TWI625949B - Control system for controlling virtual overlay network through controller to generate tenant virtual network and control method thereof - Google Patents

Abstract

The invention provides a control system for controlling a virtual overlay network through a controller to generate a tenant virtual network and a control method thereof. The foregoing control system includes a multi-tenant virtual network construction and control subsystem, a virtual overlay network construction subsystem, and a multi-tenant virtual network controller subsystem. The aforementioned multi-tenant virtual network construction and control subsystem is used to determine the generation of multi-tenant virtual networks and collect virtual network data, while the virtual overlay network construction subsystem establishes a communication tunnel in the underlying environment of the network to provide Packets sent by virtual machines on a multi-tenant virtual network can communicate across physical machines. The multi-tenant virtual network controller subsystem is used to monitor virtual network information and determine the flow of packets sent by virtual machines on a multi-tenant virtual network. .

Description

Control system for controlling virtual network over controller to generate tenant virtual network and control method thereof

The invention generates and manages a multi-Tenant Virtual Network in a cloud maintenance system, and constructs a virtual overlay network through a virtual overlay network to enable a user or The maintenance personnel establish a tenant virtual network and centrally manage the virtual machine (VM) network access and flow through the virtual network controller (Virtual Network Controller) to ensure that the virtual machine is connected to the network in the tenant virtual network. And the virtual network between tenants is completely isolated.

With the maturity of cloud computing technology and virtualization technology, the demand for cloud computing services has grown rapidly. In order to meet the flexible mobility, reliability, information security, on-demand services, high availability and other features of cloud computing services. Network resources and application models are thus gradually virtualized to form a virtual network. Tenants can subscribe to a separate virtual network, and the virtual machine to which the tenant belongs can be connected to the virtual network to achieve the second layer of network isolation between different tenants, so as to achieve information security and achieve multiple application architectures. The second-layer isolation technology generally known to be applied to the network is as follows:

(1) Virtual Local Area Network (VLAN): Virtual area network is the most common practice in current management entities or virtual networks. The virtual area network can be used to subdivide the network into logical regional networks for the data link layer (second layer) in the network architecture. Isolation is performed and each is given a different IP subnet. This method can prevent the malicious packet stealing from achieving the effect of network isolation, provide more complete information security for network management, and reduce the problem of network congestion caused by too many packets when the data in the regional network is widely distributed. However, this method limits the size of the network that can be controlled due to the 4096 upper limit of the number of VLANs, so that the size of the network cannot be scaled out. Moreover, because different IP subnet segments must be given due to differences in VLANs, IP resources are wasted.

(2) The virtual overlay network (Virtual Overlay Network) is encapsulated on the packets sent by the virtual machine using the tunnel technology of the communication tunnel. The common tunnel is encapsulated with GRE, VxLAN, NVGRE, etc., in the original second layer. According to the identifier of the tunnel encapsulation on the network, the original physical network can be divided into multiple independent virtual tenant networks to achieve the same second layer isolation effect as the virtual local area network, except that the 4096 virtual network upper limit is greatly increased. It also solves the bottleneck of maintenance that requires physical switch device setting support.

Although the virtual overlay network mechanism can improve the limitations of the original virtual local area network, the implementation of this method must rely on the OpenFlow rule support, and the specific operation of the specific tunnel encapsulation identifier is determined by the rules. The well-known cloud system OpenStack is Use this architecture. The practice is to determine the virtual coverage network establishment range before the system is started. If the virtual network range needs to be changed, the network agent on the computing node must be manually restarted, resulting in inconvenience in maintenance management, and there is no such way. Instead of using the network agent on the compute node, the SDN controller issues static rules in the OpenFlow switch, putting a burden on the storage space of the OpenFlow switch.

(3) In this prior patented technology, the concept of using a SDN controller to control virtual machine packets to achieve tenant network isolation is mentioned. The patent title and the public number are Virtual Network. (WO/2015/000386). The virtualized network concept proposed in this patent uses the SDN controller and the OpenFlow switch to control the network flow by controlling the OpenFlow table. The SDN controller determines whether it belongs to the same source according to the source MAC and the destination MAC address on the packet header sent by the virtual machine. A virtual network, if it belongs to a virtual network, releases OpenFlow rules to the switch to give access. If it is different, it is forbidden.

The controller management proposed in this patent is rare, but its use of source MAC and destination MAC as OpenFlow rules is too trivial. Two virtual machines belonging to the same virtual network will cause OpenFlow switches due to different source MAC addresses. Asking the SDN controller twice, the number of excessive queries will cause a burden on the SDN controller. The trivial and lengthy OpenFlow rules stored in the OpenFlow switch will consume the storage space of the OpenFlow switch, especially from its OpenFlow rules stored in the OpenFlow switch. Only the source and destination MAC information can be seen, and the virtual network cannot be directly interpreted by the maintenance personnel, which is not conducive to the maintenance of the real online cloud environment. It is not a good design, and it needs to be improved. Therefore, for the management of virtual network resources in the cloud computing service maintenance system, the multi-tenant virtual network generation and management method applicable to this system is proposed, which is an important key to the development of cloud computing services.

In summary, how to provide a technical solution for controlling a virtual overlay network by a controller to generate a multi-tenant virtual network is a technical problem that needs to be solved in the field.

In order to solve the problems disclosed above, the object of the present invention is to provide a method and system for generating and controlling a multi-tenant virtual network in a cloud maintenance system, to achieve virtual virtual network construction, providing users or The maintenance personnel establish a tenant virtual network to ensure that the virtual machine is connected to the virtual network within the tenant virtual network and the virtual network between the tenants is completely isolated. Simultaneous virtual Covering the characteristics of the network, the present invention greatly improves the virtual network upper limit of the 4096 sets of the traditional virtual local area network, and further solves the bottleneck of the maintenance that requires the physical switch device setting support. With the help of the tenant identification code, the flow rules on the virtual switch can be greatly simplified, saving the consumption of its access space. The tenant identification code can help the maintenance personnel to interpret the tenant virtual network of the package, which is a great help for the maintenance of the real online cloud environment.

A second object of the present invention is to provide a virtualized network management mechanism suitable for a cloud computing service system. It utilizes a centralized virtualized network controller to manage virtual switches, virtual machines, and virtual network resources.网路 Enables network management in the overall cloud computing service system to support the characteristics of virtual machine live-migration, and can manage the virtual network security management mechanism with network management settings. Portability, eliminating the clustering restrictions common to virtualized network environments, achieving seamless migration of virtual machines in virtual isolation groups, improving the effectiveness of virtual network management, and flexibly managing all virtual switches, and mastering them The overall topology and resources of the overall virtual network, and the characteristics of the highly flexible mobile, information security, and high availability of the cloud computing service, make the system of the present invention a network management system suitable for the cloud computing service system.

A control system that achieves the above object of the invention. The administrator can use the virtual overlay network construction subsystem to establish a virtual overlay network on the physical machine to establish a communication tunnel between the physical servers, and use the virtual network controller when the virtual machine enters the virtual network. The Virtual Switch manages all virtual network resources and the network topology where the virtual machines are located. The user or administrator can freely establish a tenant virtual network and pipe the virtual machine into a specific virtual network, so that the virtual machine is completely connected to the virtual network in the tenant virtual network and the virtual network between the tenants is completely isolated.

The control system proposed by the present invention for controlling a virtual overlay network by using a controller to generate a multi-tenant virtual network includes: a multi-tenant virtual network construction and control subsystem, a virtual overlay network construction subsystem, and a virtual network control The subsystems, the aforementioned subsystems are described as follows:

The foregoing multi-tenant virtual network construction and control subsystem includes: multi-tenant virtual network operation and presentation module, multi-tenant virtual network resource and topology dependency knowledge base, multi-tenant virtual network area generation decision unit, and more Tenant virtual network generation decision unit, multi-tenant virtual network resource binding virtual machine decision unit, multi-tenant virtual network resource and topology monitoring collection unit, virtual overlay network construction demand transmission unit, and multi-tenant virtual network message Transfer unit.

The aforementioned virtual overlay network construction subsystem includes a multi-tenant virtual overlay network construction subsystem communication unit, a multi-tenant virtual overlay network construction decision unit, and a virtual switch and network node control unit.

The aforementioned virtual network controller subsystem includes: multi-tenant virtual network topology monitoring unit, multi-tenant virtual network controller knowledge base, multi-tenant virtual network decision-making unit, multi-tenant virtual network unicast (unicast) Unit, multi-tenant virtual network tenant identification code binding unit, multi-tenant virtual network multicast (multicast) unit, virtual switch and network node detector, and multi-tenant virtual network controller message delivery unit.

The system proposed by the present invention further considers the characteristics of virtual machine live-migration in a virtualized network environment, and increases the portability of the network setting of the virtual isolation group in the design of the system mechanism. Through the continuous monitoring and collection of the entire virtualized network resources and the centralized management and control mechanism of the virtualized network flow, the virtual isolation group in the virtualized network covered by the system is portable. Sex and make the virtual isolation group absent Restricted to the common clustering of virtualized environments, the seamless migration of virtual machines in the virtual isolation group can be achieved, and the efficiency of the maintenance personnel to control the virtualized network can be improved.

In summary, the control system of the present invention improves the network security in the virtualized network, and provides a virtual isolation group system for the virtualized network maintenance personnel to be portable and flexible, thereby improving the maintenance personnel. Manage the efficiency of your virtualized environment.

100‧‧‧Community example summary

110‧‧‧Virtual Network Category

111‧‧‧Virtual Switch

111-a‧‧‧Virtual Switch-a

111-b‧‧‧Virtual Switch-b

111-c‧‧‧Virtual Switch-c

112‧‧‧Virtual Machine

112-a~112-k‧‧‧Virtual Machine-a~Virtual Machine-k

113‧‧‧Multi-tenant virtual network area

113-a~113-b‧‧‧Multi-tenant virtual network area-a-multi-tenant virtual network area-b

114‧‧‧Multi-tenant virtual network

114-a~114-b‧‧‧Multi-tenant virtual network-a~multi-tenant virtual network-b

120‧‧‧Physical network and physical machine category

121‧‧‧ physical machine

121-a~121-c‧‧‧body machine-a~body machine-c

123‧‧‧Physical exchanger

124‧‧‧Internet

200‧‧‧Control system for managing virtual overlay networks through controllers to generate multi-tenant virtual networks

210‧‧‧Multi-tenant virtual network construction and control subsystem

211‧‧‧Multi-tenant virtual network operation and presentation module

212‧‧‧Multi-tenant virtual network resource and topology-dependent knowledge base

213‧‧‧Multi-tenant virtual network area generation decision unit

214‧‧‧Multi-tenant virtual network generation decision-making unit

215‧‧‧Multi-tenant virtual network resource binding virtual machine decision unit

216‧‧‧Multi-tenant virtual network resources and topology monitoring collection unit

217‧‧‧Virtual Overlay Network Construction Demand Transfer Unit

218‧‧‧Multi-tenant virtual network messaging unit

220‧‧‧Virtual Overlay Network Construction Subsystem

221‧‧‧Multi-tenant virtual overlay network construction subsystem communication unit

222‧‧‧Multi-tenant virtual overlay network construction decision-making unit

223‧‧‧Virtual Switch and Network Node Control Unit

230‧‧‧Multi-tenant virtual network controller subsystem

231‧‧‧Multi-tenant virtual network topology monitoring unit

232‧‧‧Multi-tenant virtual network controller knowledge base

233‧‧‧Multi-tenant virtual network decision-making unit

234‧‧‧Multi-tenant virtual network unicast unit

235‧‧‧Multi-tenant virtual network tenant identification code binding unit

236‧‧‧Multi-tenant virtual network multicast unit

237‧‧‧Virtual Switch and Network Node Detector

238‧‧‧Multi-tenant virtual network controller messaging unit

300‧‧‧Multi-tenant virtual network construction and control subsystem operation flow chart

1 is a block diagram of a control system for using a controller to control a virtual overlay network to generate a multi-tenant virtual network according to a first embodiment of the present invention;

2 is an internal block diagram of a multi-tenant virtual network construction and control subsystem of the present invention.

3 is an internal block diagram of a virtual overlay network construction subsystem of the present invention.

4 is an internal block diagram of a multi-tenant virtual network controller subsystem of the present invention.

FIG. 5 is a flow chart of the operation of the multi-tenant virtual network construction and control subsystem of the present invention.

6 is a flow chart showing the operation of the multi-tenant virtualized network controller subsystem of the present invention.

Figure 7 is a flow chart of the multi-tenant virtual network controller subsystem decision and construction of a multi-tenant network.

Figure 8 is a schematic diagram of an embodiment of the system of the present invention.

Figure 9 is a block diagram of an embodiment of the system of the present invention.

The specific embodiments are described below to illustrate the embodiments of the invention, but are not intended to limit the scope of the invention.

The invention uses the virtual overlay network construction subsystem to establish a virtual overlay network on the physical machine to establish a communication tunnel between the physical servers, and enters the virtual network in the virtual machine. In the road, the virtual network controller and the virtual switch are used to control all the virtual network resources and the network topology where the virtual machine is located. The user or administrator can freely establish a tenant virtual network and pipe the virtual machine into a specific virtual network, so that the virtual machine is completely connected to the virtual network in the tenant virtual network and the virtual network between the tenants is completely isolated. In order to further illustrate the detailed operation of the present invention, the details of the embodiments are used herein. However, the description itself is not intended to limit the patent. On the contrary, the inventors have considered that the claimed subject matter may also be embodied in other ways, including different steps or steps in combination with steps described in this document, in combination with other existing or future technologies.

Embodiments of the present invention are directed to further explaining the systems and associated subsystems encompassed by the present invention, and using the presentation of detailed flowcharts to illustrate the important techniques and system flows of the present invention. The application scope and usage scenarios of the present invention will be described by way of an overview of the embodiments.

Please refer to FIG. 1, which is a block diagram of a control system for controlling a virtual overlay network to generate a multi-tenant virtual network using a controller according to a first embodiment of the present invention. The foregoing management system 200 for controlling a virtual overlay network using a controller to generate a multi-tenant virtual network further includes the following software modules: a multi-tenant virtual network construction and control subsystem 210, a virtual overlay network construction subsystem 220, And a multi-tenant virtual network controller subsystem 230. The aforementioned software module can be connected through a calling program.

The aforementioned multi-tenant virtual network construction and control subsystem 210 is the control decision maker of the overall operation of the system. The main function is to determine the generation of the multi-tenant virtual network and collect the data of the virtual network. The aforementioned virtual overlay network construction subsystem 220 is responsible for establishing a communication tunnel for the underlying environment as needed, so that the packets sent by the virtual machines on the multi-tenant virtual network can communicate across the physical machine. In addition, the multi-tenant virtual network controller subsystem 230 is used to monitor virtual network information. And determine the flow of packets sent by the virtual machine on the multi-tenant virtual network, which can be regarded as the executor of the overall operational behavior. In principle, the three subsystems operate independently and communicate the conditions and information required for each other's operations through the communication channel.

Please refer to FIG. 2 , which is an internal block diagram of the foregoing multi-tenant virtual network construction and management subsystem 210. The primary purpose of the subsystem is to achieve dynamic decision making, establish and manage a multi-tenant virtual network, as an overall system architecture. Control the decision-making office. The multi-tenant virtual network construction and control subsystem further includes: a multi-tenant virtual network operation and presentation module 211, a multi-tenant virtual network resource and topology dependency knowledge base 212, and a multi-tenant virtual network area generation decision unit 213. a multi-tenant virtual network generation decision unit 214, a multi-tenant virtual network resource binding virtual machine decision unit 215, a multi-tenant virtual network resource and topology monitoring collection unit 216, a virtual overlay network construction requirement transmission unit 217, and Multi-tenant virtual network messaging unit 218.

The multi-tenant virtual network operation and presentation module 211 is used to provide a manager or virtualized network operator interface to provide query and control settings, including an overview of the overall virtual isolation group, and no It is limited to clustering common in virtualized environments, arbitrarily querying virtual network isolation, and scheduling virtual machine members of virtual networks in a timely manner.

The multi-tenant virtual network area generation decision unit 213, the multi-tenant virtual network generation decision unit 214, and the multi-tenant virtual network resource binding virtual machine decision unit 215 receive the multi-tenant virtual network operation and presentation module 211. The instruction determines the legality of the administrator's operation on the virtual network area, the virtual network, and the virtual network card. The multi-tenant virtual network resource and topology monitoring collection unit 216 actively monitors the virtualized network environment during the execution of the multi-tenant virtual network construction and management subsystem 210 and collects the network through the multi-tenant virtual network controller subsystem 230. Road resources and topology information. Instantly update messages into multi-tenant virtual network resources and topology dependencies Library 212.

The virtual overlay network construction requirement transfer unit 217 and the multi-tenant virtual network message transfer unit 218 are respectively used to connect the virtual overlay network construction subsystem 220 and the virtual network controller subsystem 230.

Please refer to FIG. 3, which is an internal block diagram of the virtual overlay network construction subsystem 220. The multi-tenant virtual overlay network construction subsystem communication unit 221 is responsible for receiving operation information from the multi-tenant virtual network construction and control subsystem 210, and transmitting the message to the multi-tenant virtual overlay network construction decision unit 222 for analyzing the multi-tenant virtual network. The road area operates the message and converts it into the message required to establish or delete the communication tunnel, and operates the virtual switch on the physical machine through the virtual switch and network node control unit 223 to establish or delete the communication tunnel.

Please refer to FIG. 4, which is an internal block diagram of the multi-tenant virtual network controller subsystem 230. The multi-tenant virtual network controller subsystem 230 is used to manage the flow and topology of the virtualized network, and constructs and manages the multi-tenant virtual network area and multi-tenant virtual network determined by the multi-tenant virtual network 210. The multi-tenant virtual network resource is bound to the virtual machine, and the multi-tenant virtual network is dynamically constructed by controlling the virtual switch and the network flow direction.

The multi-tenant virtual network controller subsystem 230 includes a multi-tenant virtual network topology monitoring unit 231, a multi-tenant virtual network controller knowledge base 232, a multi-tenant virtual network decision unit 233, and a multi-tenant virtual network single point delivery. Unit 234, multi-tenant virtual network tenant identification code binding unit 235, multi-tenant virtual network multi-point delivery unit 236, virtual switch and network node detector 237, and multi-tenant virtual network controller messaging unit 238.

During the execution of the multi-tenant virtual network controller subsystem 230, the multi-tenant virtual network topology monitoring unit 231 continuously detects whether there is a need for the switch to make network access, if any Any requirements are raised and the unit will forward the request to the multi-tenant virtual network decision unit 233. In other words, this unit is the key unit in the virtualized network controller subsystem 230 that monitors and receives network access requirements. It is a unit that continues to operate continuously to grasp the network access flow of all virtual switches. .

The virtual switch and network node detector 237 is identical to the multi-tenant virtual network topology monitoring unit 231 described above and will continue to detect during execution of the virtualized network controller subsystem 230. The difference is that the information mainly monitored by the virtual switch and the network node detector 237 is the topology of the entire virtualized network and records related information, and includes the virtual switch and the network node covered (here A network node can be thought of as all virtual machines in a virtual network. When the virtual switch and the network node detector detect a change in the virtualized network topology, the related transaction is recorded in the multi-tenant virtual network controller knowledge base 232 for the other unit to perform the network environment. Or conditional interpretation.

The main action of the multi-tenant virtual network decision unit 233 is to determine the requirements of the virtual switch, which can be regarded as the key control unit of the overall virtualized network controller subsystem 230, the overall network topology and the decision of the multi-tenant virtual network. This unit is managed centrally. The multi-tenant virtual network decision unit 233 analyzes the source and destination of the network packet sent from the virtual machine, and refers to the network environment information of the virtualized network controller knowledge base to determine the appropriate processing manner of the packet, if the packet is The source and destination are not on the same physical machine. Before the packet is sent to the communication tunnel between the physical machines, the tenant identification code needs to be configured for the packet. The packet needs to be sent to the multi-tenant virtual network tenant identification code binding unit 235. The type is also related to its processing mode. If the packet belongs to unicast, the packet is sent to the multi-tenant virtual network unicast unit 234. If the packet belongs to multi-cast, the packet is sent. Multi-point delivery for up to tenant virtual networks (multicast) unit 236.

In other words, the multi-tenant virtual network decision unit 233 sends the packet to the appropriate processing unit, and the corresponding network flow direction is generated, that is, the virtual machine sharing the virtual network of the same tenant can be interconnected, and the virtual machine of the different tenant virtual network is generated. Isolated from each other.

The multi-tenant virtual network controller message delivery unit 238 is a communication channel of the multi-tenant virtual network controller subsystem 230, which can be mainly divided into two parts. On one hand, the multi-tenant virtual network construction and control subsystem 210 is provided. The multi-tenant virtual network controller 230 transmits information to the multi-tenant virtual network construction and control subsystem 210 and the virtual overlay network construction subsystem 220 to instantly exchange virtual isolation group settings. And the state of the virtualized network. On the other hand, the unit further provides a communication pipeline for message transmission between the multi-tenant virtual network controller 230 and the virtual switch, so that the multi-tenant virtual network controller 230 can use the unit to generate the entire construction immediately and correctly. Virtualize the topology of the network and actually generate all the virtual isolation groups in the overall virtualized network. This unit can be seen as a medium for the key external interface of the multi-tenant virtual network controller 230.

The relationship between the unit and the unit of the multi-tenant virtual network controller 230 of FIG. 4 is as follows: When the multi-tenant virtual network controller 230 is started, the multi-tenant virtual network topology monitoring unit 231 and the virtual device are triggered. The switch and network node detector 237 continuously monitors and collects virtualized network resources and requirements. Both units synchronize the detected necessary information to the multi-tenant virtual network controller knowledge. Among the libraries 232. The virtual switch and network node detector 237 focuses on the monitoring of virtual switches and virtual machines in the virtualized network. The main purpose is to detect related devices and nodes of the overall network. In addition, the virtualized network flow to the topology monitoring unit monitors the flow and topology of the overall virtualized network and streams the received network. The demand is transmitted to the multi-tenant virtual network decision unit 233, whereby the decision unit makes the decision of the demand and the direction of the flow. When the multi-tenant virtual network decision unit 233 completes the decision, the corresponding decision is forwarded to the multi-tenant virtual network unicast unit 234, the multi-tenant virtual network tenant identification code binding unit 235 or the multi-tenant. A virtual network unicast unit 236. The three units will actually send the generated flow direction rules to the virtual switch through the multi-tenant virtual network controller message delivery unit 238 according to the received requirements, so as to correctly and correctly generate the topology and flow direction of the virtual network.

5-7 are flowcharts of a control method for controlling a virtual overlay network to generate a multi-tenant virtual network by using a controller according to a second embodiment of the present invention. The foregoing control method is applied to the control system 200 for controlling the virtual overlay network using the controller to generate a multi-tenant virtual network in the first embodiment, and the steps are as follows:

Please refer to FIG. 5, which is a flowchart of the operation of the multi-tenant virtual network construction and control subsystem of the present invention. After the multi-tenant virtual network construction and control subsystem 210 is activated, the administrator (step 310) can query the multi-tenant virtual network system information action through the multi-tenant virtual network operation and presentation module 211 (step 320). Learn about the distribution of existing multi-tenant virtual network areas, multi-tenant virtual networks, and virtual NICs on multi-tenant virtual networks to understand the current multi-tenant virtual network settings and topology. Then, the administrator of the system can perform the multi-tenant virtual network area (step 330), the multi-tenant virtual network (step 340), and the virtual network card binding tenant virtual network through the multi-tenant virtual network operation and presentation module 211 ( Step 350) Three operations, each step is described as follows:

Operating the multi-tenant virtual network area (step 330), the administrator will be able to select multiple physical entity NICs through the physical network topology of the multi-tenant virtual network resource and the topology-dependent knowledge base 212 displayed on the operation interface. Circle through the multi-tenant virtual network After the path area (step 330) is operated to circle the required physical network card, the following two steps are required to be performed: transferring the virtual network area information to the virtual overlay network construction subsystem (step 331) and transferring the operation instruction to the multi-tenant virtual The network controller subsystem (step 332). The virtual overlay network construction subsystem 220 receives the operation instruction type through the multi-tenant virtual overlay network construction subsystem communication unit 221, and can be divided into operations of establishing, deleting, and updating a multi-tenant virtual network area, and a multi-tenant virtual overlay network. The construction decision unit 222 will perform a virtual network area for the physical network card selected in the decision operation instruction. The necessary condition for forming the virtual network area is that the packet must be interoperable, and is not limited to a single area network, as long as the network can be The connection can become a multi-tenant virtual network area. When it is determined that the virtual local area network can be formed, the virtual switch and network node control unit 223 will operate on the managed virtual switch to establish a full mesh communication tunnel establishment. This completes the infrastructure of the multi-tenant virtual network area. The instructions for receiving the operation of the multi-tenant virtual network controller subsystem 230 can also be divided into the operations of establishing, deleting and updating the multi-tenant virtual network area, and the settings are first stored in the multi-tenant virtual network controller knowledge base 232. Used for subsequent comparison of packets. At this point, all the settings of the multi-tenant virtual network area are completed.

Operating the multi-tenant virtual network (step 340), the administrator also selects the multi-tenant virtual network to establish the multi-tenant by using the network topology of the multi-tenant virtual network resource and the topology-dependent relationship 212 on the operation interface. Under the virtual network area, there are three types of operations that can be added, deleted, and updated. Then, the following steps are performed: the operation instruction is delivered to the multi-tenant virtual network controller system, and the multi-tenant virtual network controller subsystem 230 (step 341) stores the information in the multi-tenant virtual network controller knowledge after receiving the instruction. The library 232 is used for subsequent comparison of the packets. This completes the multi-tenant virtual network setting action.

Operating the virtual network card to bind to the tenant virtual network (step 350) through the operation interface The network topology from the multi-tenant virtual network resource and the topology-dependent relationship 212 is displayed to select the tenant virtual network to which the virtual network card is to be bound in the multi-tenant virtual network area, and the types of operations that can be performed are added. Update three. Then, the following steps are performed: the operation instruction is delivered to the multi-tenant virtual network controller system (step 351), and the multi-tenant virtual network controller subsystem 230 stores the information in the multi-tenant virtual network controller knowledge after receiving the instruction. The library 232 is used for subsequent comparison of the packets. This completes the virtual network card and tenant virtual network binding operation setting action.

Please refer to FIG. 6, which is a flowchart of the operation of the multi-tenant virtualized network controller subsystem. The details are as follows: After the virtualized network controller subsystem is started (step 410), in order to achieve instant grasp of the overall multi-tenant virtual network information and dynamically generate the goal of multi-tenant virtual isolation, the controller will use multi-tenant virtual The network topology monitoring unit 231 performs a network environment-related monitoring and detecting action with the virtual switch and the network node detector 237, that is, monitoring the multi-tenant virtualized network packet (step 420) and detecting the virtual switch. Acting with the network node (step 440). Detecting the virtual switch and the network node (step 440) periodically sends a topology aware packet to the virtual switch to understand the connectivity and topology of the virtual switches, and monitor the multi-tenant virtualized network packet (step 420) The network packet that is not recognized by the virtual switch is received, and the virtual network card existing on the virtual switch of the controlled switch is also detected, so as to grasp whether the virtual network card is moved to another virtual switch. The topology information and the virtual network card information connected to the virtual switch will be stored in the multi-tenant virtual network controller knowledge base 232, and will be stored and received from the virtual network area, the virtual network and the virtual network card. The virtual network command (step 430), the controller will have enough information to determine the network of the tenant to which it belongs and its flow direction for any network packet that is sent to the controller. The network packets received by the monitoring multi-tenant virtualized network packet (step 420) are all packets that are not recognized by the virtual switch, so in addition to collecting information, the controller needs to analyze the packet information and then The virtual switch issues the appropriate command to inform it of the correct packet flow (step 450) to achieve isolation between the tenant networks. The controller will first perform an action to determine whether the virtual switch of the source access requirement belongs to any virtual network (step 480). If it does not belong to any tenant virtual network, action construction will be performed to generate general virtualized network access. The flow direction message (step 490) allows the packet to be sent normally to its target without blocking, and the action is passed to the message to the virtual switch of the network access (step 491). If the controller determines that the packet belongs to the tenant virtual network that has been registered, the action construction must be performed to generate a virtual network flow message (step 460), and the possible actions will be described in detail in FIG. The flow direction message is passed to the virtual switch to which the network access belongs (step 481).

Please refer to FIG. 7, which is a flow chart of the multi-tenant virtual network controller subsystem 230 decision and constructing a multi-tenant network. The detailed description thereof is as follows: when the virtual switch in the controller control range receives a certain from the existence The packet sent by the virtual network card in the registered virtual network is sent to the controller for further flow direction indication (step 461). First, the controller determines whether the packet is from the virtual network card on the inquiring virtual switch (step 462), the judgment is to know whether it is the starting point of the packet transmission. If the packet belongs to the virtual network card from the virtual switch of the inquiry, it indicates that the packet is just sent to the virtual network, which can be regarded as being in the virtual network. The starting point of the journey, so for the subsequent actions we need to configure the virtual overlay network ID (Tunnel ID) for this packet.

Under the condition that the packet is the starting point, it is first determined whether the packet type is unicast (step 467), and if it is known as unicast according to the packet destination MAC address, the action determines the source and destination of the source packet. Whether the MAC address belongs to the same tenant virtual network (step 471). If it is determined to belong to the same tenant virtual network, the packet is legally packetized. The controller will notify the virtual switch that the virtual switch has configured the tenant identification code for this packet and unicasts it to the destination (step 472). However, if the source and destination MAC addresses are not in the same virtual network, it indicates that the packet is an illegal packet, and the controller will perform an action to notify the virtual switch to discard the packet (step 470).

After the packet is used as a starting point, it is determined whether the packet type is a multicast (step 468), and if the packet is indeed a broadcast packet, the virtual switch is notified to configure a virtual overlay network identifier for the packet, and The multicast mode is sent to the destination (step 469). This is the effect of multicast multicast packet transmission, because if there is more than one virtual network card of the tenant virtual network on the virtual switch, direct broadcast will cause the virtual network card to receive packets from the same tenant virtual network card. Therefore, multicasting is used to avoid this problem. In the multi-tenant virtual network controller knowledge base 232, there will be enough information to know which virtual switches are connected to the same virtual network, so The packet is configured to be virtualized with the network identification code and then transmitted to the ports and clusters. At the same time, the virtual mesh network is connected to the external network to establish a full mesh connection, so that the virtual network card of the same virtual network on other physical machines is also Can receive the packet.

It has been explained above that the controller determines whether the packet is from the virtual network card on the virtual switch in question (step 462), the packet is from the virtual network card on the virtual switch of the query, and then the controller determines that the packet is not from the query. The case of a virtual NIC on a virtual switch. If the virtual switch receives a packet to determine that its packet is not from its own virtual network card, it represents that the packet was sent from another virtual switch and then ends its journey on the virtual network.

Under the condition that the packet is the end point, first determine whether the packet type is a single point transmission. Broadcast (step 463), since the virtual switch that has sent the packet has first determined that the packet is sent as a legal packet, in this case, the controller does not need to make additional judgments, and only needs to perform an action notification virtual switch. The packet is sent to the destination in a unicast manner (step 465).

After the packet is the end point, it is determined whether the packet is a broadcast packet (step 464), and if the target MAC is a broadcast address, the action is notified to the virtual switch to send the packet to the destination in a multicast manner (step 466). Different from the multicast mode in which the packet is started at the beginning, the packet here has been configured with a virtual overlay network identification code. Based on this identifier, we issue a connection cluster that needs to be multicast, and will no longer go to the virtual overlay network. The external mesh connection established by the external network is transmitted to avoid broadcast storms caused by network loops.

Please refer to FIG. 8, which is a schematic diagram 100 of an embodiment of the present invention. The figure illustrates an application scope and usage scenario of a system for constructing and using a controller to control a virtual overlay network to generate a multi-tenant virtual network, and the illustration is used to reveal that the system is implemented in a virtualized environment and a physical environment. Case. In addition, the definitions of devices and proper nouns in a virtualized network environment are further illustrated in this summary in order to clarify the methods and examples used in the system of the present invention.

FIG. 8 is a schematic diagram of a virtualized network category 110 combined with a physical network and a physical machine category 120 for illustrating the interaction between the virtualized network and the physical network. In general, a virtualized network needs to be built on a physical network and a physical machine. The physical network and physical machine category 120 includes a physical machine 121, an entity switch 123, and an externally connected Internet 124. The virtual switch 111 and the plurality of virtual machines 112 can be configured on each physical machine. The tenant virtual network area 113 constructed by the system of the present invention is circled by a virtual switch on the physical machine to form a tenant virtual network. In the range of the road area 113, network interworking can be allowed, and in the tenant A tenant virtual network 114 is established in the virtual network area 113. The 113-a tenant network area includes two tenant virtual networks 114-a and 114-b, and the virtual network card on the virtual machine 112 can be selected to be installed. In which tenant virtual network, the virtual machines in the tenant virtual network can communicate with each other, and the tenant virtual networks are isolated from each other, and the virtual machines 112-a, 112-b, 112-c in 114-a communicate with each other. However, it is completely isolated from other virtual machines in 114-b.

[Features and effects]

The virtual local area network (VLAN) in the prior art is often used as the second layer of network isolation. However, due to the limitation of the number of upper limits and the need for physical network device support, it is not suitable for flexible provisioning in multi-tenant virtual networks. The demand for the installation. In the prior art, the virtual overlay network (Virtual Overlay Network), the well-known cloud management system OpenStack uses a virtual overlay network with OpenFlow static rules to achieve a multi-tenant virtual network. If you want to change the virtual coverage network range, you need to manually control the calculation. Nodes are not convenient for provisioning and management in a multi-tenant virtual network environment. In addition, the prior patents applied to the multi-tenant virtualized network in the prior art, because the source and the destination MAC are used to distinguish the tenants of the virtual machine, thereby isolating the network packets between different tenants to achieve the effect of the multi-tenant virtual network, but Using the MAC as the flow direction rule will cause the rules in the OpenFlow rule table to be too long and cumbersome. It not only occupies the storage space of the OpenFlow switch, but also cannot directly identify from the rules that the tenant to which it belongs will cause inconvenience in maintenance. Looking at the foregoing, the prior art does lack a multi-tenant virtual network provisioning and management mechanism for virtual environments. Therefore, the present invention is directed to the characteristics of a virtualized network environment, and develops a multi-tenant virtual network provisioning and management mechanism suitable for use in a cloud computing service system.

The method and system of the present invention applied to the construction of a virtualized network and using a controller to control a virtual overlay network to generate a multi-tenant virtual network, compared with other conventional technologies In the meantime, it has the following advantages:

The multi-tenant virtual network system of the present invention considers the characteristics of the virtualized network environment and designs a multi-tenant virtual network management mechanism suitable for the cloud computing service system. This mechanism system can cover the second layer isolation feature of the prior art network, achieve packet interworking in the tenant virtual network, and block the communication barrier between the tenant virtual networks. Supports the real-time migration of virtual machines in a virtualized network environment through a centralized controller, and achieves the portability of network management settings of virtual isolation groups.

The invention uses a virtualized network controller with a virtual overlay network to break through the number limit in the virtual local area network and eliminates the complicated procedures that need to be set for the underlying physical network switch.

The invention constructs a virtual overlay network through a virtual overlay network to dynamically generate a multi-tenant virtual network area according to requirements, and can centrally control the virtual overlay network range, thereby greatly improving management convenience.

The multi-tenant virtual network construction and control subsystem of the system of the present invention adopts a friendly and highly available multi-tenant virtual network operation and presentation module, so that the administrator or network operator can simultaneously view the existing multi-tenant virtual Network area, multi-tenant virtual network and virtualized network topology, and can plan and bind virtual network card to tenant virtual network according to the overall network management considerations, and increase cloud computing service network maintenance management system Security and availability.

The invention uses the virtualized network controller and the virtual overlay network to configure the tenant-specific identification code for the network packet, and the controller can determine the appropriate rule according to the identification code, thereby greatly reducing the number of flows that the controller needs to release to the virtual switch. And its identification code can directly identify the tenants to which it belongs, which will greatly improve the efficiency and convenience of maintenance.

The detailed description of the preferred embodiments of the present invention is intended to be limited to the scope of the invention, and is not intended to limit the scope of the invention. The patent scope of this case.

Claims (8)

A control system for controlling a virtual overlay network through a controller to generate a multi-tenant virtual network, comprising the following plurality of software subsystems: a multi-tenant virtual network construction and control subsystem, issuing multi-tenant virtual network area information and collecting a virtual network network construction subsystem coupled to the multi-tenant virtual network construction and control subsystem and receiving the multi-tenant virtual network area information, the virtual overlay network construction subsystem responding to the multiple Tenant virtual network area information to establish a communication tunnel in the underlying network environment to provide packets sent by virtual machines on the multi-tenant virtual network to communicate across the physical machine through the tenant identification code; and multi-tenant virtual network controller subsystem And coupled to the multi-tenant virtual network construction and control subsystem and receiving the multi-tenant virtual network area information, and coupled to the virtual overlay network construction subsystem, wherein the multi-tenant virtual network controller subsystem Used to monitor virtual network information to obtain topology information, and based on the topology information and the multi-tenant virtual network area information Determining a flow direction of the packet sent by the virtual machine on the multi-tenant virtual network; if the source and destination of the packet sent by the virtual machine are not in the same physical machine, the multi-tenant virtual network controller subsystem receives the packet And configure the tenant ID for the packet. For example, the management and control system described in claim 1 wherein the multi-tenant virtual network construction and control subsystem comprises: a multi-tenant virtual network resource and topology dependency knowledge base; multi-tenant virtual network operation and presentation mode Group, providing user management interface, including total View the overall overview of the multi-tenant virtual network and schedule or set up the multi-tenant virtual network and its members; the multi-tenant virtual network area generates the decision-making unit, which is the execution result of the multi-tenant virtual network operation and presentation module. Integrating the information in the multi-tenant virtual network resource and the topology-dependent knowledge base to determine the multi-tenant virtual network area information; the multi-tenant virtual network generating decision unit, the manager operating through the multi-tenant virtual network And the execution result of the presentation module, integrating the information in the multi-tenant virtual network resource and the topology-dependent knowledge base to determine the multi-tenant virtual network message; the multi-tenant virtual network resource binding virtual machine decision The unit, the manager, integrates the information in the multi-tenant virtual network resource and the topology-dependent knowledge base through the multi-tenant virtual network operation and the execution result of the presentation module, and determines to create a virtual network card binding on the virtual machine. Dedicated multi-tenant virtual network messages; multi-tenant virtual network resources and topology monitoring collection units are used to actively monitor multi-tenant virtual Network resources and network topology information of the network environment, and update the information to the multi-tenant virtual network resource and topology-dependent relationship knowledge base; multi-tenant virtual network channel construction demand transmission unit for transmitting more Tenant virtual network area decision message to multi-tenant virtual network channel construction subsystem of the virtual overlay network construction subsystem; multi-tenant virtual network message transmission unit for transmitting multi-tenant virtual network area, multi-tenant virtual network The virtual network card on the road and virtual machine is bound to a specific multi-tenant virtual network message. The control system of claim 2, wherein the virtual overlay network construction subsystem comprises: The multi-tenant virtual overlay network construction subsystem communication unit is configured to receive the multi-tenant virtual network area decision message and transmit the system construction result; the multi-tenant virtual overlay network construction decision unit is configured to analyze the multi-tenant virtual network area Decision message; the virtual switch and the network node control unit convert the multi-tenant virtual network area decision message verified to be legal into a virtual overlay network construction command, and establish communication between the virtual switches on each physical machine Tunnels to form a basic virtual overlay network within the multi-tenant virtual network area. The control system of claim 3, wherein the multi-tenant virtual network controller subsystem comprises: a multi-tenant virtual network controller knowledge base; a multi-tenant virtual network topology monitoring unit, in the multi-tenant After the virtual network controller subsystem starts executing, continuously monitor the multi-tenant virtual network environment, determine and provide any network access requirements sent by the network node to the virtual switch; virtual switch and network node The detector continuously detects the information in the multi-tenant virtual network environment after the multi-tenant virtual network controller subsystem starts executing, and records the transaction in the multi-tenant virtual network controller knowledge base; the multi-tenant The virtual network decision unit receives the network access requirement from the multi-tenant virtual network topology monitoring unit to determine the action required to generate the multi-tenant virtual network access flow; the multi-tenant virtual network tenant identification code is tied According to the decision result of the multi-tenant virtual network decision unit, the tenant identification code needs to be configured for the packet, and the multi-tenant virtual network access flow direction is generated as The packet is configured with a tenant identification code; The multi-tenant virtual network single-point delivery unit performs single-point delivery according to the decision result of the multi-tenant virtual network decision unit, and generates multi-tenant virtual network access flow direction action as single-point delivery; multi-tenant virtual network multi-point The delivery unit, according to the decision result of the multi-tenant virtual network decision unit, is multi-point delivery, whereby the unit generates a tenant virtual network access flow direction action for multi-point delivery; the multi-tenant virtual network controller message delivery unit provides multi-tenancy The virtual network controller subsystem communicates with the multi-tenant virtual network construction and management subsystem and the virtual overlay network construction subsystem. A control method for controlling a virtual overlay network through a controller to generate a multi-tenant virtual network is applied to the control system according to any one of claims 1 to 4, wherein the control system includes a multi-tenant virtual network construction and control The system, the virtual overlay network construction subsystem, and the multi-tenant virtual network controller subsystem, the method includes the following steps: Step (1) querying the multi-tenant virtual network and the virtualized network extension for the managed cloud environment category Step (2) according to the multi-tenant virtual network and network topology data to determine a multi-tenant virtual network area; step (3) based on the multi-tenant virtual network and network topology data for decision setting Multi-tenant virtual network; step (4) according to the multi-tenant virtual network and network topology data to decide whether to bind the virtual machine virtual network card to the tenant virtual network; step (5) when the multi-tenant virtual network After the construction and management subsystem receives the multi-tenant virtual network area setting message, it is stored in the system knowledge base and transmitted to the virtual overlay network. Constructing a multi-tenant virtual overlay network construction subsystem of the subsystem and the multi-tenant virtual network controller subsystem; step (6) when the multi-tenant virtual network construction and control subsystem receives the multi-tenant virtual network setting message After being stored in the system knowledge base and passed to the multi-tenant virtual network controller subsystem; step (7) when the multi-tenant virtual network construction and control subsystem receives the virtual network card binding virtual tenant of the virtual machine The virtual network message is stored in the system knowledge base and transmitted to the multi-tenant virtual network controller subsystem; step (8) the multi-tenant virtual overlay network construction subsystem receives the virtual network construction from the multi-tenant When the tenant virtual network area setting command is established, the control subsystem determines whether to establish a virtual overlay network; and (9) the multi-tenant virtual network controller continuously detects and monitors the virtual switch and the network node during startup. And store the topology information in the system knowledge base, and receive the tenant network related setting information from the multi-tenant virtual network management system, and the information exists in its system knowledge. Step (10) The multi-tenant virtual network controller continuously monitors the network packet transmitted by the virtual switch during startup, and compares the knowledge base to determine whether it belongs to a specific tenant virtual network packet; step (11) When the multi-tenant virtual network controller determines that the network packet belongs to the specific tenant virtual network packet, the appropriate packet flow direction is determined according to the network packet information, and the tenant virtual network flow direction is sent to the virtual switch. Reach network connectivity within tenants and network isolation between tenants. The method of controlling the method according to claim 5, wherein the step of determining whether to establish a virtual overlay network in the step (8) further comprises: step (a) first testing whether the networks between the virtual switches are interoperable; If step (b) fails the test, it means that the setting command is not legal, and the returning cannot establish the tenant virtual network area; if the step (c) passes the test, it indicates that the setting instruction is legal and will be between each virtual switch. All establish communication tunnels and construct a virtual mesh network with full mesh topology. For example, in the control method described in claim 5, the step of determining whether it belongs to a specific tenant virtual network packet in step (10) comprises: step (a) according to the knowledge base of the multi-tenant virtual network controller, Whether the source MAC address of the network packet belongs to a specific tenant virtual network packet; if the step (b) belongs to a specific tenant virtual network, it is determined that the virtual network card of the source virtual machine is bound to the specific tenant virtual network. And sending out the network packet is received by the virtual switch, the multi-tenant virtual network controller informs the virtual switch of the correct network flow to achieve tenant virtual network isolation; step (c) if it is not a specific tenant virtual The network, that is, the source virtual machine that judges the packet, is not bound to the specific tenant virtual network, and informs the virtual switch to process the packet as a general network layer 2 switch. The control method according to claim 5, wherein the step of determining the packet forming the tenant virtual network flow in the step (11) comprises: step (a) according to the multi-tenant virtual network controller knowledge base, comparing Whether the network packet source MAC address belongs to the network packet sent by the virtual network card on the sent virtual switch. If it indicates that the packet is in the beginning of its virtual network exchange journey, otherwise it indicates that the packet is at the end of its virtual network exchange journey; step (b) when the network packet is at the starting point of its exchange journey, according to the network packet The destination MAC address determines that the network packet is unicast. If the multi-tenant virtual network controller knowledge base compares the network packet source MAC address with the destination MAC address, it belongs to the same virtual network and obtains its tenant identification. The code is used to notify the virtual switch to configure the tenant identification code for the packet and transmit it to the destination in a unicast manner; if the packet does not belong to the same virtual network, the packet is an illegal packet, and the virtual switch is notified to directly discard the packet; c) When the network packet is determined at the starting point of its exchange journey, the network packet is determined to be a broadcast packet according to the MAC address of the network packet, and the tenant identification code is obtained from the multi-tenant virtual network controller knowledge base to notify the virtual The switch configures the tenant ID for this packet and multicasts the packet to the virtual switch with the same tenant virtual network.埠, and at the same time, send a packet to each communication tunnel on the virtual overlay network to ensure that the virtual machine belonging to the same tenant virtual network can receive the broadcast packet correctly on other physical machines; step (d) when the network packet Under the condition of the end of the exchange journey, the network packet is judged to be unicast according to the destination MAC address of the network packet. Since it has ensured that the packet is a legitimate packet at the start of the starting point, the multi-tenant virtual network controller does not Any check is required to notify the virtual switch to unicast to the destination; step (e) when the network packet is at the end of its exchange journey, determine the network packet based on the destination MAC address of the network packet Is a broadcast packet, that is, it will be packetized by multicast. The connection to the same tenant virtual network exists on the virtual switch, but not on the communication tunnel on the virtual overlay network.