KR102114968B1 - System for direct connection between clouds - Google Patents

Abstract

Disclosed is a cloud direct connection system that is connected by a high-speed network circuit, guarantees security and independence between clients, and accommodates various client environments. A cloud direct connection system according to an aspect of the present invention includes: a first cloud in which at least one zone, which is a set of virtual servers of at least one client, is constructed as a first cloud virtualizing computing resources; A first direct connection switch that serves as a gateway to the first cloud, comprising: a first direct connection switch that is connected to each zone by assigning a port for each zone built in the first cloud; A second cloud in which at least one zone, which is a set of other virtual servers of the at least one client, is built as a second cloud virtualized computing resources; And a second direct connection switch connected to the first direct connection switch through a dedicated line and serving as a gateway to the second cloud, wherein a port is allocated for each zone built in the second cloud and connected to each zone. 2 includes a direct connection switch.

Description

Cloud direct connection system {SYSTEM FOR DIRECT CONNECTION BETWEEN CLOUDS}

The present invention relates to a technique for connecting between clouds in a remote location, and more particularly, to a system for directly or directly connecting between clouds in a remote location.

Cloud computing is a computing service that pays a fee for using large-scale IT resources by using virtualization technology and distributed processing technology to service computing resources over the Internet. That is, cloud computing is an Internet-based user-oriented on-demand outsourcing service technology that integrates and provides computing resources existing in different physical locations into one using virtualization technology.

If the Internet is provided, you can use your own computing environment regardless of time and place, charge for the amount of time you use, and all services such as hardware / software and after-services can be provided in the cloud computing environment. Therefore, system maintenance, maintenance cost, hardware / software purchase cost, and energy saving can be expected.

As cloud computing services are attracting attention, IT giants such as Google, Amazon, Apple, and Microsoft are opening the cloud computing era. Cloud computing services are evolving into cloud computing service types such as public cloud, private cloud, and hybrid cloud.

Public cloud provides cloud services through the Internet to a large number of unspecified people. Public cloud does not mean free or open data and source, and provides services such as user access control and billing. In the public cloud, service providers manage user information and share all resources.

A private cloud is a service that provides a computing environment like a public cloud and directly manages services, data, and processes in a specific company or institution. For security, it is a closed cloud service model that avoids external contact and is accessible only to authorized persons.

Hybrid cloud is a public cloud and private cloud or a combined service of public cloud and co-location system.It provides a basic public cloud, and data and services that do not want to share are private cloud service policies or co-location systems. Follow the policy of.

The demand for the hybrid cloud is increasing due to the advantages of public cloud, that is, scalability and economics, and the advantage of private cloud or co-location system, that is, exclusive use.

Domestic published patent 10-2012-0030126 (published on March 27, 2012)

However, in order to build the hybrid cloud, a high-speed network line is required for stable acceptance of client traffic, and it is necessary to ensure security and independence between clients, and to connect various client environments such as data centers of cloud operators and computer rooms of clients. Requirements must be satisfied.

The present invention has been proposed to solve the above problems, and has an object to provide a cloud direct connection system that is connected by a high-speed network circuit, guarantees security and independence between clients, and accommodates various client environments.

Other objects and advantages of the present invention can be understood by the following description, and will be more clearly understood by examples of the present invention. In addition, it will be readily appreciated that the objects and advantages of the present invention can be realized by means of the appended claims and combinations thereof.

The cloud direct connection system according to an aspect of the present invention for achieving the above object is a first cloud in which virtualization of a computing resource is a first cloud in which at least one zone, which is a set of virtual servers of at least one client, is constructed. cloud; A first direct connection switch that serves as a gateway to the first cloud, comprising: a first direct connection switch that is connected to each zone by assigning a port for each zone built in the first cloud; A second cloud in which at least one zone, which is a set of other virtual servers of the at least one client, is built as a second cloud virtualized computing resources; And a second direct connection switch connected to the first direct connection switch through a dedicated line and serving as a gateway to the second cloud, wherein a port is allocated for each zone built in the second cloud and connected to each zone. 2 includes a direct connection switch.

Each of the first and second direct connection switches may independently set a routing table for each sub-interface in order to set sub-interfaces for each client in the zone and separate routing for each client.

The first and second direct connection switches may set a virtual LAN (VLAN) for each sub-interface.

Each of the first and second clouds may include, for each zone, a client-side switch for connecting virtual servers of clients in the zone to the first and second direct connection switches.

Clients in the zone may use IP addresses overlapping with other clients in the zone, and the client-side switch may be an L2 switch.

A plurality of the first and second direct connection switches and the client-side switches are respectively installed, and each of the plurality of first and second direct connection switches may configure a redundancy path through a plurality of client-side switches.

Each of the first and second direct connection switches may perform packet routing by exchanging IP addresses of clients in charge of each direct connection switch.

The first and second direct connection switches use any one of Open Shortest Path First (OSPF), Routing Information Protocol (RIP), or Border Gateway Protocol (BGP). The first and second direct connection switches can exchange IP address information of the clients with each other.

The cloud direct connection system according to another aspect of the present invention for achieving the above object is a first cloud in which virtualization of a computing resource is a first cloud in which at least one zone, which is a set of virtual servers of at least one client, is constructed. cloud; A first direct connection switch that serves as a gateway to the first cloud, comprising: a first direct connection switch that is connected to each zone by assigning a port for each zone built in the first cloud; A second cloud in which different servers of the at least one client configure zones for each client to form an independent network for each client; And a second direct connection switch connected to the first direct connection switch through a dedicated line and serving as a gateway to the second cloud, wherein a second direct connection is established by setting a sub-interface for each zone of the second cloud. Switch.

The first cloud includes, for each zone, a first client-side switch for connecting virtual servers of clients in the zone to the first direct connection switch, and the second cloud is a physical link to the second direct connection switch A second client-side switch connected to; And a third client-side switch connected to each zone in the second cloud and connecting each zone to the second client-side switch.

The first direct connection switch sets a sub-interface for each client in a zone for each port and independently sets a routing table for each sub-interface to separate routing for each client, and the second direct connection switch includes the second To allocate ports for each client-side switch and to separate routing for each zone, sub-interfaces for each zone are set, and routing tables can be set independently for each sub-interface.

The first and second direct connection switches may set a virtual LAN (VLAN) for each sub-interface.

Clients in the zone of the first cloud may use IP addresses overlapping with other clients in the zone, the first and second client-side switches may be L2 switches, and the third cloud-side switch may be L3 switches.

The first and second direct connection switches and the plurality of first and second client-side switches are respectively installed, and each of the plurality of first and second direct connection switches constitutes a redundancy path through a plurality of first and second client-side switches. can do.

Each of the first and second direct connection switches may perform packet routing by exchanging IP addresses of clients in charge of each direct connection switch.

The first and second direct connection switches use any one of Open Shortest Path First (OSPF), Routing Information Protocol (RIP), or Border Gateway Protocol (BGP). The first and second direct connection switches can exchange IP address information of the clients with each other.

The present invention enables stable accommodating of client traffic such as backup, synchronization, and disaster recovery in a hybrid cloud by directly connecting the clouds in spaces separated from each other by a high-speed network line.

In addition, the present invention secures security and independence between clients by accommodating multiple zones in one switch device connecting between clouds in remote areas and supporting multiple virtual LANs in multiple zones in the cloud. .

1 is a view showing the configuration of a cloud direct connection system according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating a signal path in the first regional network of FIG. 1.
3 is a view showing the configuration of a cloud direct connection system according to another embodiment of the present invention.
FIG. 4 is a diagram illustrating a signal path in the second regional network of FIG. 3.

The above objects, features, and advantages will be more apparent through the following detailed description in connection with the accompanying drawings, and accordingly, those skilled in the art to which the present invention pertains can easily implement the technical spirit of the present invention. There will be. In addition, in the description of the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted. Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a view showing the configuration of a cloud direct connection system according to an embodiment of the present invention.

Referring to FIG. 1, the cloud direct connection system according to the present embodiment illustrates two geographically separated regions. In FIG. 1, the first region is a data center in which a client (customer) cloud server is built, and the second region is a data center in which a cloud server of the same client is geographically separated from the first region.

As shown in FIG. 1, the contact point between the first region and the second region is DC (Direct Connection) switches 110 and 120. That is, the DC switch 110 in the first area and the DC switch 120 in the second area are directly connected to each other to serve as a gateway for each area, and for example, a dedicated circuit of 10 gigabytes is provided.

The DC switch 110 of the first region and the DC switch 120 of the second region route packets through an Open Shortest Path First (OSPF). In addition, the DC switch 110 in the first area and the DC switch 120 in the second area exchange packets with the IP addresses of the clients in charge of each switch to perform packet routing.

The DC switches 110 and 120 are L3 switches and provide switch virtualization functions for physically integrating server connections of clients. The DC switches 110 and 120 allocate an interface for each zone, specifically, for each of the client-side switches 130 and 140, that is, a port, and set each sub-interface for each of the assigned ports for each client in the zone. . And the DC switch (110, 120) sets a virtual LAN (VLAN: Virtual LAN) on each sub-interface for each client. That is, different virtual LANs are set for each client. In addition, the DC switches 110 and 120 separately set a routing table for each sub-interface. That is, it operates by applying an independent routing table for each client assigned to the sub-interface.

Specifically, the DC switches 110 and 120 allocate ports for each zone, specifically for each of the client-side switches 130 and 140, and set sub-interfaces as many as the number of clients in each port. A virtual route forwarding (VRF) instant is configured in each sub-interface. Here, configuring the VRF instance means separating the routing for each client, which means creating a separate routing table for each client.

Table 1 shows an example of allocating an interface for each zone in the DC switches 110 and 120.

Zone name Interface Subinterface VLAN ZONE-A Eth1 / 1 Eth1 / 1.1 ~ Eth1 / 1.4 100 ~ 110 ZONE-B Eth1 / 2 Eth1 / 2.1 ~ Eth1 / 2.4 110 ~ 120 ZONE-C Eth1 / 3 Eth1 / 3.1 ~ Eth1 / 3.4 121-130 ZONE-D Eth1 / 4 Eth1 / 4.1 ~ Eth1 / 4.4 131 ~ 140 ZONE-E Eth1 / 5 Eth1 / 5.1 ~ Eth1 / 5.4 141 ~ 150

According to the example in [Table 1], the ZONE-A is assigned to the Eth1 / 1 interface of the DC switch 110, and each sub-interface (Eth1 / 1.1 to Eth1 / 1.4) is assigned to each client belonging to the corresponding ZONE-A. It is assigned, and a virtual LAN (VALN) is set for each client. The same is set for the other zones ZONE-B, ZONE-C, ZONE-D, and ZONE-E.

Each regional data center is composed of multiple zones, and each zone has several clients' servers. The servers of the clients in each zone are configured with a virtual LAN (VLAN) for each client, but the virtual LAN for each client does not overlap. However, IP addresses can be duplicated for each client in the zone. That is, the servers of the client A and the servers of the client B have different virtual LANs, but the servers of the client A and the servers of the client B can be assigned the same IP address to each other.

Servers of multiple clients in one zone share one client-side switch (130, 140). The DC switches 110 and 120 are connected to the client-side switches 130 and 140 through a physical link. That is, the DC switches 110 and 120 allocate and connect one physical port to the client-side switches 130 and 140.

The client-side switches 130 and 140 are L2 switches and are connected to the DC switches 110 and 120 by physical links as described above. As shown in FIG. 1, the switches 130 and 140 on the client side are connected to servers of at least one or more clients.

The server in each zone is a virtual machine-based virtualization server. The virtualization server creates a logical virtual machine on physical hardware, and the same operating system and applications as the physical server are installed and operated to provide the same environment as the physical server. At this time, a hypervisor technology may be used to implement a virtualization environment.

As illustrated in FIG. 1, two DC switches 110 and 120 are illustrated for each region. That is, the redundancy of the DC switches 110 and 120 is implemented to prevent a system failure by bypassing the path to the other DC switches 110 and 120 when one of the DC switches 110 and 120 fails. The DC switches 110 and 120 provide a redundant path through the client-side switches 130 and 140. That is, the DC switches 110 and 120 make a redundancy path through a virtual router redundancy protocol (VRRP) or a hot standby router protocol (HSRP) through the client-side switch 130.

FIG. 2 is a view showing a signal path in the first regional network of FIG. 1. Referring to FIG. 2, two DC switches 110 are installed at external contacts of the first regional network, and the two DC switches 110 ) Are connected to two client-side switches 130 connected to servers located in the first zone. In addition, in the first zone, servers of Client A and Client B are installed, and different Virtual LANs are set for Client A and Client B.

In FIG. 2, the dotted line is the signal path of client A, and the dashed-dotted line is the signal path of client B. The DC switch 110 is connected to the client-side switch 130 by a physical link and sets the number of clients to the port interworking with the client-side switch 130, that is, in the present embodiment, sets two sub-interfaces, and to A virtual route forwarding (VRF) instance 210 is configured. That is, client A and client B have separate routing tables.

The DC switch 110 provides a redundant path through the switch 130 on the client side. That is, the two DC switches 110 make a redundancy path through a virtual router redundancy protocol (VRRP) or a hot standby router protocol (HSRP) through the switch 130 on the client side. Therefore, when one of the two DC switches 110 fails, data can be transmitted and received through the remaining DC switches.

3 is a view showing the configuration of a cloud direct connection system according to another embodiment of the present invention. The embodiment with reference to FIG. 1 is an embodiment for explaining a direct connection between the cloud and the cloud, while the system shown in FIG. 3 is an embodiment for explaining a direct connection between the client's internal network and the client's cloud.

Referring to FIG. 3, the cloud direct connection system according to the present embodiment illustrates two geographically separated regions. In FIG. 3, the first region is a data center where a client (customer) cloud server is built, and the second region is a client-owned data center and may be a co-location system. In the embodiment with reference to FIG. 1, servers of a plurality of clients form one zone, whereas in the embodiment with reference to FIG. 3, servers of one client configure one zone, that is, one zone for each client. To form an independent network for each client. The system configuration of the first region in FIG. 3 is the same as the system configuration of the first region described with reference to FIG. 1.

In addition, in FIG. 3, the contact point with the first area in the second area, that is, the gateway is a DC switch 320, and the corresponding DC switch 320 is the same as the DC switch 120 in the second area described with reference to FIG. 1. Do. The DC switch 110 in the first area and the DC switch 320 in the second area are directly connected to provide a dedicated circuit of, for example, 10 gigabytes. In addition, the DC switch 110 in the first area and the DC switch 320 in the second area may include an Open Shortest Path First (OSPF), a Routing Information Protocol (RIP), or a border route protocol ( Packet routing is performed between clients by exchanging IP addresses of clients in charge of each switch using dynamic routing protocols such as Border Gateway Protocol (BGP). In addition, by using a dynamic routing protocol between the two regional switches, if the circuit between the DC switch 110 in the first region and the DC switch 320 in the second region fails or the line is disconnected for maintenance, it is transferred to another normal circuit. Packets are transmitted with minimal disruption.

The DC switch 320, like the DC switch 110 in the first region, is an L3 switch and provides a switch virtualization function for physically integrating server connections of clients. The DC switch 320 allocates an interface, that is, a port, for each first client-side switch 310, and sets each sub-interface for each client, that is, for each zone. In addition, the DC switch 320 sets a virtual LAN (VLAN) on a sub-interface for each client, that is, for each zone. That is, different virtual LANs are set for each client. In addition, the DC switch 320 sets a routing table separately for each sub-interface. That is, it operates by applying an independent routing table for each client assigned to the sub-interface.

The first client-side switch 310 is connected to the DC switch 320 through a physical link. That is, the DC switch 320 allocates and connects one physical port to the first client-side switch 310. The first client-side switch 310 is an L2 switch and is connected to the DC switch 320 through a physical link as described above. As illustrated in FIG. 3, a server 310 of at least one or more clients is connected to the switch 310 on the first client side. The first client-side switch 310 provides a customer-specific access VLAN port.

Unlike the embodiment with reference to FIG. 1, in the present embodiment with reference to FIG. 3, a second client-side switch 330 is included between the client's server (client A and client B in FIG. 3) and the first client-side switch 310. do. The second client-side switch 330 is an L3 switch.

That is, since each client in the second region has an independent network, an L3 switch is disposed for each client to communicate with the first client-side switch 310. The first client-side switch 310 in the second region provides an L2 bridge as an L2 switch. When a client's servers access L2, that is, the OSI 2 layer, a loop occurs, so L3 for each client. The loop is prevented by arranging the switch, the second client-side switch 330.

In FIG. 3, a zone is formed for each client in the second region. In the first region, servers of several clients could be located in one zone, but the second region has an independent network for each client, so a zone is configured for each client, and the second client-side switch for each client as described above Connect 330. The server of each client in the second region may be a physical server or a virtual machine-based virtualization server.

4 is a view showing a signal path in the second regional network of FIG. 3, referring to FIG. 4, two DC switches 320 are installed at the external contacts of the second regional network, and the two DC switches 320 ), The first client-side switch 310 is connected. The first client-side switch 310 corresponds to the client-side switch 130 in the first region. In addition, a second client-side switch 330 is installed between the server of the clients in the second region and the first client-side switch 310. The second client-side switch 330 is an L3 switch, and the first client-side switch 210 is an L2 switch.

In FIG. 4, the dotted line is the signal path of client A, and the dashed-dotted line is the signal path of client B. The DC switch 320 is connected to the first client-side switch 310 by a physical link and sets the number of clients to the port interworking with the first client-side switch 310, that is, in this embodiment, sets two sub-interfaces. A virtual route forwarding (VRF) instance is configured in each sub-interface. That is, client A and client B have separate routing tables.

The DC switch 320 provides a redundancy path through the first client-side switch 310. That is, the two DC switches 320 make a redundancy path through the Virtual Router Redundancy Protocol (VRRP) or Hot Standby Router Protocol (HSRP) through the first client-side switch 310. Therefore, when one of the two DC switches 320 fails, data can be transmitted and received through the remaining DC switches.

Unlike the network of the first region described with reference to FIG. 2, a second client-side switch 330 is installed between the client's server and the first client-side switch 310 in the network of the second region of the present embodiment. The first client-side switch 310 transmits data on a frame-by-frame basis using the Ethernet protocol as the L2 switch, while the second client-side switch 330 transmits data on a packet-by-packet basis using the IP protocol as the L3 switch. .

While this specification includes many features, such features should not be construed as limiting the scope of the invention or the claims. In addition, features described in individual embodiments herein may be implemented in combination in a single embodiment. Conversely, various features that are described in a single embodiment herein may be implemented in various embodiments individually or in combination as appropriate.

The present invention described above, since it is possible for a person of ordinary skill in the art to which the present invention pertains, various substitutions, modifications and changes are possible without departing from the technical spirit of the present invention. It is not limited by the drawings.

110, 120, 320: DC switch
130, 140: client-side switch
310: first client-side switch
330: second client-side switch

Claims (16)

A first cloud virtualized computing resources, comprising: a first cloud in which at least one zone, which is a set of virtual servers of each of the at least one client, is constructed;
A first direct connection switch that serves as a gateway to the first cloud, comprising: a first direct connection switch connected to each zone by assigning a port for each zone built in the first cloud;
A second cloud constructed in a location different from the first cloud and virtualizing computing resources, the second cloud having at least one zone that is a set of different virtual servers of each of the at least one client; And
A second direct connection switch that is connected to the first direct connection switch through a dedicated line and serves as a gateway to the second cloud. A second direct connection switch allocates ports for each zone built in the second cloud and connects each zone Cloud direct connection system comprising a; direct connection switch. According to claim 1,
Each of the first and second direct connection switches,
A cloud direct connection system characterized in that a routing table is set independently for each sub-interface in order to set sub-interfaces for each client in a zone for each port and to separate routing for each client. According to claim 2,
The first and second direct connection switches,
Cloud direct connection system, characterized in that for setting the virtual LAN (VLAN: Virtual LAN) for each sub-interface. The method of claim 3,
Each of the first and second clouds,
Each zone, a cloud direct connection system comprising a client-side switch for connecting the virtual servers of the clients in the zone to the first and second direct connection switches. The method of claim 4,
Clients in the zone can use IP addresses overlapping with other clients in the zone,
The client-side switch is a cloud direct connection system, characterized in that the L2 switch. The method of claim 4,
A plurality of the first and second direct connection switches and the client-side switches are respectively installed,
A cloud direct connection system, characterized in that each of the plurality of first and second direct connection switches constitutes a redundant path through a plurality of client-side switches. The method according to any one of claims 1 to 6,
Each of the first and second direct connection switches,
A cloud direct connection system characterized in that routing of packets is performed by exchanging IP addresses of clients in charge of each direct connection switch. The method of claim 7,
The first and second direct connection switches,
The first and second direct connection switches between each other using one of the Open Shortest Path First (OSPF), Routing Information Protocol (RIP), or Border Gateway Protocol (BGP). Cloud direct connection system, characterized in that it exchanges the IP address information of the client. A first cloud virtualized computing resources, comprising: a first cloud in which at least one zone, which is a set of virtual servers of each of the at least one client, is constructed;
A first direct connection switch that serves as a gateway to the first cloud, comprising: a first direct connection switch connected to each zone by assigning a port for each zone built in the first cloud;
A second cloud constructed in a location different from the first cloud and virtualizing computing resources, wherein the at least one or more clients have different virtual servers forming zones for each client to form an independent network for each client; And
A second direct connection switch connected to the first direct connection switch through a dedicated line and serving as a gateway to the second cloud, wherein a second direct connection switch is connected by setting a sub-interface for each zone of the second cloud Cloud direct connection system comprising a. The method of claim 9,
The first cloud,
For each zone, a first client-side switch for connecting virtual servers of clients in the zone to the first direct connection switch,
The second cloud,
A second client-side switch connected by a physical link to the second direct connection switch; And a third client-side switch connected to each zone in the second cloud and connecting each zone to the second client-side switch. The method of claim 10,
The first direct connection switch,
To set each sub-interface for each client in the zone and to separate routing for each client, set the routing table for each sub-interface independently
The second direct connection switch,
A cloud direct connection system, characterized in that a port is assigned to each of the second client-side switches, a sub-interface for each port is set for each port, and a routing table is set for each sub-interface independently. The method of claim 11,
The first and second direct connection switches,
Cloud direct connection system, characterized in that for setting the virtual LAN (VLAN: Virtual LAN) for each sub-interface. The method of claim 12,
The clients in the zone of the first cloud may use IP addresses overlapping with other clients in the zone,
The first and second client-side switches are L2 switches,
The third client-side switch is a cloud direct connection system, characterized in that the L3 switch. The method of claim 11,
A plurality of the first and second direct connection switches and the first and second client-side switches are respectively installed,
A cloud direct connection system, characterized in that each of the plurality of first and second direct connection switches constitutes a redundancy path through a plurality of first and second client side switches. The method according to any one of claims 9 to 14,
Each of the first and second direct connection switches,
A cloud direct connection system characterized by routing packets by exchanging IP addresses of clients in charge of each direct connection switch. The method of claim 15,
The first and second direct connection switches,
The first and second direct connection switches between each other using one of the Open Shortest Path First (OSPF), Routing Information Protocol (RIP), or Border Gateway Protocol (BGP). A cloud direct connection system that exchanges client's IP address information.

Images