VLAN Subinterface Packet Processing for Cloud Network Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network interface card passthrough scenarios in cloud computing systems lack the capability to provide abundant network functions such as security groups, quality of service, and distributed routing due to limited processing and storage capabilities of switching equipment.
Innovation Solution
Implementing a packet processing method that utilizes VLAN subinterfaces and a virtual network function module to perform network function processing on data packets, where virtual machines connected to virtual functions on network interface cards can send data packets with VLAN identifiers to switching equipment for forwarding to corresponding VLAN subinterfaces, which then remove the VLAN identifiers and send the packets to the virtual network function module for processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If network interface card passthrough is used to provide direct access to virtual machines, then network performance and simplicity are improved, but the ability to provide abundant network functions (security groups, QoS, distributed routing) deteriorates due to limited processing capabilities of switching equipment
Solution Approach 1:
The patent introduces a virtual network function module as an intermediary component between the physical network interface card and virtual machines. This module is implemented in software on the host system, allowing it to provide rich network functions (security groups, QoS, distributed routing) without adding hardware complexity to the network interface card itself. The virtual network function module intercepts and processes network packets, enabling sophisticated network control while maintaining the performance benefits of direct network access.
2Productivity
If switching equipment is used to forward packets between virtual functions, then packet forwarding capability is improved, but processing and storage capabilities remain limited preventing provision of abundant network functions
Solution Approach 1:
The patent replaces the hardware-based switching equipment with a software-based virtual network function module. Instead of relying on fixed-function hardware switches with limited processing capabilities, the system uses software running on the host to perform network function processing. This substitution allows for flexible implementation of various network functions (security groups, QoS, distributed routing) that would be difficult or impossible to implement in hardware switching equipment.
Data Source
Figure 1A~1B
Figure 2
Figure 3
AI summary
Embodiments of this application provide a packet processing method in a cloud computing system, a host, and a system. At least one network interface card is connected to the host. The at least one network interface card includes switching equipment and at least three network ports. A first virtual machine running on the host sends a data packet to a second virtual machine by using the VF that is connected to the first virtual machine. The data packet carries a VLAN identifier of the VF that sends the data packet. Switching equipment of a first network port receives the data packet, and forcibly forwards the data packet to the second network port by using the network cable. Switching equipment of the second network port sends, according to the VLAN identifier carried in the data packet, the data packet to a VLAN subinterface that has a same VLAN identifier as the data packet. The VLAN subinterface receives the data packet, removes the VLAN identifier in the data packet, and sends the data packet to the virtual network function module. The virtual network function module performs network function processing on the changed data packet, and sends the processed data packet to the second virtual machine. In a network interface card passthrough scenario, after sending a data packet by using a passthrough VF, a virtual machine may send the data packet to a virtual network function module on a VMM in the foregoing manner. Abundant virtual network functions are provided for a user by using the software module, so as to implement virtual network function processing on the data packet.