KR20150006575A - System for direct connection between clouds - Google Patents

Abstract

Disclosed is a cloud direct connection system capable of being connected by using a high network line; securing the security and the independence between clients; and receiving various client environments. The cloud direct connection system according to an embodiment of the present invention comprises a first cloud which installs one or more zones which are a group of virtual servers of clients as the first cloud which virtualizes a computing resource; a first direct connection switch which performs a gateway role for the first cloud and is connected for each zone by assigning a port to each zone installed in the first cloud; a second cloud which installs the zones which are the group of different virtual servers of the clients as the second cloud which virtualizes the computing resource; and a second direct connection switch which is connected to the first direct connection switch by using a private line, performs the gateway role for the second cloud, and is connected to each zone by assigning the port to each zone installed in the second cloud.

Description

[0001] SYSTEM FOR DIRECT CONNECTION BETWEEN CLOUDS [0002]

Field of the Invention The present invention relates to a technology for connecting clouds in a remote place, and more specifically, to a system for directly connecting clouds in a remote place.

Cloud computing is a computing service that pays a large amount of IT resources by using virtualization technology and distributed processing technology to service computing resources on the Internet. In other words, cloud computing is an Internet-based user-oriented on-demand outsourcing service technology that integrates computing resources existing in different physical locations into a single virtualization technology.

If the Internet is provided, you can use your own computing environment regardless of time and place, charge a fee for the time you use, and all services such as hardware / software and post-service can be provided in the cloud computing environment Therefore, system maintenance and repair costs, hardware / software purchase cost, and energy savings can be expected.

Cloud computing services have gained attention, and IT conglomerates like Google, Amazon, Apple, and Microsoft are opening the era of cloud computing. Cloud computing services are developing into cloud computing service types such as public cloud, private cloud, and hybrid cloud.

The public cloud provides cloud services to the unspecified number of people over the Internet. Public clouds do not mean free or open data and sources, and they provide services such as user access control and billing. A public cloud is a service provider that manages user information and shares all resources.

A private cloud is a service that provides a computing environment such as a public cloud, and manages services, data, and processes directly from a specific enterprise or organization. For security reasons, it is a closed cloud service model that can be accessed only by authorized persons while avoiding contact with outside.

A hybrid cloud is a combination of a public cloud and a private cloud or a public cloud and co-location system, providing a public cloud natively, while data and services that are not shared are private cloud service policies or co- Policy.

These hybrid clouds are increasingly in demand because of the advantages of a public cloud: scalability and economics, as well as the benefits of a private cloud or co-location system, ie, exclusive use.

Korean Patent Laid-Open No. 10-2012-0030126 (published on Mar. 27, 2012)

However, in order to construct the hybrid cloud, a high-speed network line is required for reliable reception of client traffic, security and independence between clients must be guaranteed, and various client environments such as a data center of a cloud provider and a computer room of a client should be connected The requirements to be met must be met.

It is an object of the present invention to provide a cloud direct connection system which is connected to a high-speed network line and ensures security and independence between clients and accommodates various client environments.

Other objects and advantages of the present invention will become apparent from the following description, and it will be understood by those skilled in the art that the present invention is not limited thereto. It will also be readily apparent that the objects and advantages of the invention may be realized and attained by means of the instrumentalities and combinations particularly pointed out in the appended claims.

According to an aspect of the present invention, there is provided a cloud direct connection system including a first cloud that virtualizes computing resources, a first cloud, cloud; A first direct connection switch performing a role of a gateway to the first cloud, the first direct connection switch being connected to each zone by allocating a port for each zone established in the first cloud; A second cloud in which at least one zone, which is a collection of other virtual servers of the at least one client, is constructed as a second cloud that virtualizes computing resources; And a second direct connection switch connected to the first direct connection switch through a leased line and serving as a gateway to the second cloud, wherein a port is allocated to each zone established in the second cloud, 2 direct connection switch.

Each of the first and second direct connection switches may independently set a routing table for each sub-interface in order to set a sub-interface for each client in the zone and separate routing for each client.

The first and second direct connection switches may set a virtual LAN (VLAN) for each sub-interface.

Each of the first and second clouds may include a client-side switch for connecting virtual servers of clients in the zone to the first and second direct connection switches, for each zone.

Clients in the zone can use the IP address in duplicate with other clients in the zone, and the client-side switch can be an L2 switch.

A plurality of first and second direct connection switches and a plurality of client side switches are provided, and each of the first and second direct connection switches can configure a redundancy path through a plurality of client side switches.

Each of the first and second direct connection switches can exchange the IP addresses of the clients of the respective direct connection switches to perform packet routing.

The first and second direct connection switches use any one of an Open Shortest Path First (OSPF), a Routing Information Protocol (RIP), and a Border Gateway Protocol (BGP). The first and second direct connection switches can exchange the IP address information of the client with each other.

According to another aspect of the present invention, there is provided a cloud direct connection system, comprising: a first cloud that virtualizes computing resources; a first cloud that virtualizes computing resources, cloud; A first direct connection switch performing a role of a gateway to the first cloud, the first direct connection switch being connected to each zone by allocating a port for each zone established in the first cloud; A second cloud in which other servers of the at least one client configure a zone for each client to form an independent network for each client; And a second direct connection switch connected to the first direct connection switch by a leased line and serving as a gateway to the second cloud, wherein a second direct connection is established by setting a sub interface for each zone of the second cloud, Switch.

Wherein the first cloud includes a first client-side switch for connecting virtual servers of clients in the zone to the first direct-connect switch for each zone, and the second cloud is connected to the second direct- A second client-side switch connected to the second client-side switch; And a third client-side switch connected for each zone in the second cloud and for connecting each zone to the second client-side switch.

Wherein the first direct connection switch independently sets a routing table for each sub-interface in order to set a sub-interface for each client in a zone and to separate routing for each client, and the second direct connection switch sets the second direct- In order to allocate ports for each client-side switch and to separate routing by zone, each sub-interface can be set up for each port and the routing table can be set independently for each sub-interface.

The first and second direct connection switches may set a virtual LAN (VLAN) for each sub-interface.

Clients in the zone of the first cloud may use an IP address with another client in the zone, the first and second client-side switches may be L2 switches, and the third cloud-side switch may be an L3 switch.

Wherein a plurality of first and second direct connection switches and first and second client side switches are provided, and each of the first and second direct connection switches is configured to configure a redundant path through a plurality of first and second client side switches can do.

Each of the first and second direct connection switches can exchange the IP addresses of the clients of the respective direct connection switches to perform packet routing.

The first and second direct connection switches use any one of an Open Shortest Path First (OSPF), a Routing Information Protocol (RIP), and a Border Gateway Protocol (BGP). The first and second direct connection switches can exchange the IP address information of the client with each other.

The present invention enables reliable reception of client traffic such as backup, synchronization, and failure recovery in the hybrid cloud by directly connecting the cloud of the separated areas to the high-speed network line.

In addition, the present invention assures security and independence between clients by accommodating multi-zones in one switch device connecting the clouds in the separated regions and supporting redundant virtual LANs in a plurality of zones in the cloud .

1 is a diagram illustrating a configuration of a cloud direct connection system according to an embodiment of the present invention.
FIG. 2 is a diagram illustrating a signal path in the first area network of FIG. 1; FIG.
3 is a diagram illustrating a configuration of a cloud direct connection system according to another embodiment of the present invention.
FIG. 4 is a diagram illustrating signal paths in the second area network of FIG. 3. FIG.

The foregoing and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings, in which: There will be. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. Hereinafter, a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a configuration of a cloud direct connection system according to an embodiment of the present invention.

Referring to FIG. 1, a cloud direct connection system according to the present embodiment illustrates two geographically separated areas. 1, a first area is a data center in which a client (customer) cloud server is constructed, and a second area is a data center in which a cloud server of the same client is located geographically distant from the first area.

As shown in FIG. 1, the contact point between the first area and the second area is DC (Direct Connection) switches 110 and 120. That is, the DC switch 110 of the first area and the DC switch 120 of the second area are directly connected to each other to serve as a gateway for each area, for example, a 10-gigabit dedicated line is provided.

The DC switch 110 of the first area and the DC switch 120 of the second area route the packet with the Open Shortest Path First (OSPF) protocol. Also, the DC switch 110 of the first area and the DC switch 120 of the second area mutually exchange IP addresses of the clients to be served by the respective switches.

DC switches 110 and 120 provide a switch virtualization function to physically integrate the server connection of clients as an L3 switch. DC switches 110 and 120 allocate an interface, i.e., a port, for each of the zones 130 to 140, specifically for each of the client-side switches 130 and 140, and sets the sub-interface for each of the allocated ports for each client in the zone . The DC switches 110 and 120 set virtual LANs (VLANs) on subinterfaces of respective clients. That is, different virtual LANs are set for each client. The DC switches 110 and 120 separately set the routing table for each sub-interface. In other words, it operates by applying independent routing table for each client assigned to the sub-interface.

Specifically, the DC switches 110 and 120 allocate a port for each zone, specifically, for each of the client-side switches 130 and 140, and set a sub-interface for the number of clients to each port Configure a Virtual Route Forwarding (VRF) instant on each subinterface. Here, configuring the VRF instance means to separate the routing for each client and to create a separate routing table for each client.

An example of allocating an interface for each zone in the DC switches 110 and 120 is shown in Table 1 below.

ZONE Interface Subinterface VLAN ZONE-A Eth1 / 1 Eth1 / 1.1 to Eth1 / 1.4 100-110 ZONE-B Eth1 / 2 Eth1 / 2.1 ~ Eth1 / 2.4 110 ~ 120 ZONE-C Eth1 / 3 Eth1 / 3.1 to Eth1 / 3.4 121 ~ 130 ZONE-D Eth1 / 4 Eth1 / 4.1 ~ Eth1 / 4.4 131-140 ZONE-E Eth1 / 5 Eth1 / 5.1 to Eth1 / 5.4 141-150

According to the example shown in Table 1, the ZONE-A is assigned to the Eth1 / 1 interface of the DC switch 110 and the subinterfaces Eth1 / 1.1 to Eth1 / 1.4 are assigned to each client belonging to the ZONE- And a virtual LAN (VALN) is set for each client. The same is true for the other zones ZONE-B, ZONE-C, ZONE-D and ZONE-E.

The data center in each region is composed of a plurality of zones, and there are servers of several clients in each zone. Virtual LANs (VLANs) are set for each client of each client in each zone. Virtual LANs for each client do not overlap. However, within the zone, IP addresses can be used redundantly for each client. That is, the servers of the client A and the servers of the client B have different virtual LANs, but the servers of the client A and the servers of the client B can be assigned the same IP address.

The servers of a plurality of clients in one zone share one client-side switch 130, 140. The DC switches 110 and 120 are connected to the client side switches 130 and 140 through a physical link. That is, the DC switches 110 and 120 allocate and connect one physical port to the client-side switches 130 and 140.

The client-side switches 130 and 140 are L2 switches and are physically linked to the DC switches 110 and 120 as described above. As shown in FIG. 1, the switches 130 and 140 on the client side are connected to servers of at least one or more clients.

The server in each zone is a virtual machine-based virtualization server. The virtualization server creates a logical virtual machine on the physical hardware and installs the same operating system and applications as the physical server to provide the same environment as the physical server. At this time, a hypervisor technique may be used to implement a virtualization environment.

As shown in FIG. 1, two DC switches 110 and 120 are shown for each region. That is, the redundancy of the DC switches 110 and 120 is implemented to prevent a system failure when a failure occurs in one of the DC switches 110 and 120 by bypassing the path to another DC switch 110 and 120. The DC switches 110 and 120 provide redundancy paths through the client-side switches 130 and 140. That is, the DC switches 110 and 120 create a redundant path through Virtual Router Redundancy Protocol (VRRP) or Hot Standby Router Protocol (HSRP) through the client-side switch 130.

2 shows a signal path in the first area network of FIG. 1. Referring to FIG. 2, two DC switches 110 are installed at the external contacts of the first area network and two DC switches 110 The two client-side switches 130 connected to the servers located in the first zone are connected. In the first zone, the servers of the client A and the client B are installed, and the client A and the client B are set to different virtual LANs (VLANs).

2, the dashed line is the signal path of the client A, and the one-dot chain line is the signal path of the client B. The DC switch 110 is connected to the client-side switch 130 through a physical link and sets the number of clients in the port linked to the client-side switch 130, that is, two subinterfaces in this embodiment, And configure a Virtual Route Forwarding (VRF) instance 210. That is, the routing tables of client A and client B are created separately.

The DC switch 110 provides a redundancy path through the switch 130 on the client side. That is, the two DC switches 110 establish a redundant path through Virtual Router Redundancy Protocol (VRRP) or Hot Standby Router Protocol (HSRP) through the switch 130 on the client side. Accordingly, when any one of the two DC switches 110 fails, the data can be transmitted / received through the remaining DC switches.

3 is a diagram illustrating a configuration of a cloud direct connection system according to another embodiment of the present invention. 1 is an embodiment for explaining a direct connection between a cloud and a cloud, whereas the system shown in FIG. 3 is an embodiment for explaining a direct connection between a client's in-house network and a client's cloud.

Referring to FIG. 3, the cloud direct connection system according to the present embodiment illustrates two geographically separated areas. In Figure 3, the first region is the data center where the client (customer) cloud server is built and the second region is the client-owned data center, which may be a co-location system. In the embodiment of FIG. 1, the servers of the plurality of clients form one zone, whereas in the embodiment of FIG. 3, the servers of one client constitute one zone, that is, one zone for each client Thereby forming an independent network for each client. In FIG. 3, the system configuration of the first area is the same as the system configuration of the first area described with reference to FIG.

3, the contact point, i.e., the gate, with the first area of the second area is the DC switch 320, and the corresponding DC switch 320 is the same as the DC switch 120 of the second area described with reference to FIG. Do. The DC switch 110 of the first area and the DC switch 320 of the second area are directly connected to provide a dedicated line of, for example, 10 gigabytes. The DC switch 110 of the first area and the DC switch 320 of the second area are connected to each other through an Open Shortest Path First (OSPF), a Routing Information Protocol (RIP) Border Gateway Protocol (BGP)), etc., to exchange packets between clients by exchanging the IP addresses of the clients responsible for each switch. Also, by using the dynamic routing protocol between the two local switches, even if the line between the DC switch 110 of the first area and the DC switch 320 of the second area fails or the line is disconnected for maintenance, Packets are sent with minimal interruption.

The DC switch 320 provides a switch virtualization function for physically integrating the server connection of the clients as an L3 switch, similar to the DC switch 110 of the first area. The DC switch 320 allocates an interface, i.e., a port, for each first client-side switch 310, and sets each allocated port for each client, i.e., a sub-interface for each zone. The DC switch 320 sets a virtual LAN (VLAN) for each client, i.e., a sub-interface for each zone. That is, different virtual LANs are set for each client. The DC switch 320 separately sets a routing table for each sub-interface. In other words, it operates by applying independent routing table for each client assigned to the sub-interface.

The first client side switch 310 is physically linked to the DC switch 320. That is, the DC switch 320 allocates and connects one physical port to the first client-side switch 310. The first client side switch 310 is an L2 switch and is physically linked to the DC switch 320 as described above. As shown in FIG. 3, at least one server of a plurality of clients is connected to the switch 310 on the first client side. The switch 310 on the first client side provides an access VLAN port for each customer.

1, a second client-side switch 330 is included between the client's server (client A and client B in FIG. 3) and the first client-side switch 310 in the embodiment of FIG. 3 do. The second client-side switch 330 is the L3 switch.

That is, since each client in the second area has an independent network, the L3 switch is arranged for each client so as to communicate with the first client-side switch 310. The first client-side switch 310 in the second area provides an L2 bridge as an L2 switch. Since the clients' servers are in a L2 (LOOP) state when they connect to the OSI layer 2, L3 By placing a second client-side switch 330 that is a switch, the loop is prevented.

In FIG. 3, a zone is configured for each client in the second area. In the first area, servers of a plurality of clients can be located in one zone. However, since the second area has an independent network for each client, a zone is configured for each client, and a second client- (Not shown). The server of each client in the second region may be a physical server, or it may be a virtual machine-based virtualization server.

4, there is shown a signal path in the second area network of FIG. 3. Referring to FIG. 4, two DC switches 320 are installed at the external contacts of the second area network, and the two DC switches 320 The first client side switch 310 is connected. The first client side switch 310 corresponds to the client side switch 130 of the first region. And a second client-side switch 330 is provided between the server of the clients of the second area and the first client-side switch 310. The second client side switch 330 is the L3 switch and the first client side switch 210 is the L2 switch.

4, the dashed line is the signal path of the client A, and the one-dot chain line is the signal path of the client B. The DC switch 320 is connected to the first client-side switch 310 through a physical link, and sets the number of clients, that is, two subinterfaces in this embodiment, to the port linked to the first client-side switch 310 A Virtual Route Forwarding (VRF) instance is configured on each subinterface. That is, the routing tables of client A and client B are created separately.

The DC switch 320 provides a redundancy path through the first client side switch 310. That is, the two DC switches 320 create a redundant path through Virtual Router Redundancy Protocol (VRRP) or Hot Standby Router Protocol (HSRP) through the first client side switch 310. Accordingly, when any one of the two DC switches 320 fails, data can be transmitted / received through the remaining DC switches.

The second client-side switch 330 is installed between the server of the client and the first client-side switch 310 in the network of the second region of the present embodiment, unlike the network of the first region described with reference to FIG. The first client-side switch 310 transmits data on a frame-by-frame basis using the Ethernet protocol as an L2 switch, while the second client-side switch 330 transmits data on a packet-by-packet basis using the IP protocol as an L3 switch .

While the specification contains many features, such features should not be construed as limiting the scope of the invention or the scope of the claims. In addition, the features described in the individual embodiments herein may be combined and implemented in a single embodiment. Conversely, various features described in the singular < Desc / Clms Page number 5 > embodiments herein may be implemented in various embodiments individually or in combination as appropriate.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. The present invention is not limited to the drawings.

110, 120, 320: DC switch
130, 140: Client-side switch
310: first client-side switch
330: second client-side switch

Claims (16)

CLAIMS 1. A first cloud that virtualizes computing resources, comprising: a first cloud in which at least one zone, which is a collection of virtual servers of at least one or more clients, is constructed;
A first direct connection switch performing a role of a gateway to the first cloud, the first direct connection switch being connected to each zone by allocating a port for each zone established in the first cloud;
A second cloud in which at least one zone, which is a collection of other virtual servers of the at least one client, is constructed as a second cloud that virtualizes computing resources; And
A second direct connection switch connected to the first direct connection switch by a leased line and acting as a gateway to the second cloud, wherein a port is allocated to each zone established in the second cloud, And a direct connection switch. The method according to claim 1,
Wherein each of the first and second direct connection switches comprises:
Wherein each of the ports sets a sub-interface for each client in the zone and independently sets a routing table for each sub-interface in order to separate the routing for each client. 3. The method of claim 2,
Wherein the first and second direct connection switches comprise:
And a virtual LAN (VLAN) is set for each of the sub-interfaces. The method of claim 3,
Wherein each of the first and second clouds includes:
And a client-side switch for connecting the virtual servers of the clients in the zone to the first and second direct connection switches, for each zone. 5. The method of claim 4,
Clients in the zone can use the IP address in duplicate with other clients in the zone,
Wherein the client-side switch is an L2 switch. 5. The method of claim 4,
A plurality of first and second direct connection switches and a plurality of client side switches are provided,
Wherein each of the plurality of first and second direct connection switches constitutes a redundant path through a plurality of client side switches. 7. The method according to any one of claims 1 to 6,
Wherein each of the first and second direct connection switches comprises:
Wherein each of the direct connection switches mutually exchanges IP addresses of clients to which packets are to be transmitted. 8. The method of claim 7,
Wherein the first and second direct connection switches comprise:
The first and second direct connection switches are connected to each other by using any one of a Shortest Path First (OSPF), a Routing Information Protocol (RIP), or a Border Gateway Protocol (BGP) Wherein the client exchanges IP address information of the client. CLAIMS 1. A first cloud that virtualizes computing resources, comprising: a first cloud in which at least one zone, which is a collection of virtual servers of at least one or more clients, is constructed;
A first direct connection switch performing a role of a gateway to the first cloud, the first direct connection switch being connected to each zone by allocating a port for each zone established in the first cloud;
A second cloud in which other servers of the at least one client configure a zone for each client to form an independent network for each client; And
A second direct connection switch connected to the first direct connection switch by a leased line and acting as a gateway to the second cloud, the second direct connection switch being connected to the second cloud by setting a sub interface for each zone of the second cloud, A cloud direct connection system. 10. The method of claim 9,
The first cloud includes:
A first client-side switch for connecting the virtual servers of the clients in the zone to the first direct connection switch,
The second cloud includes:
A second client-side switch that is physically linked to the second direct connection switch; And a third client-side switch connected to each zone in the second cloud and connecting each zone to the second client-side switch. 11. The method of claim 10,
The first direct connection switch comprises:
Each port is configured with a sub-interface for each client in the zone and a routing table is set independently for each sub-interface to separate routing by client,
The second direct connection switch comprises:
Wherein each of the first client side switch and the second client side switch is configured to assign a port to each of the ports and to separate routing by zones, and to set independently a routing table for each sub-interface. 12. The method of claim 11,
Wherein the first and second direct connection switches comprise:
And a virtual LAN (VLAN) is set for each of the sub-interfaces. 13. The method of claim 12,
Clients in the zone of the first cloud may use IP addresses in duplicate with other clients in the zone,
Wherein the first and second client side switches are L2 switches,
And the third cloud-side switch is an L3 switch. 12. The method of claim 11,
Wherein a plurality of first and second direct connection switches and first and second client side switches are provided,
Wherein each of the plurality of first and second direct connection switches constitutes a redundant path through a plurality of first and second client side switches. 15. The method according to any one of claims 9 to 14,
Wherein each of the first and second direct connection switches comprises:
Wherein each of the direct connection switches mutually exchanges IP addresses of clients to which packets are to be transmitted. 16. The method of claim 15,
Wherein the first and second direct connection switches comprise:
The first and second direct connection switches are connected to each other by using any one of a Shortest Path First (OSPF), a Routing Information Protocol (RIP), or a Border Gateway Protocol (BGP) A cloud-direct-connect system that exchanges client IP address information.

Images