KR20230068054A - High-performance cloud system performing external traffic monitoring for multiple subnets using a single port and method thereof - Google Patents

Abstract

An HPC system and method for monitoring external traffic for multiple subnets using a single port are disclosed. An HPC system for performing external traffic monitoring on multiple subnets using a single port according to an aspect of the present invention configures a cluster using a plurality of computing nodes to provide high-performance cloud services to the outside of a virtualization server that operates subnets. a virtual MAC address generation unit that configures a plurality of virtual network interfaces corresponding to the number of subnets for one communication port for communication with the network and assigns an address of each virtual network interface; an address assignment unit that assigns an IP address to each virtual network interface; and a traffic collection unit for collecting external traffic of each virtual network interface used by each subnet.

Description

High-performance cloud system performing external traffic monitoring for multiple subnets using a single port and method thereof}

The present invention relates to a high-performance cloud system using a plurality of computing nodes, and more particularly, to an HPC system and method for monitoring external traffic on multiple subnets using a single port.

As a method of implementing high-performance computing technology, there are a scale-up method that increases the hardware performance of a single computing device and a scale-out method that increases computing power by connecting multiple computing devices through a network. there is.

As network technology develops more and more, network overhead for interaction between computers in a cluster structure that connects multiple computers is decreasing. this is getting popular.

Single virtualization is a technology that provides a computing environment in which computing resources are integrated into one by connecting a plurality of computing devices through a network.

As a method of implementing conventional single virtualization, single virtualization in the form of middleware is a system integration method of load balancing work by operating middleware in the form of a service on an operating system, and is dependent on a specific library or tool. Single virtualization at the operating system kernel level operates as a cluster-wide resource management technology inside a bare metal operating system. Single virtualization using clustering of virtual machines is a method in which a new virtualized task management layer is operated between the user area and the kernel area to resolve the dependency relationship of tasks.

Multiple cluster configurations are required for use by multiple groups, and separate subnet configurations are required for each cluster configuration. In addition, external traffic collection is required to monitor the traffic usage of the configured cluster.

If multiple subnets are configured, each subnet must be assigned a separate network interface to collect external traffic for each subnet. However, since there is a limit to the number of network interface cards (NICs) that can be mounted on one server, device configuration becomes complicated and costs due to the addition of equipment increase.

Republic of Korea Patent Publication No. 10-2019-0058619 (published on May 29, 2019) High Performance Computing System and Method

Therefore, the present invention has been made to solve the above problems, and performs external traffic monitoring for multiple subnets using a single port, which can perform external traffic monitoring for a plurality of subnets using one network interface. It is to provide an HPC system and method for doing.

Other objects of the present invention will become clearer through preferred embodiments described below.

According to one aspect of the present invention, a cluster using a plurality of computing nodes corresponds to the number of subnets for one communication port for communication with an external network of a virtualization server operating subnets to provide high-performance cloud services. a virtual beer address generation unit that configures a plurality of virtual network interfaces and assigns an address of each virtual network interface; an address allocator for allocating an IP address to each of the virtual network interfaces; and a traffic collection unit for collecting external traffic of each of the virtual network interfaces used by each of the subnets, and monitoring external traffic for multiple subnets using a single port.

Here, the virtual MAC address generation unit may use MACVLAN, and the address allocation unit may use Network Address Translation (NAT).

In addition, the network interface includes an internal interface and an external interface, the internal interface is connected to the address and is used for communication with a computing node, and a plurality of external IPs by secondary IPs provided in the external interface are MACVLAN is connected to the NAT.

Here, the virtualization server monitors the amount of external network traffic by the communication port, and sets the maximum value of the number of virtual network interfaces of the virtual MAC address generator based on the amount of traffic.

Also, the virtual MAC address generator configures more virtual network interfaces than the number of subnets.

In addition, the virtualization server configures a virtual subnet to allocate the redundant virtual network interfaces, and periodically performs a communication test with a preset test terminal using the redundant virtual network interfaces.

In addition, the virtualization server allocates a new virtual network interface and a new address when configuring a new subnet for a new cluster only when the result of the communication test remains normal.

According to another aspect of the present invention, in the monitoring method performed in an HPC system that configures a cluster using a plurality of computing nodes and provides a high-performance cloud service to the outside through a subnet, one communication port for communication with an external network configuring a plurality of virtual network interfaces corresponding to the number of subnets for each virtual network interface, and assigning an address of each virtual network interface; allocating an IP address to each of the virtual network interfaces; and collecting external traffic of each of the virtual network interfaces used by each of the subnets, a method for monitoring external traffic for multiple subnets using a single port and a recording medium recording a program executing the method.

Here, redundant virtual network interfaces are configured more than the number of subnets, virtual subnets are configured to allocate the redundant virtual network interfaces, and communication tests with preset test terminals are periodically performed using the redundant virtual network interfaces. can be performed.

According to the present invention, a plurality of subnets can be configured using one network interface and external traffic can be monitored without additional installation of a NIC in the server.

1 is a block diagram illustrating the concept of devirtualization according to an embodiment of the present invention;
Figure 2 is a block diagram schematically showing a single virtualization system for a high-performance cloud service according to an embodiment of the present invention.
3 is a flowchart illustrating a schematic process of a single virtualization service for a high-performance cloud service according to an embodiment of the present invention.
4 and 5 are diagrams schematically illustrating the configuration and concept of an HPC system for monitoring external traffic on multiple subnets using a single port according to an embodiment of the present invention.
6 is a diagram showing an example of assigning multiple IPs using a single port according to an embodiment of the present invention.
7 is a flowchart illustrating a process of utilizing redundant virtual network interfaces according to an embodiment of the present invention;

Since the present invention can make various changes and have various embodiments, specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to specific embodiments, and should be understood to include all modifications, equivalents, or substitutes included in the spirit and technical scope of the present invention.

It is understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, but other elements may exist in the middle. It should be. On the other hand, when an element is referred to as “directly connected” or “directly connected” to another element, it should be understood that no other element exists in the middle.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. These terms are only used for the purpose of distinguishing one component from another. For example, terms such as a first threshold value and a second threshold value, which will be described later, may be substantially different from each other or partially identical to each other. Since there is room, terms such as first and second are written together for convenience of classification.

Terms used in this specification are only used to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, terms such as "include" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, but one or more other features It should be understood that the presence or addition of numbers, steps, operations, components, parts, or combinations thereof is not precluded.

In addition, the components of the embodiments described with reference to each drawing are not limitedly applied only to the corresponding embodiment, and may be implemented to be included in other embodiments within the scope of maintaining the technical spirit of the present invention, and also separate Even if the description is omitted, it is natural that a plurality of embodiments may be re-implemented as an integrated embodiment.

In addition, in the description with reference to the accompanying drawings, the same or related reference numerals are given to the same components regardless of reference numerals, and overlapping descriptions thereof will be omitted. In describing the present invention, if it is determined that a detailed description of related known technologies may unnecessarily obscure the subject matter of the present invention, the detailed description will be omitted.

1 is a block diagram showing the concept of devirtualization according to an embodiment of the present invention, and FIG. 2 is a block diagram schematically showing a single virtualization system for a high-performance cloud service according to an embodiment of the present invention.

Referring to FIG. 1 , a general cloud system is a method of providing a plurality of application views by using a virtualization engine in one computing node.

In comparison, the virtualization method according to an embodiment of the present invention provides a single computing environment using the resources of a plurality of computing nodes to provide a single application view, so that the user can use high-performance computing resources in which multiple computing resources are combined into one. become available

Of course, as will be described later, even in the devirtualization system according to this embodiment, a forward virtualization engine may be additionally installed at the top to provide a plurality of views, thereby providing a virtualization cloud service using high-performance computing resources by a plurality of computing nodes. can also provide.

Referring to FIG. 2 showing a system configuration for this purpose, a single virtualization system includes a plurality of computing nodes 10 and virtualization using resources of the computing nodes 10 by using container-based resource isolation technology in a hypervisor layer. It includes a virtualization server 30 providing a computing environment. In this embodiment, a method using a container in a hypervisor layer is referred to as a hyperchain. In other words, a single computing environment is provided by combining the resources of each computing node like a chain using container technology at the hypervisor layer.

The virtualization server 30 uses container-based resource isolation technology inside the Linux kernel. And, in the Linux kernel, a manager for task distribution for cluster-wide resource utilization is operated in the form of a kernel module. According to an example, remote memory access technology can be implemented by modifying the kernel's internal memory management code.

Container technology is considered the most representative cloud-native platform. Containers have been a part of the Linux operating system (OS) for a long time. It goes all the way back to the Unix OS. Originally, [Linux Containers (LXC)] began as an operating system level virtualization method for running multiple isolated Linux systems (containers) on a single control host. At the time, compared to other OS level virtualization, the level of security was not secure. Since then, Windows containers have also started to operate recently.

Simply put, a container is a concept that is installed on top of an OS and creates multiple isolated spaces on top of it. If VMware's virtualization solution divides and uses physical computing resources at the hardware level, containers are virtualization at the OS level. It bundles the application and the libraries, binaries, and configuration files that run it.

In other words, it can be said to be a SW tool that enables distribution by bundling an execution environment and necessary libraries into one package. Container images can be run the same anywhere, regardless of the computing environment, because they contain all the images required for execution. It is similar to standardizing and standardizing various items such as fruits such as apples and bananas, shoes and laptops, regardless of the means of transportation, by using container boxes in logistics transportation. Container technology in IT also operates as a standard image regardless of the type of application.

Docker (Docker) is a tool (tool) that automates the deployment of Linux applications in containers, the virtualization server 30 uses it. In the case of container-based services such as Docker, when demand suddenly increases, container images are distributed to more computing resources so that the increased workload can be distributed and executed.

In addition, the hypervisor is a thin layer of software that controls access methods of various operating systems (OS) to various computer resources such as processors and memory. Software that allows multiple OSs to run on one computer system. It is used as a kind of intermediateware between the central processing unit (CPU) and the OS. It is an effective way to create virtual computers using different OSs on one computer. It is a virtualization engine.

Linux container technology is called LXC for short. It is a virtualization technique that runs multiple isolated Linux systems on a single host. Provides an independent computing operating environment using chroot technology. This environment is generally called a namespace and consists of the following five parts.

-UTS namespace : change hostname and split

-IPC namespace : Inter-process communication. Inter-process communication isolation

-PID namespace: Split management of PID (Process ID)

-NS namepsace : Split and isolate the mount point of the file system

-NET namespace: Divide information related to network resources such as network interface and iptables

-USER namespace : Separate user and group IDs and isolate them

And it uses cgroup technology to isolate system resource usage. You can designate CPU cores to process tasks on a per-container basis, and you can limit the memory used by containers.

The advantage of using Linux containers is that resources can be scaled up/down dynamically. And it has less computational overhead compared to other virtualization technologies that provide dynamic management. It shows differentiated advantages in terms of performance in performing CPU-intensive operations.

Since container-based resource isolation techniques and hypervisors will be obvious to those skilled in the art, detailed descriptions are omitted.

In summary, the virtualization server 30 provides a single computing virtual environment using resources of a plurality of computing nodes 10 by using container resource isolation technology in a virtualization-based hypervisor layer.

The virtualization server 30 further includes an application unit for executing applications and a distribution processing unit for distributed utilization of resources of each computing node 10 .

Hereinafter, a single virtualization method in a virtualization server will be described.

3 is a flowchart illustrating a schematic process of a single virtualization service for a high-performance cloud service according to an embodiment of the present invention.

Referring to FIG. 3 , the virtualization server 30 checks the computing resources of the plurality of computing nodes 10 that it manages (S310). For example, it may be the available storage capacity of each computing node 10, CPU/memory specifications, etc., which will be obvious to those skilled in the art, so a detailed description thereof will be omitted.

The virtualization server 30 builds a single virtualized computing environment using Linux container-based resource isolation technology in a hypervisor layer based on the identified resources of each computing node 10 (S320). Since the Linux container-based resource isolation technology has been described above, duplicate descriptions will be omitted.

Here, one of the computing nodes 10 is set as a leader node, and the leader node is a node that provides a single virtualization environment to users. In a single virtualization environment, the computing resources of the leader node and the resources of all other connected computing nodes are integrated and displayed. Users access the computing environment through SSH (secure shell) or VNC (virtual network computing) and use transparently provided global resources.

Computing nodes other than the leader node create Linux containers for the purpose of providing resources in a single virtualization environment. Since it is a container created for the purpose of providing simple resources, only the resources of each computing node are shown, and SSH service for management purposes is provided. That is, the leader node provides SSH service, VNC service, and global task manager functions, and the rest of the computing nodes provide only SSH service.

Referring back to the drawings, then the virtualization server 30 provides users with a cloud service using a single virtualized computing environment (S330). At this time, a high-performance cloud service may be provided by providing a view according to one application, or as described above, although not shown in the drawing, multiple views may be provided by using a virtualization engine for net virtualization.

Hereinafter, an HPC system and method for monitoring external traffic on multiple subnets using a single port will be described in detail.

4 and 5 are diagrams schematically showing the configuration and concept of an HPC system for monitoring external traffic on multiple subnets using a single port according to an embodiment of the present invention, and FIG. 6 is an embodiment of the present invention. It is a diagram showing an example of assigning multiple IPs using a single port according to the example.

Referring to FIG. 4 , the HPC system for monitoring external traffic on multiple subnets includes a virtual machine address generation unit 410, an address allocation unit 420, and a secondary IP 430.

The virtual MAC address generation unit 410 configures a plurality of virtual network interfaces corresponding to the number of subnets for one communication port (network interface) for communication with the external network of the virtualization server 30, and configures each virtual network interface. grants a brewery of Then, the address assignment unit 420 assigns an IP address to each virtual network interface. The virtual MAC address generator may use MACVLAN, and the address allocator 420 may use Network Address Translation (NAT).

Referring to FIG. 5 together, a MACVLAN, which can virtually configure multiple network interfaces (three in this embodiment, but is not limited thereto) in one network interface and assign a MAC address to each interface, is called MACVLAN. to use the function. By enabling multiple MAC addresses on one interface, multiple subnet configurations on one interface are possible through the MACVLAN device. As a result, since each device (computing nodes on a subnet for each cluster) uses a separate MAC address, traffic collection for each device is possible.

A macvlan network is a network that makes container communication simpler and more seamless by eliminating the bridge between containers and hosts when using bridge networks and overlay networks. The advantage of using a macvlan network is that container assets that need to face the outside of the network can be connected to the external network without port forwarding.

In addition, an IP address for communication through an external communication network must be assigned to the address assigned to the virtual network interface, and each address is assigned by the address allocator 420 implemented as a NAT.

Referring to FIG. 6 together, the network interface can be divided into an external interface (eno2) and an internal interface (enp175s0f0), mac1, mac2, and mac3 are virtual network interfaces created from the internal interface enp175s0f0, and the secondary IP External IPs are designated through 430 and each external IP is connected to the MACVLAN device of the internal interface through NAT. That is, the internal interface is connected to the MACVLAN and used for communication with the computing node, and a plurality of external IPs by the secondary IP 430 provided in the external interface are connected to the MACVLAN through NAT.

Secondary IP (430) is a function that allows you to additionally set an IP when you want to use two or more IPs in the network interface, and NAT (Network Address Translation) is a function that performs IP conversion in the network and uses an internal IP It is used to convert the external IP needed to communicate with the outside in the existing device. Since this will be obvious to those skilled in the art, a more detailed description will be omitted.

Although not shown in the drawing, a traffic collecting unit for collecting external traffic of each virtual network interface used by each subnet is further included. The traffic collection unit may use a program called vnStat. Using the vnStat traffic collection tool, traffic collection is enabled for each macvlan interface, and because the external IP and NAT are connected, traffic can be collected when the computing node in the cluster communicates with the outside world.

7 is a flowchart illustrating a process of utilizing redundant virtual network interfaces according to an embodiment of the present invention.

Referring to FIG. 7 , more virtual network interfaces are configured than the number of subnets (S710). For example, if there are currently 3 subnets, add 1 redundant subnet to configure a total of 4 virtual network interfaces.

Here, the virtualization server 30 monitors the amount of external network traffic through one communication port, and sets the maximum value of the number of virtual network interfaces of the virtual beer address generator based on the monitored information. As an example, assuming that 3 subnets (i.e., 3 virtual network interfaces) are mainly used for the 1st communication port, and it is determined that the corresponding traffic volume is appropriate, the maximum number of virtual network interfaces of the 1st communication port is 5. set to dog

Then, a virtual subnet to which redundant virtual network interfaces are allocated is configured (S720). For example, configure a virtual subnet with one or more computing nodes not assigned to a cloud service, assign extra virtual network interfaces to the virtual subnet and assign IP addresses to the corresponding computing nodes.

Then, a periodic communication test is performed on the redundant virtual network interface (S730). For example, by performing communication with a random computing node constituting a virtual subnet and an external preset test terminal, measuring the communication environment (communication normal, speed, delay time, etc.) By judging, the communication test is performed.

By periodically performing communication tests using redundant virtual network interfaces, it is possible to anticipate and respond to problems caused by communication failures in subnets using actual communication.

Records the result of performing the communication test, and determines whether or not the test result remains normal (S740).

If normal is maintained, when a new cluster to be operated is generated, a new virtual network interface is allocated to the corresponding new subnet (S750). New virtual network interfaces may be configured and allocated in addition to the above-described redundant virtual network interfaces for communication tests, or redundant virtual network interfaces for communication tests may be allocated to new subnets.

In contrast, if an abnormal result is generated as a result of the communication test, a network interface using another communication port (referred to as a second communication port) is provided to the new subnet (S760). According to an example, at this time, to provide a stable service, the second communication port provides a single network interface rather than a virtual network interface, or by reducing the number of virtual network interfaces in the second communication port (for example, in the second communication port half) operate.

The above-described external traffic monitoring method for multiple subnets using a single port according to the present invention can be implemented as computer readable code on a computer readable recording medium. Computer-readable recording media includes all types of recording media in which data that can be decoded by a computer system is stored. For example, there may be read only memory (ROM), random access memory (RAM), magnetic tape, magnetic disk, flash memory, optical data storage device, and the like. In addition, the computer-readable recording medium may be distributed to computer systems connected through a computer communication network, and stored and executed as readable codes in a distributed manner.

In addition, although the above has been described with reference to preferred embodiments of the present invention, those skilled in the art can make the present invention within the scope not departing from the spirit and scope of the present invention described in the claims below. It will be appreciated that various modifications and variations may be made.

10: computing node
30: virtualization server

Claims (10)

A plurality of virtual network interfaces are configured corresponding to the number of subnets for one communication port for communication with the external network of a virtualization server operating subnets to provide high-performance cloud services by configuring a cluster using a plurality of computing nodes. and a virtual beer address generation unit for assigning the address of each virtual network interface;
an address allocator for allocating an IP address to each of the virtual network interfaces; and
An HPC system for monitoring external traffic for multiple subnets using a single port, including a traffic collection unit for collecting external traffic of each of the virtual network interfaces used by each of the subnets.
The method of claim 1,
The HPC system for performing external traffic monitoring for multiple subnets using a single port, wherein the virtual MAC address generation unit uses MACVLAN and the address allocation unit uses NAT (Network Address Translation).
The method of claim 2,
The network interface includes an internal interface and an external interface, wherein the internal interface is connected to the address and used for communication with a computing node,
The HPC system for monitoring external traffic for multiple subnets using a single port, wherein a plurality of external IPs by secondary IPs provided in the external interface are connected to the MACVLAN by the NAT.
The method of claim 1,
The virtualization server monitors the amount of external network traffic by the communication port, and sets the maximum value of the number of virtual network interfaces of the virtual MAC address generator based on the amount of traffic, external traffic for multiple subnets using a single port. HPC system to perform monitoring.
The method of claim 4,
The HPC system for performing external traffic monitoring for multiple subnets using a single port, wherein the virtual MAC address generator configures more virtual network interfaces than the number of subnets.
The method of claim 5,
The virtualization server configures virtual subnets, allocates the redundant virtual network interfaces, and periodically performs communication tests with preset test terminals using the redundant virtual network interfaces for multiple subnets using a single port. HPC systems that perform external traffic monitoring.
The method of claim 6,
The virtualization server performs external traffic monitoring for multiple subnets using a single port, allocating a new virtual network interface and a new address when configuring a new subnet for a new cluster only when the result of the communication test remains normal. HPC system to do.
A monitoring method performed in an HPC system that configures a cluster using a plurality of computing nodes and provides a high-performance cloud service to the outside through a subnet,
configuring a plurality of virtual network interfaces corresponding to the number of subnets for one communication port for communication with an external network, and assigning address of each virtual network interface;
allocating an IP address to each of the virtual network interfaces; and
External traffic monitoring method for multiple subnets using a single port, comprising the step of collecting external traffic of each of the virtual network interfaces used by each of the subnets.
The method of claim 8,
Configure more virtual network interfaces than the number of subnets, configure virtual subnets to allocate the redundant virtual network interfaces, and periodically perform communication tests with preset test terminals using the redundant virtual network interfaces. A method of monitoring external traffic for multiple subnets using a single port.
A recording medium containing instructions executable by a computer such as an application or program module to be executed by a computer for performing the method of claim 8.

Images