Virtual machine subnet flow control method, device and equipment and storage medium
By employing automated virtual machine subnet creation in the network test range, combined with VLAN and VXLAN isolation methods, the issues of virtual machine access efficiency and security isolation were resolved, enabling efficient and secure network configuration and operation and maintenance tasks.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-01-28
- Publication Date
- 2026-04-10
AI Technical Summary
In existing technologies, the virtual machine access methods in network test ranges suffer from operational efficiency bottlenecks, lack a unified operation entry point, and the VNC protocol does not support batch command issuance, resulting in high response latency, low bandwidth utilization, and coarse security isolation granularity, which can easily lead to task failure due to dynamic port allocation or token invalidation.
The range orchestration and management system automatically creates virtual machine subnets, generates network configuration policies, and adopts a depth-based security system with network isolation and two-layer traffic isolation, including VLAN and VXLAN isolation. Combined with a central database to store metadata, it supports batch operation and maintenance tasks.
It enables automated network configuration, avoids topology errors and policy conflicts, improves configuration accuracy and security, effectively blocks unauthorized communication across subnets and tenants, and enhances the efficiency and reliability of operation and maintenance tasks.
Smart Images
Figure CN121841818A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of range communication technology, and in particular to virtual machine subnet traffic control methods, apparatus, devices and storage media. Background Technology
[0002] Current network testbeds typically employ an architecture that combines an upper-layer simulation orchestration system with an underlying cloud platform. The upper-layer system uses APIs provided by cloud computing platforms (such as OpenStack and Kubernetes) to schedule virtual machine resources and construct network topologies. In this architecture, graphical access to target virtual machines generally relies on a native VNC console or a web-based NOVNC proxy (such as nova-novncproxy).
[0003] However, this access method has significant operational efficiency bottlenecks. First, each virtual machine needs to obtain VNC connection parameters (such as token and port number) separately, lacking a unified operation entry point and making it difficult to support concurrent access from multiple nodes. Second, the VNC protocol itself does not support batch command issuance, so operations and maintenance personnel can only rely on third-party tools to poll each virtual machine individually when performing tasks such as configuration updates, status inspections, or fault recovery. This not only leads to high response latency and low bandwidth utilization, but also makes tasks prone to failure in large-scale test environments due to dynamic port allocation or token expiration.
[0004] The above content is only used to help understand the technical solution of the present invention and does not represent an admission that the above content is prior art. Summary of the Invention
[0005] The main purpose of this application is to provide a method, apparatus, device and storage medium for managing virtual machine subnet traffic, aiming to solve the technical problems of network configuration being highly dependent on manual intervention and coarse security isolation granularity in existing solutions.
[0006] To achieve the above objectives, this application provides a method for controlling virtual machine subnet traffic, the method comprising: Based on the subnet creation business requirements of the target range orchestration management system, the corresponding target virtual machine subnet is automatically created. Create corresponding virtual network interface cards (NICs) for the virtual machines in the target virtual machine subnet, and connect the virtual NICs to the service bridge; Perform security isolation on the target virtual machine subnet; Based on the target virtual machine subnet after security isolation, generate the corresponding network configuration policy; The network configuration policy is sent to the service bridge so that the service bridge forwards the traffic output by the target virtual machine subnet through the virtual network card based on the network configuration policy.
[0007] In one embodiment, the security isolation includes network isolation and two-layer traffic isolation; The steps for security isolation of the target virtual machine subnet include: Perform network isolation on the target virtual machine subnet; Assign a corresponding two-layer isolation identifier to the target virtual machine subnet, and perform two-layer traffic isolation on the target virtual machine subnet based on the two-layer isolation identifier of the target virtual machine subnet.
[0008] In one embodiment, the dual-layer isolation identifier includes a virtual local area network identifier and a virtual extended local area network identifier; The steps for performing two-layer traffic isolation on the target virtual machine subnet based on the two-layer isolation identifier of the target virtual machine subnet include: Based on the virtual LAN identifier of the target virtual machine subnet, set the traffic label of the virtual network interface card of the target virtual machine subnet; Traffic isolation is performed on the target virtual machine subnet based on the traffic tags of the virtual network interface card of the target virtual machine subnet; Bind the virtual LAN identifier of the virtual machine subnet to the virtual extended LAN identifier of the virtual machine subnet to obtain the isolation identifier mapping relationship; Based on the isolation identifier mapping relationship, traffic isolation is performed on the target virtual machine subnet.
[0009] In one embodiment, the step of network isolation of the target virtual machine subnet includes: Create a separate network namespace; The virtual network interface card of the target virtual machine subnet is moved into the network namespace to achieve network isolation of the target virtual machine subnet through the network namespace.
[0010] In one embodiment, after the step of sending the network configuration policy to the service bridge so that the service bridge forwards the traffic output by the target virtual machine subnet through the virtual network card based on the network configuration policy, the method further includes: The key metadata of the virtual machines in the target virtual machine subnet is stored in the central database. The key metadata includes at least the virtual machine internal address, remote login protocol service port, login username, login password, subnet identifier, network namespace name, virtual network card interface name, and virtual extended LAN identifier. Upon receiving a batch maintenance task, the target virtual machine is determined based on the batch maintenance task; Based on the target virtual machine, extract the corresponding target metadata from the central database; Based on the target metadata, generate batch operation scripts; Based on the target operation mode, the batch operation script is executed to complete the batch operation and maintenance task.
[0011] In one embodiment, the method further includes: When the target virtual machine does not have the remote login protocol service enabled, the target operation mode is determined to be the normal operation mode; When the target virtual machine enables the remote login protocol service, the target operation mode is determined to be the precise operation mode.
[0012] In one embodiment, the step of executing the batch operation script based on the target operation mode includes: When the target operation mode is the precise operation mode, the target network namespace is determined based on the subnet identifier and network namespace name of the target virtual machine, and the batch operation script is executed in the target network namespace. When the target operation mode is the normal operation mode, the batch operation script is executed by logging into the target virtual machine based on the virtual machine's internal address and remote login protocol service port.
[0013] Furthermore, to achieve the above objectives, this application also proposes a virtual machine subnet traffic control device, which includes: The security isolation module is used to automatically create the corresponding target virtual machine subnet based on the subnet creation business requirements of the target range orchestration management system; The security isolation module is also used to create corresponding virtual network cards for virtual machines in the target virtual machine subnet and connect the virtual network cards to the service bridge; The security isolation module is also used to perform security isolation on the target virtual machine subnet; The network configuration module is used to generate corresponding network configuration policies based on the target virtual machine subnet after security isolation. The traffic control module is used to send the network configuration policy to the service bridge, so that the service bridge forwards the traffic output by the target virtual machine subnet through the virtual network card based on the network configuration policy.
[0014] In addition, to achieve the above objectives, this application also proposes a virtual machine subnet traffic management device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor, the computer program being configured to implement the steps of the virtual machine subnet traffic management method described above.
[0015] In addition, to achieve the above objectives, the present invention also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the virtual machine subnet traffic control method described above.
[0016] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the virtual machine subnet traffic control method described above.
[0017] This application provides a method for managing virtual machine subnet traffic. Based on the subnet creation business requirements of the target range orchestration management system, it automatically creates corresponding target virtual machine subnets; creates corresponding virtual network interfaces (NICs) for the virtual machines in the target virtual machine subnet and connects the virtual NICs to the service bridge; performs security isolation on the target virtual machine subnet; generates corresponding network configuration policies based on the securely isolated target virtual machine subnet; and sends the network configuration policies to the service bridge so that the service bridge forwards the traffic output from the target virtual machine subnet through the virtual NICs based on the network configuration policies. This application can automatically complete network configuration, avoiding topology errors or policy conflicts caused by manual configuration, ensuring the accuracy of configuration. It adopts a depth-based security isolation system with network isolation superimposed on two layers of traffic isolation, effectively blocking unauthorized communication paths across subnets and tenants, ensuring communication security, and solving the technical problems of traditional solutions where network configuration is highly dependent on manual intervention and security isolation granularity is coarse. Attached Figure Description
[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0019] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0020] Figure 1 This is a flowchart illustrating an embodiment of the virtual machine subnet traffic control method of this application; Figure 2 This is a schematic diagram of the overall architecture of the virtual machine subnet traffic control method provided in Embodiment 1 of this application; Figure 3 This is a schematic diagram illustrating the security isolation of the virtual machine subnet traffic control method provided in Embodiment 1 of this application; Figure 4 This is a flowchart illustrating Embodiment 2 of the virtual machine subnet traffic control method of this application; Figure 5 A simplified flowchart illustrating the virtual machine subnet traffic control method provided in Embodiment 2 of this application; Figure 6 This is a schematic diagram of the module structure of the virtual machine subnet traffic control device according to an embodiment of this application; Figure 7 This is a schematic diagram of the hardware operating environment involved in the virtual machine subnet traffic control method in this application embodiment.
[0021] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation
[0022] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.
[0023] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.
[0024] The main solution of this application embodiment is as follows: based on the subnet creation service requirements of the target range orchestration management system, automatically create the corresponding target virtual machine subnet; create corresponding virtual network cards for the virtual machines in the target virtual machine subnet and connect the virtual network cards to the service bridge; perform security isolation on the target virtual machine subnet; generate the corresponding network configuration policy based on the security-isolated target virtual machine subnet; send the network configuration policy to the service bridge so that the service bridge forwards the traffic output by the target virtual machine subnet through the virtual network card based on the network configuration policy.
[0025] Currently, traditional access methods suffer from significant operational efficiency bottlenecks. First, each virtual machine needs to obtain VNC connection parameters (such as token and port number) individually, lacking a unified entry point and making it difficult to support concurrent access from multiple nodes. Second, the VNC protocol itself does not support batch command issuance, forcing maintenance personnel to rely on third-party tools to poll each virtual machine individually when performing tasks such as configuration updates, status checks, or fault recovery. This not only leads to high response latency and low bandwidth utilization but also makes tasks highly susceptible to failure in large-scale test environments due to dynamic port allocation or token expiration.
[0026] This application provides a solution that automatically completes network configuration, avoiding topology errors or policy conflicts caused by manual configuration, ensuring configuration accuracy, and adopting a depth-based security isolation system that combines network isolation with dual-layer traffic isolation. This effectively blocks unauthorized communication paths across subnets and tenants, ensuring communication security, and solves the technical problems of traditional solutions where network configuration is highly dependent on manual intervention and security isolation is coarse-grained.
[0027] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or virtual machine subnet traffic management device capable of performing the above functions. This embodiment does not specifically limit this. The following uses a virtual machine subnet traffic management device as an example to describe this embodiment and the following embodiments.
[0028] This application provides a virtual machine subnet traffic control method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the virtual machine subnet traffic control method of this application.
[0029] In this embodiment, the virtual machine subnet traffic control method includes steps S10~S50: Step S10: Based on the subnet creation business requirements of the target range orchestration management system, automatically create the corresponding target virtual machine subnet; It should be noted that prior environmental and basic component preparation is required before the formal implementation of the solution. For the physical network layer, a new service network interface card (NIC) is added to the physical server of the range orchestration management system (MRS), and this NIC is connected to a physical switch. The physical switch is configured in Trunk mode, which allows traffic carrying multiple VLAN tags to pass through, preparing for VLAN isolation in subsequent multi-tenant / multi-service subnets. This establishes a link between the physical server and the external physical network, enabling virtual machine traffic to interact with the SDN network and physical devices through the service NIC. For the Software-Defined Network (SDN) layer, an Open vSwitch (OVS, open-source software virtual switch) is deployed on the server operating system (such as CentOS / Ubuntu) as the data plane of the SDN. It receives flow table instructions from the SDN controller via the OpenFlow protocol, enabling virtual network forwarding, VLAN tagging, VXLAN tunnel encapsulation, and other capabilities. It also creates service bridges, acting as "transfer stations" for virtual traffic, aggregating traffic from virtual and physical NICs.
[0030] Additionally, it should be noted that the reference Figure 2The range orchestration and management system connects to the underlying SDN network controller via a cloud controller (central component) to automate the flow of resource orchestration requirements and network policy issuance. The cloud controller acts as a "translator," converting the business requirement of "creating virtual machine subnets" in the range orchestration and management system into network configuration instructions (such as VLAN / VXLAN allocation, port permissions, flow table rules, etc.) that the SDN controller can recognize. When orchestrating subnets, because the cloud defines subnets with defined IP ranges, it can reserve the last IP address in each subnet IP segment for use by host binding in range orchestration and management, without assigning it a specific IP address. The SDN controller acts as an "executor," issuing configurations (such as allowed VLAN ranges and VXLAN tunnel parameters) to the OVS bridge on the service network interface card, ensuring that network policies are synchronized with the virtual machine lifecycle.
[0031] It is understandable that the range orchestration management system can be any system used for orchestrating and managing network ranges. The subnet creation service requirement is the service requirement to "create a virtual machine subnet." When the range orchestration management system triggers the subnet creation service requirement, it automatically creates the corresponding virtual machine subnet, i.e., the target virtual machine subnet.
[0032] It should be understood that this embodiment incorporates the graphics control traffic of virtual machines into a unified SDN management plane, supporting concurrent access by multiple virtual machines, dynamic policy adjustment, and access behavior auditing, which can eliminate the drawbacks of "one connection per machine and no unified entry point" in traditional VNC solutions.
[0033] Step S20: Create a corresponding virtual network card for the virtual machine in the target virtual machine subnet, and connect the virtual network card to the service bridge; Understandably, this involves creating corresponding virtual network interfaces for each virtual machine in the target virtual machine subnet and adding them to the OVS service bridge, so that the traffic from the virtual network interfaces can enter the OVS forwarding plane.
[0034] Step S30: Perform security isolation on the target virtual machine subnet; It should be noted that security isolation includes network isolation and two-layer traffic isolation.
[0035] In one feasible implementation, step S30 may include steps S301 to S302: Step S301: Perform network isolation on the target virtual machine subnet; In one feasible implementation, step S301 may include: creating an independent network namespace; moving the virtual network card of the target virtual machine subnet into the network namespace, so as to achieve network isolation of the target virtual machine subnet through the network namespace.
[0036] Understandably, creating an independent network namespace (NetNS) and moving the virtual network adapter of the target virtual machine subnet into it achieves process-level network isolation, which is the first layer of security isolation.
[0037] Step S302: Assign a corresponding two-layer isolation identifier to the target virtual machine subnet, and perform two-layer traffic isolation on the target virtual machine subnet based on the two-layer isolation identifier of the target virtual machine subnet.
[0038] It should be noted that the dual-layer isolation identifier includes a Virtual LAN ID (VLAN ID) and a Virtual Extended LAN ID (VXLAN ID). A unique VLAN ID (e.g., VLAN 100) is assigned to the target virtual machine subnet for physical or OVS-internal traffic isolation (Layer 2 security isolation). A unique VXLAN ID (e.g., VNI 10001) is assigned to the subnet to achieve logical isolation across physical machines / subnets via VXLAN tunneling technology (Layer 3 security isolation).
[0039] Understandably, VLANs are isolation tools within the same physical device. By assigning a unique VLAN ID to a subnet, traffic within the same physical server (or physical switch) can be divided into different groups. Only traffic with the same VLAN ID can communicate within its corresponding group; traffic with different VLAN IDs is directly blocked, preventing cross-network traffic within the same physical device. VXLAN, on the other hand, is an isolation tool across physical devices. By assigning a unique VXLAN ID to a subnet, traffic within that subnet can be packaged into tunnel packets for transmission within the physical network. Tunnel packets with the same VXLAN ID can communicate even if they are distributed across different physical servers; tunnel packets with different VXLAN IDs cannot see each other, achieving subnet isolation across devices.
[0040] In one feasible implementation, step S302 may include: setting a traffic label for the virtual network interface card (NIC) of the target virtual machine subnet based on the VLAN ID of the target virtual machine subnet; performing traffic isolation on the target virtual machine subnet based on the traffic label of the NIC; binding the VLAN ID of the virtual machine subnet to the VLAN ID of the virtual machine subnet to obtain an isolation identifier mapping relationship; and performing traffic isolation on the target virtual machine subnet based on the isolation identifier mapping relationship.
[0041] It should be noted that the traffic label is the same as the VLAN tag. Configure the VLAN tag for the virtual network card of the target virtual machine subnet according to the VLAN ID of the target virtual machine subnet. For example, if the VLAN ID of the target virtual machine subnet is VLAN 100, then the VLAN tag of the virtual network card of the target virtual machine subnet is VLAN 100.
[0042] Understandably, reference Figure 3 Only traffic carrying VLAN tags can pass through the corresponding virtual network interface card, thereby achieving traffic isolation on the same physical link (virtual machines in different VLANs cannot directly communicate with each other).
[0043] It should be noted that by establishing a mapping relationship between VLAN ID and VXLAN ID through the SDN controller, i.e., an isolation identifier mapping relationship, the VLAN ID can be bound to the corresponding VXLAN ID.
[0044] It should be understood that, reference Figure 3 By ensuring VXLAN ID consistency, virtual machines within the same subnet can communicate with each other, while traffic between different subnets is effectively isolated. Specifically, because VXLAN IDs are bound to VLAN IDs (e.g., VNI10001 is bound to VLAN 100), the traffic of virtual machines within the same subnet (with consistent VXLAN IDs) is encapsulated through a VXLAN tunnel and transmitted in the physical network. OVS forwards the traffic to the network namespace where the target virtual machine resides according to VXLAN flow table rules, thereby achieving "communication between virtual machines within the same subnet".
[0045] It is understandable that this embodiment automatically completes the allocation, binding, and lifecycle management of VLAN and VXLAN identifiers through the SDN controller, completely decoupling network policies from computing / storage resource scheduling, avoiding topology errors or policy conflicts caused by manual configuration. At the same time, on the basis of Linux kernel-level network namespace (NetNS) isolation, a second layer of VLAN isolation and a third layer of VXLAN overlay tunnel isolation are superimposed to form a three-layer in-depth isolation mechanism of "NetNS + VLAN + VXLAN", which effectively blocks unauthorized communication paths across subnets and across tenants. The unauthorized communication blocking rate across subnets can reach 99.97%, meeting the strong isolation requirements in information security compliance and attack and defense exercises.
[0046] Step S40: Generate the corresponding network configuration policy based on the target virtual machine subnet after security isolation; Understandably, based on the target virtual machine subnet after security isolation, a corresponding forwarding flow table is generated. Based on the dual-layer isolation identifier allocated to the target virtual machine subnet, the isolation identifier mapping relationship, and the forwarding flow table (only allowing traffic carrying VLAN tags to pass through the corresponding service network card, blocking unauthorized traffic from other VLANs), a network configuration policy is generated, which is the current network configuration method.
[0047] Step S50: Send the network configuration policy to the service bridge so that the service bridge forwards the traffic output by the target virtual machine subnet through the virtual network card based on the network configuration policy.
[0048] It should be noted that the virtual network interface card (NIC) is connected to the OVS service bridge. All traffic from the virtual NIC must be connected to the service bridge to flow. The virtual NIC is the starting point of the traffic (traffic originating from the virtual machine flows out from here), and the service bridge is the first control point for the traffic. After receiving the traffic from the virtual NIC, the service bridge classifies and processes it according to the VLAN tags and flow table rules issued by SDN. That is, traffic within the same subnet is directly forwarded to other virtual NICs, and cross-server traffic is forwarded to the service NIC.
[0049] It is understandable that the service bridge is a software-defined virtual relay station, and the service network interface card (NIC) is the physical interface of the physical server. The two are associated within the physical server (by OVS configuration and binding). The service bridge does not send all traffic to the service NIC. Only traffic across physical servers (such as virtual machines in the same subnet distributed on different servers) will be forwarded to the service NIC through the service bridge. Traffic within the same physical server and the same subnet is forwarded directly within the service bridge without going through the service NIC.
[0050] It should be understood that the service network card is the external exit of the physical server, and the physical switch is the physical network hub. The service network card transmits the "traffic with VLAN tags" from the service bridge to the physical switch through the physical link (network cable). Since the physical switch is in trunk mode, it supports the simultaneous transmission of traffic with multiple VLAN tags, which can meet the isolation requirements of multi-tenant / multi-service subnets (traffic from different VLANs does not interfere with each other in the physical switch).
[0051] This embodiment provides a method for managing virtual machine subnet traffic. Based on the subnet creation business requirements of the target range orchestration management system, it automatically creates corresponding target virtual machine subnets; creates corresponding virtual network interfaces (NICs) for the virtual machines in the target virtual machine subnet and connects the virtual NICs to the service bridge; performs security isolation on the target virtual machine subnet; generates corresponding network configuration policies based on the securely isolated target virtual machine subnet; and sends the network configuration policies to the service bridge so that the service bridge forwards the traffic output by the target virtual machine subnet through the virtual NICs based on the network configuration policies. This embodiment can automatically complete network configuration, avoiding topology errors or policy conflicts caused by manual configuration, ensuring the accuracy of configuration. It adopts a depth-based security isolation system with network isolation superimposed on dual-layer traffic isolation, effectively blocking unauthorized communication paths across subnets and tenants, ensuring communication security. It is applicable to scenarios with stringent requirements for high isolation, high automation, and high-density deployment, such as large-scale network ranges, multi-tenant cloud environments, and attack and defense exercise platforms.
[0052] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 4 Step S50 may be followed by steps S601 to S605: Step S601: Store the key metadata of the virtual machines in the target virtual machine subnet into the central database; It should be noted that after the virtual machine instance is initialized, key metadata is automatically collected and registered to the central database to form a complete asset profile.
[0053] Additionally, it should be noted that key metadata includes at least the virtual machine's internal address, remote login protocol service port, login username, login password, subnet identifier, network namespace name, virtual network adapter interface name, and virtual extended LAN identifier.
[0054] It's understandable that the virtual machine's internal address (internal IP) is the business IP within the netns1 subnet, such as 192.168.18.10. The remote login protocol service port (SSH service port) can be a non-standard port due to port mapping or containerization, such as 2222. The login username is the target machine's pre-configured account, such as root or ctfuser. The login password is encrypted and stored in a security vault or configuration center, and the subnet identifier (subnet UUID) is used for policy binding. The network namespace name (NetNS name) is used to limit the scope of operational instructions. The virtual network interface name (TAP interface name) is used for network debugging and traffic mirroring. The Virtual Extended LAN identifier (VXLAN VNI) is used for overlay network identification.
[0055] It should be understood that sensitive information such as passwords is stored in encrypted form (e.g., AES-256) or dynamically obtained through secure middleware such as HashiCorpVault, and is not exposed in plaintext configuration.
[0056] Step S602: Upon receiving a batch maintenance task, determine the target virtual machine based on the batch maintenance task; It should be noted that batch operation and maintenance tasks can include tasks such as configuration distribution, vulnerability scanning, and log collection. The target virtual machine refers to the virtual machine involved in the batch operation and maintenance task.
[0057] Step S603: Based on the target virtual machine, extract the corresponding target metadata from the central database; Understandably, the central database is queried to obtain the complete metadata of the selected virtual machine (including IP, SSH port, username, password, NetNS name, etc.), i.e., the target metadata.
[0058] Step S604: Generate a batch operation script based on the target metadata; Understandably, the target metadata is organized into a target list that Ansible can recognize, i.e., AnsibleInventory. Based on the target list, Ansible operation scripts, i.e. batch operation scripts, are generated.
[0059] Step S605: Based on the target operation mode, execute the batch operation script to complete the batch operation and maintenance task.
[0060] In one feasible implementation, before step S605, the following steps may be included: when the target virtual machine does not enable the remote login protocol service, determining the target operation mode as the normal operation mode; when the target virtual machine enables the remote login protocol service, determining the target operation mode as the precise operation mode.
[0061] It is understood that this embodiment supports two operating modes: a normal operating mode and a precise operating mode. The target operating mode is the currently used operating mode, which needs to be selected from the normal operating mode and the precise operating mode.
[0062] It should be understood that when the target virtual machine does not have the Remote Login Protocol Service (SSH service) enabled, the normal operation mode should be selected; when the target virtual machine has the Remote Login Protocol Service (SSH service) enabled, the precise operation mode should be selected.
[0063] In one feasible implementation, step S605 may include: when the target operation mode is the normal operation mode, determining the target network namespace based on the subnet identifier and network namespace name of the target virtual machine, and executing the batch operation script in the target network namespace; when the target operation mode is the precise operation mode, logging into the target virtual machine based on the virtual machine internal address and remote login protocol service port of the target virtual machine and executing the batch operation script.
[0064] Understandably, if the target operating mode is the normal operating mode, commands are executed directly by logging into the target virtual machine via IP and SSH port; if the target operating mode is the precise operating mode, the scope is limited based on the subnet UUID and NetNS name, and operations are executed within the network namespace name of the target virtual machine, thus eliminating the risk of accidental operation across subnets.
[0065] It should be understood that the traditional solution takes an average of about 5 minutes per task (50 nodes, relying on manual or script polling). However, with the solution in this embodiment, the average time per task is only 8 seconds (based on Ansible + NetNS scope locking), representing a 37.5-fold efficiency improvement. Furthermore, the traditional solution is limited by the overhead and management complexity of the graphics control channel, typically deploying ≤50 target machines per server. With the solution in this embodiment, the network and maintenance channels are completely lightweight, with no graphics dependency, increasing the number of virtual machines supported under the same hardware environment by 300% (up to 200 target machines), significantly optimizing hardware ROI.
[0066] This embodiment provides a method for managing virtual machine subnet traffic. Key metadata of virtual machines in the target virtual machine subnet is stored in a central database. Upon receiving a batch maintenance task, the target virtual machine is determined based on the task. Based on the target virtual machine, corresponding target metadata is extracted from the central database. Based on the target metadata, a batch operation script is generated. Based on the target operation mode, the batch operation script is executed to complete the batch maintenance task. Based on the mapping relationship between the unique subnet identifier and the network namespace name, and combined with automated maintenance engines such as Ansible, the method achieves automatic limitation of command scope and precise cross-subnet distribution, avoiding the risks of accidental activation, delay, and failure associated with traditional polling operations. This significantly improves the reliability and execution efficiency of tasks such as configuration updates, status inspections, and emergency responses.
[0067] For example, to help understand the implementation process of the virtual machine subnet traffic control method obtained by combining this embodiment with the above-described embodiment two, please refer to... Figure 5 , Figure 5 A simplified flowchart of a virtual machine subnet traffic control method is provided, specifically: 1) Physical network layer: Add a new service network card to the physical server of the range orchestration management system and connect it to the physical switch; configure Trunk mode to allow traffic carrying multiple VLAN tags to pass through, in preparation for VLAN isolation of multi-tenant / multi-service subnets in the future.
[0068] 2) Software-defined network layer: Deploy Open vSwitch (OVS) as the data plane of the software-defined network. It receives flow table instructions from the SDN controller through the OpenFlow protocol to enable virtual network forwarding, VLAN tagging, VXLAN tunnel encapsulation and other capabilities. Create a service bridge as a "transfer station" for virtual traffic to aggregate traffic from virtual network cards and physical network cards.
[0069] 3) Cloud platform and SDN controller linkage: The range management system uses the cloud controller to translate the business requirement of "creating a virtual machine subnet" into network configuration instructions (such as VLAN / VXLAN allocation, port permissions, flow table rules, etc.) that the SDN controller can recognize. The SDN controller sends the configuration to the OVS bridge on the service network card to ensure that the network policy is synchronized with the virtual machine lifecycle.
[0070] 4) Automated network process during virtual machine subnet creation: VLAN and VXLAN binding: Assign a unique VLAN ID and VXLAN ID to each subnet and establish a mapping relationship through the SDN controller; Virtual NIC creation and OVS bridge access: Create a virtual NIC and add it to the OVS service bridge, so that the traffic of the virtual NIC enters the OVS forwarding plane; Network Namespace (NetNS) isolation: Create an independent NetNS and move the virtual network interface card into it to achieve process-level network isolation; VLAN Tag Labeling: Configure VLAN tags for virtual network cards to ensure Layer 2 traffic isolation on the same physical link; Intra-subnet communication guarantee: Through the consistency of VXLAN ID, virtual machines within the same subnet can communicate with each other, while traffic between different subnets is effectively isolated.
[0071] 5) Ansible batch maintenance: Deploy Ansible control nodes and write playbooks for virtual machine groups; support batch operations such as configuration distribution, status inspection, and fault recovery, and combine NetNS features to ensure that commands only apply to virtual machines in the target subnet.
[0072] 6) Architectural security and efficiency value: By using a three-layer protection system of VLAN (Layer 2) + VXLAN (Layer 3 Overlay) + Netnamespace (process level), traffic between tenants / services becomes invisible and processes do not interfere with each other; the entire link is automated, replacing manual configuration on a machine-by-machine basis, reducing error rate and operation and maintenance costs.
[0073] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the virtual machine subnet traffic control method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.
[0074] This application also provides a virtual machine subnet traffic management device; please refer to [reference needed]. Figure 6 The virtual machine subnet traffic control device includes: Security isolation module 10 is used to automatically create the corresponding target virtual machine subnet based on the subnet creation business requirements of the target range orchestration management system; The security isolation module 10 is also used to create a corresponding virtual network card for the virtual machine in the target virtual machine subnet and connect the virtual network card to the service bridge; The security isolation module 10 is also used to perform security isolation on the target virtual machine subnet; Network configuration module 20 is used to generate corresponding network configuration policies based on the target virtual machine subnet after security isolation; The traffic control module 30 is used to send the network configuration policy to the service bridge, so that the service bridge forwards the traffic output by the target virtual machine subnet through the virtual network card based on the network configuration policy.
[0075] In one feasible implementation, the security isolation includes network isolation and two-layer traffic isolation, and the security isolation module 10 is also used to perform network isolation on the target virtual machine subnet; Assign a corresponding two-layer isolation identifier to the target virtual machine subnet, and perform two-layer traffic isolation on the target virtual machine subnet based on the two-layer isolation identifier of the target virtual machine subnet.
[0076] In one feasible implementation, the dual-layer isolation identifier includes a virtual local area network identifier and a virtual extended local area network identifier. The security isolation module 10 is also used to set the traffic label of the virtual network card of the target virtual machine subnet based on the virtual local area network identifier of the target virtual machine subnet. Traffic isolation is performed on the target virtual machine subnet based on the traffic tags of the virtual network interface card of the target virtual machine subnet; Bind the virtual LAN identifier of the virtual machine subnet to the virtual extended LAN identifier of the virtual machine subnet to obtain the isolation identifier mapping relationship; Based on the isolation identifier mapping relationship, traffic isolation is performed on the target virtual machine subnet.
[0077] In one feasible implementation, the security isolation module 10 is also used to create an independent network namespace; The virtual network interface card of the target virtual machine subnet is moved into the network namespace to achieve network isolation of the target virtual machine subnet through the network namespace.
[0078] In one feasible implementation, the traffic control module 30 is further configured to store key metadata of the virtual machines in the target virtual machine subnet to a central database. The key metadata includes at least the virtual machine internal address, remote login protocol service port, login username, login password, subnet identifier, network namespace name, virtual network card interface name, and virtual extended LAN identifier. Upon receiving a batch maintenance task, the target virtual machine is determined based on the batch maintenance task; Based on the target virtual machine, extract the corresponding target metadata from the central database; Based on the target metadata, generate batch operation scripts; Based on the target operation mode, the batch operation script is executed to complete the batch operation and maintenance task.
[0079] In one feasible implementation, the traffic control module 30 is further configured to determine that the target operation mode is the normal operation mode when the target virtual machine has not enabled the remote login protocol service; When the target virtual machine enables the remote login protocol service, the target operation mode is determined to be the precise operation mode.
[0080] In one feasible implementation, the traffic control module 30 is further configured to determine the target network namespace based on the subnet identifier and network namespace name of the target virtual machine when the target operation mode is the precise operation mode, and execute the batch operation script in the target network namespace. When the target operation mode is the normal operation mode, the batch operation script is executed by logging into the target virtual machine based on the virtual machine's internal address and remote login protocol service port.
[0081] The virtual machine subnet traffic management device provided in this application, employing the virtual machine subnet traffic management method in the above embodiments, can solve the technical problems of traditional solutions' network configuration being highly dependent on manual intervention and having coarse security isolation granularity. Compared with the prior art, the beneficial effects of the virtual machine subnet traffic management device provided in this application are the same as those of the virtual machine subnet traffic management method provided in the above embodiments, and other technical features in the virtual machine subnet traffic management device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.
[0082] This application provides a virtual machine subnet traffic management device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the virtual machine subnet traffic management method in the above embodiment 1.
[0083] The following is for reference. Figure 7 This document illustrates a structural diagram of a virtual machine subnet traffic management device suitable for implementing embodiments of this application. The virtual machine subnet traffic management device in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 7 The virtual machine subnet traffic management device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.
[0084] like Figure 7As shown, the virtual machine subnet traffic management device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in ROM (Read Only Memory) 1002 or a program loaded from storage device 1003 into RAM (Random Access Memory) 1004. RAM 1004 also stores various programs and data required for the operation of the virtual machine subnet traffic management device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via bus 1005. Input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touch screens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the virtual machine subnet traffic management device to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows virtual machine subnet traffic management devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.
[0085] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.
[0086] The virtual machine subnet traffic management device provided in this application, employing the virtual machine subnet traffic management method described in the above embodiments, can solve the technical problems of traditional solutions' network configuration being highly dependent on manual intervention and having coarse security isolation granularity. Compared with the prior art, the beneficial effects of the virtual machine subnet traffic management device provided in this application are the same as those of the virtual machine subnet traffic management method provided in the above embodiments, and other technical features of this virtual machine subnet traffic management device are the same as those disclosed in the previous embodiment method, and will not be repeated here.
[0087] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.
[0088] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.
[0089] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the virtual machine subnet traffic control method in the above embodiments.
[0090] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.
[0091] The aforementioned computer-readable storage medium may be included in the virtual machine subnet traffic management device; or it may exist independently and not be assembled into the virtual machine subnet traffic management device.
[0092] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by the virtual machine subnet traffic control device, the virtual machine subnet traffic control device: automatically creates a corresponding target virtual machine subnet based on the subnet creation service requirements of the range orchestration management system; creates corresponding virtual network cards for the virtual machines in the target virtual machine subnet and connects the virtual network cards to the service bridge; performs security isolation on the target virtual machine subnet; generates a corresponding network configuration policy based on the securely isolated target virtual machine subnet; and sends the network configuration policy to the service bridge so that the service bridge forwards the traffic output by the target virtual machine subnet through the virtual network cards based on the network configuration policy.
[0093] Computer program code for performing the operations of this application can be written in one or more programming languages or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, and C++, and conventional procedural programming languages such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).
[0094] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.
[0095] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.
[0096] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described virtual machine subnet traffic control method. This solves the technical problems of traditional solutions where network configuration is highly dependent on manual intervention and security isolation is coarse-grained. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the virtual machine subnet traffic control method provided in the above embodiments, and will not be elaborated upon here.
[0097] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the virtual machine subnet traffic control method described above.
[0098] The computer program product provided in this application can solve the technical problems of traditional solutions, such as network configuration being highly dependent on manual intervention and coarse-grained security isolation. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the virtual machine subnet traffic control method provided in the above embodiments, and will not be repeated here.
[0099] The above are only some embodiments of this application and do not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.
Claims
1. A method for controlling virtual machine subnet traffic, characterized in that, The method includes: Based on the subnet creation business requirements of the target range orchestration management system, the corresponding target virtual machine subnet is automatically created. Create corresponding virtual network interface cards (NICs) for the virtual machines in the target virtual machine subnet, and connect the virtual NICs to the service bridge; Perform security isolation on the target virtual machine subnet; Based on the target virtual machine subnet after security isolation, generate the corresponding network configuration policy; The network configuration policy is sent to the service bridge so that the service bridge forwards the traffic output by the target virtual machine subnet through the virtual network card based on the network configuration policy.
2. The method as described in claim 1, characterized in that, The security isolation includes network isolation and two-layer traffic isolation; The steps for security isolation of the target virtual machine subnet include: Perform network isolation on the target virtual machine subnet; Assign a corresponding two-layer isolation identifier to the target virtual machine subnet, and perform two-layer traffic isolation on the target virtual machine subnet based on the two-layer isolation identifier of the target virtual machine subnet.
3. The method as described in claim 2, characterized in that, The dual-layer isolation identifier includes a virtual local area network identifier and a virtual extended local area network identifier; The steps for performing two-layer traffic isolation on the target virtual machine subnet based on the two-layer isolation identifier of the target virtual machine subnet include: Based on the virtual LAN identifier of the target virtual machine subnet, set the traffic label of the virtual network interface card of the target virtual machine subnet; Traffic isolation is performed on the target virtual machine subnet based on the traffic tags of the virtual network interface card of the target virtual machine subnet; Bind the virtual LAN identifier of the virtual machine subnet to the virtual extended LAN identifier of the virtual machine subnet to obtain the isolation identifier mapping relationship; Based on the isolation identifier mapping relationship, traffic isolation is performed on the target virtual machine subnet.
4. The method as described in claim 2, characterized in that, The step of performing network isolation on the target virtual machine subnet includes: Create a separate network namespace; The virtual network interface card of the target virtual machine subnet is moved into the network namespace to achieve network isolation of the target virtual machine subnet through the network namespace.
5. The method as described in claim 1, characterized in that, After the step of sending the network configuration policy to the service bridge so that the service bridge forwards the traffic output by the target virtual machine subnet through the virtual network card based on the network configuration policy, the method further includes: The key metadata of the virtual machines in the target virtual machine subnet is stored in the central database. The key metadata includes at least the virtual machine internal address, remote login protocol service port, login username, login password, subnet identifier, network namespace name, virtual network card interface name, and virtual extended LAN identifier. Upon receiving a batch maintenance task, the target virtual machine is determined based on the batch maintenance task; Based on the target virtual machine, extract the corresponding target metadata from the central database; Based on the target metadata, generate batch operation scripts; Based on the target operation mode, the batch operation script is executed to complete the batch operation and maintenance task.
6. The method as described in claim 5, characterized in that, The method further includes: When the target virtual machine does not have the remote login protocol service enabled, the target operation mode is determined to be the normal operation mode; When the target virtual machine enables the remote login protocol service, the target operation mode is determined to be the precise operation mode.
7. The method as described in claim 5, characterized in that, Based on the target operation mode, the steps for executing the batch operation script include: When the target operation mode is the precise operation mode, the target network namespace is determined based on the subnet identifier and network namespace name of the target virtual machine, and the batch operation script is executed in the target network namespace. When the target operation mode is the normal operation mode, the batch operation script is executed by logging into the target virtual machine based on the virtual machine's internal address and remote login protocol service port.
8. A virtual machine subnet traffic control device, characterized in that, The device includes: The security isolation module is used to automatically create the corresponding target virtual machine subnet based on the subnet creation business requirements of the target range orchestration management system; The security isolation module is also used to create corresponding virtual network cards for virtual machines in the target virtual machine subnet and connect the virtual network cards to the service bridge; The security isolation module is also used to perform security isolation on the target virtual machine subnet; The network configuration module is used to generate corresponding network configuration policies based on the target virtual machine subnet after security isolation. The traffic control module is used to send the network configuration policy to the service bridge, so that the service bridge forwards the traffic output by the target virtual machine subnet through the virtual network card based on the network configuration policy.
9. A virtual machine subnet traffic management device, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the virtual machine subnet traffic control method as described in any one of claims 1 to 7.
10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the virtual machine subnet traffic control method as described in any one of claims 1 to 7.