host computer; and the second virtual machine is deployed on the second host computer; The second forwarding unit is configured to, in a case where the first virtual switch determines that the first public network traffic message is a first message, determine a first virtualization gateway currently running normally from a plurality of virtualization gateways, forward the first message through the first virtualization gateway, and generate the first high-speed forwarding table. The first high-speed forwarding table includes a corresponding relationship among a public network IP, a mac address of a virtual machine public network IP and a management IP of a host computer where the virtual machine is located, which are accessed by the first virtual machine, and the host computer information table includes a corresponding relationship between a host computer management IP and a mac address.

8. A computer device comprising a processor, a memory, and a computer program stored on the memory and executable on the processor, characterized in that, The computer program is executed by the processor to implement the public network traffic forwarding method for a cloud computing system according to any one of claims 1 to 6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the public network traffic forwarding method for a cloud computing system according to any one of claims 1 to 6.

Images