WO2014172869A1

WO2014172869A1 - Method, device and system for communication in virtual local area network

Info

Publication number: WO2014172869A1
Application number: PCT/CN2013/074705
Authority: WO
Inventors: 王俊捷; 林沐晖; 卢广
Original assignee: 华为技术有限公司
Priority date: 2013-04-25
Filing date: 2013-04-25
Publication date: 2014-10-30
Also published as: CN103596649B; CN103596649A

Abstract

An embodiment of the present invention discloses a method for communication in a virtual local area network. The method is characterized by comprising: obtaining a TCP/IP packet needing be sent in a virtual local area network; searching for a correspondence between the virtual local area network and a host according to a virtual local area network identification carried in the TCP/IP packet, and obtaining hosts comprised in the virtual local area network; determining a destination host of the TCP/IP packet according to address information in the TCP/IP packet, the destination host being comprised in the hosts comprised in the virtual local area network; and sending the TCP/IP packet to the destination host of the TCP/IP packet through a peripheral component interconnect express (PCIE) switch. In this way, it is achieved that point-to-point data transmission in a virtual local area network is only allowed between hosts in the virtual local area network, thereby solving the problem of the VLAN security of an IPoPCIE system. Embodiments of the present invention also disclose a host, a system and a storage medium for communication in a virtual local area network.

Description

Method, device and system for communicating in virtual local area network

Technical field

The embodiments of the present invention relate to the field of computers, and in particular, to a method, device, and system for communicating in a virtual local area network (VLAN). Background technique

With the development of the Periphera Component Interconnect Expres s (PCIE) bus technology, the PCIE bus is no longer just a data transmission bus between the host and peripheral devices, and is further extended to two hosts. Data communication bus between. At present, the mainstream communication method between hosts is to rely on the Transmit Control Protocol (TCP) / Internet Protocol (IP) stack. In order to better compatible with existing TCP/IP programs, the industry has proposed that the TCP/IP protocol runs on the PCIE bus (TCP/IP over PCIE, IPoPCIE) network, that is, the TCP/IP protocol runs on the PCIE network. The PCIE network here refers to the network between devices that use the PCIE bus for communication connection. A PCIE virtual network interface card (VNIC) is virtualized on the host. The PCIE vNIC provides a link layer interface for data transmission and reception on the TCP/IP stack. For upper-layer applications, there is no difference between the PCIE vNIC and the Ethernet network device. The application-down interface is also the TCP/IP stack. You don't care if the link layer is an Ethernet or PCIE link, you can transparently use the PCIE link for communication. .

However, while improving performance, IPoPCIE also faces serious problems: There is no security isolation function in PCIE hardware, and there are serious problems in network security: such as network viruses, network loops, network storms caused by hacker software, causing the entire network瘫痪People in different departments access information to each other, leading to information leakage and other issues. Virtual LAN is proposed to solve the broadcast problem and security of Ethernet. In the broadcast domain, each VLAN contains a group of hosts with the same requirements. The broadcast and unicast traffic inside a VLAN will not be forwarded to other VLANs. Broadcast in the same VLAN only has members in the VLAN Can be received, and will not be transferred to other VLANs. In the IPoPCIE network, in the prior art, the communication in the VLAN is implemented in the following manner, and the application needs to transmit the data packet in the virtual local area network to the TCP/IP stack, and then through the PCIE vNIC to each host in the IPoPCIE network. Broadcast transmission or unicast transmission to the destination host of the unicast data packet, the receiving end receives the data packet, and filters through the VLAN module in the operating system kernel, thereby transmitting the data packet to the destination device in the virtual local area network. In fact, the data packet still arrives at each physical host, but the data is filtered only in the VLAN module of the receiving end. The real isolation effect is not achieved, and the network storm cannot be effectively avoided. As described above, in the prior art, the internal communication of the VLAN in the IPoPCIE system cannot be solved, and the data packet isolation between the hosts is not achieved, and the network storm cannot be avoided. Summary of the invention

In view of this, the embodiments of the present invention provide a method, a device, and a system for communicating in a virtual local area network, which enable data transmission in a virtual local area network only between hosts in the same virtual local area network in the IPoPCIE network. The security of VLANs in the IPoPCIE system ensures true isolation of data packets between hosts, ensuring security and effectively avoiding network storms.

In a first aspect, an embodiment of the present invention provides a method for communicating in a virtual local area network, including: acquiring a TCP/IP data packet that needs to be sent in a virtual local area network;

And searching for a correspondence between the virtual local area network and the host according to the virtual local area network identifier carried in the TCP/IP data packet, and acquiring a host included in the virtual local area network;

Determining, by the address information in the TCP/IP data packet, a destination host of the TCP/IP data packet, where the destination host is included in a host included in the virtual local area network;

The TCP/IP packet is sent to the destination host of the TCP/IP packet by a high speed peripheral component interconnect PCIe switch.

In a first possible implementation of the first aspect:

The corresponding relationship between the virtual local area network and the host is from a virtual local area network management server, and is established and maintained by the virtual local area network management server. In combination with the first aspect or the first possible implementation of the first aspect, in a second possible implementation:

The corresponding relationship between the virtual local area network identifier and the node number of the host included in the virtual local area network is recorded in the corresponding relationship between the virtual local area network and the host.

With reference to the second possible implementation manner of the first aspect, in a third possible implementation manner, the node number of the host included in the virtual local area network is the first aspect of the first aspect of physical integration included in the virtual local area network To the third possible implementation, in the fourth possible implementation:

When any host in the network managed by the virtual local area network management server acquires a command to modify the virtual local area network, the any host sends a modification notification to the virtual local area network management server, so that the virtual local area network management server is modified according to the The notification updates the correspondence between the virtual local area network and the host, and sends the updated correspondence between the virtual local area network and the host to all hosts in the network managed by the host.

In combination with the first aspect or the first to fourth possible implementations of the first aspect, in a fifth possible implementation:

If the TCP/IP packet is obtained by the source host, then:

When the address information indicates a broadcast address, the destination host of the TCP/1 P data packet is all other hosts in the host included in the virtual local area network except the source host;

When the address information indicates a unicast address, if the host included in the virtual local area network includes the host corresponding to the unicast address, the destination host of the TCP/IP data packet is the unicast address. Corresponding host.

In a second aspect, an embodiment of the present invention provides a host, including:

a virtual local area network determining module, configured to obtain a TCP/1 P data packet to be sent in the virtual local area network, and find a correspondence between the virtual local area network and the host according to the virtual local area network identifier carried in the TCP/IP data packet, and obtain the virtual local area network The host included, according to the TCP/IP packet Address information, determining a destination host of the TCP/IP data packet, where the destination host is included in a host included in the virtual local area network;

And a transceiver module, configured to interconnect the PCIE switch to send the TCP/IP data packet to the destination host of the TCP/IP data packet through a high-speed peripheral component.

In a first possible implementation of the second aspect:

With reference to the first possible implementation manner of the second aspect, in a second possible implementation manner, the node number of the host included in the virtual local area network is a physical combination included in the virtual local area network, the second aspect or the second The first or second possible implementation of the aspect, in a third possible implementation manner, further includes:

The correspondence management module is configured to receive a correspondence between the virtual local area network and the host from the virtual local area network management server, where the correspondence between the virtual local area network and the host is established and maintained by the virtual local area network management server.

With reference to the third possible implementation manner of the second aspect, in a fourth possible implementation manner, the corresponding relationship management module is further configured to acquire a command for modifying a virtual local area network, and send a modification notification to the virtual local area network management server. And updating the corresponding relationship between the local virtual office i or the network and the host according to the corresponding relationship between the virtual local area network and the host that is updated according to the modification notification returned by the virtual local area network management server.

In conjunction with the second aspect or the first to fourth possible implementations of the second aspect, in a fifth possible implementation:

When the address information indicates a broadcast address, the destination host of the TCP/1 P data packet is all other hosts in the host included in the virtual local area network except the host;

When the address information indicates a unicast address, if the host included in the virtual local area network includes the host corresponding to the unicast address, the destination host of the TCP/IP data packet is The host corresponding to the unicast address. In a third aspect, an embodiment of the present invention provides a host, including a processor and a memory, where the memory stores an execution instruction, and when the host is running, the processor communicates with the memory, the processor Executing the execution instruction causes the host to perform the method of any of the above first aspects.

In a fourth aspect, an embodiment of the present invention provides a computer readable medium, comprising computer executed instructions, the computer executed instructions for causing a host to perform the method of any one of the foregoing first aspects.

According to a fifth aspect, an embodiment of the present invention provides a high-speed peripheral component interconnection system, including: at least two hosts, a PCIE switch, and a virtual local area network management server, according to any one of the foregoing second aspect or the third aspect, wherein Each of the at least two hosts is connected to the PCIE switch, and the virtual local area network management server is connected to the PICE switch.

The virtual local area network management server is configured to establish and maintain a correspondence between the virtual local area network and the host.

In a first possible implementation of the fifth aspect,

The virtual local area network management server is further configured to: after receiving the modification notification sent by any one of the at least two hosts, update the corresponding relationship between the virtual local area network and the host according to the modification notification, and update the corresponding relationship The corresponding relationship between the virtual local area network and the host is sent to each of the at least two hosts.

Through the foregoing solution, the method, device, and system for communicating in a virtual local area network according to an embodiment of the present invention determine that a host in a virtual local area network that needs to send a TCP/IP data packet is in the IPoPCIE system, and only passes the PCIE switch to the VLAN. The destination host sends the data packet, which realizes the data transmission only between the hosts in the same virtual local area network, thus better solved the problem.

The security of the VLAN of the IPoPCIE system ensures effective isolation of data packets between physical hosts and avoids network storms. BRIEF DESCRIPTION OF THE DRAWINGS In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some implementations of the present invention. For example, for those skilled in the art, before the creative work is done Further drawings can also be obtained from these figures.

1 is a schematic diagram of a PCIE system according to Embodiment 1 of the present invention;

2 is a flowchart of a method for communicating in a virtual local area network according to Embodiment 2 of the present invention;

3 is a flow chart of a method for modifying a correspondence between a virtual local area network and a host according to an embodiment of the present invention;

4 is a structural diagram of a host according to Embodiment 3 of the present invention;

Figure 5 is a structural diagram of a host in Embodiment 4 of the present invention.

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are a part of the embodiments of the present invention, but not all embodiments. . All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without making creative labor are within the scope of the present invention.

1 is a schematic diagram of a high-speed peripheral component interconnection system according to Embodiment 1 of the present invention. As shown in FIG. 1, the system includes at least two hosts 10 (Hos t ), a PCIE switch 20 (PCIE Swi tch ), and a virtual local area network management. The server 30; the PCIE switch 20 is connected to all the hosts 10 to implement data forwarding between the hosts 10. The virtual local area network management server 30 is connected to the PCIE switch 20 and is used to manage the correspondence between each VLAN and the host in the maintenance system.

An operating system (Operating System) is running on each host 10, and at least one virtual machine (Vir tua l Machine, VM for short) can be run in a virtualized scenario. The host 10, the specific structure, the function implementation, and the like are as described in the following Embodiment 2, Embodiment 3 or Embodiment 4, and details are not described herein again. The host in the embodiment of the present invention may be an ordinary computer, a mobile terminal, a workstation or a server, a dedicated server, etc. The virtual local area network management server may be an ordinary host in the system, or may be a dedicated host, and the present invention does not Specifically limited.

As shown in FIG. 2, Embodiment 2 of the present invention provides a method for communicating in a virtual local area network, which may be implemented in the PCIE system of Embodiment 1 shown in FIG. 1, but the implementation structure is not limited to FIG. The structure of the system shown. The method includes:

S20 obtains TCP/IP packets that need to be sent in the virtual local area network.

The host obtains TCP/IP packets that the upper layer application needs to send in the virtual local area network. This step Specifically, the PC IE vN IC driver module in the host operating system acquires a TCP/IP data packet, and the PC I e vN IC driver module is an interface that connects the host operating system TCP/IP stack and the PCIE network link layer. Specifically, for convenience of description, a host that acquires a TCP/IP packet that needs to be sent in a virtual local area network may also be referred to as a source host.

Specifically, if the upper layer application running on the host has a data packet to be sent in the virtual local area network, the upper layer application needs to add the data packet sent in the VLAN to the TCP/IP protocol stack, that is, the upper layer application invokes the kernel of the host operating system. The interface between the state and the user mode, the data packet sent in the VLAN is added to the TCP/1 P protocol stack, and the virtual LAN module in the operating system of the host obtains the TCP/TCP that needs to be sent in the VLAN from the TCP/IP protocol stack. IP data packet, the virtual local area network label is added to the TCP/IP data packet, where the virtual local area network label can be a virtual local area network identifier (VLAN ID), and the VLAN ID is the ID of the virtual local area network that the TCP/IP data packet needs to be sent. An 8-bit virtual LAN label can be added to the TCP/IP packet header. Of course, the virtual LAN label is not limited to the VLAN ID, as long as it can identify the VLAN information, such as the VLAN name. The VLAN module in the host's operating system passes the TCP/IP packet with the virtual LAN label (here added the virtual LAN identifier) to the PCIE vNIC driver module in the host operating system, and the PCIE vNIC driver module slave VLAN module. Receive TCP/IP packets with virtual LAN labels added.

S202. Search for a correspondence between the virtual local area network and the host according to the virtual local area network identifier carried in the TCP/IP data packet, and obtain a host included in the virtual local area network.

The host searches for the record corresponding to the virtual local area network identifier in the corresponding relationship between the virtual local area network and the host according to the obtained virtual local area network identifier of the TCP/IP data packet, and obtains the host included in the virtual local area network corresponding to the VLAN ID, and the host belongs to the virtual local area network. Specifically, the PCIE vNIC driver module in the host operating system searches for the correspondence between the virtual local area network and the host according to the virtual local area network identifier carried in the TCP/IP data packet, and obtains the host included in the virtual local area network corresponding to the VLAN ID.

Preferably, in the embodiment of the present invention, the correspondence between the VLAN ID and the node number of the host included in the corresponding virtual local area network is recorded in the corresponding relationship between the virtual local area network and the host. The correspondence between the local area network and the host is referred to as the corresponding relationship. Certainly, the correspondence between the virtual local area network and the host may also record the correspondence between the identifier that can represent the virtual local area network other than the VLAN ID and the identifier that can represent the host other than the node number of the host, and the present invention No restrictions. For convenience of description, in the embodiment of the present invention, the correspondence between the VLAN ID and the node number of the host recorded in the correspondence between the virtual local area network and the host is described, and the scope of protection of the present invention is not limited. Generally, this correspondence can be in the form of a table, such as a correspondence table between a virtual local area network and a host.

Preferably, the correspondence between the virtual local area network and the host comes from the virtual local area network management server, which is established by the virtual local area network management server and is updated and maintained according to changes of the host in the virtual local area network (for example, addition/deletion of the host). Each host in the network locally stores a mapping relationship between the virtual local area network and the host, and is consistent with the correspondence between the virtual local area network and the host on the virtual local area network management server. The virtual local area network management server may be a dedicated host in the network, or any host in the network may be used as a virtual local area network management server to manage the entire network (the network range managed by the virtual local area network management server) in the virtual local area network and the host. Corresponding relationship, establishing and maintaining the correspondence between the virtual local area network and the host. The correspondence relationship may be periodically sent by the virtual local area network management server to each host in the network managed by the virtual local area network management server, or may be sent to each host when needed (for example, when the corresponding relationship changes), and of course, each host may actively manage to the virtual local area network. The server obtains the correspondence between the virtual local area network and the host, and the present invention does not limit this. In the embodiment of the present invention, the correspondence between the virtual local area network identifier and the node number of the host included in the virtual local area network is recorded in the corresponding relationship between the virtual local area network and the host. For example, the VLAN ID shown in the table is 20 In the virtual local area network, including one host, the host node number is 1; in the virtual local area network with the VLAN ID 49 shown in the table, including 5 hosts, the host node number is 1, 3, 4, 5 , 7. Virtual LAN ID host node number

20 1

49 2, 3, 4, 5, 7 Correspondence between virtual local area network and host

Preferably, the update maintenance of the correspondence between the virtual local area network and the host may use the method shown in the flow chart of FIG. 3:

The S30 host obtains the command to modify the virtual LAN.

When the user needs to modify the virtual local area network, the command to modify the virtual local area network is executed through the management and maintenance interface. For example, when a host needs to be added to a VLAN or deleted from a VLAN, the user will execute the command of adding a VLAN or deleting a VLAN. The host obtains the command of adding a VLAN or deleting a VLAN, and obtains the VLAN I D in the command. Specifically, the command of modifying the virtual local area network may be obtained by the PC I e vN IC driving module in the host operating system. For example, the command to modify the VLAN may be registered in the PCIe vNIC driver module, so that when the user performs adding or deleting the VLAN, When commanded, the PCIe vNIC driver module will get the command. The host here can be any host in the network managed by the virtual LAN management server.

S 302. The host sends a modification notification to the virtual local area network management server.

The host sends a modification notification to the virtual local area network management server to update the correspondence between the virtual local area network and the host, and the modification notification carries the VLAN ID and/or the node number information of the host to be modified, and most of the hosts are added or deleted in the VLAN. You need to carry the VLAN ID and the node number of the host at the same time. However, in some applications, you can carry only one parameter. For example, when you create a new VLAN, the modification notification of the host can only carry the node number of the host. When the LAN management server assigns a VLAN ID or deletes a VLAN, the host's modification notification can only carry the VLAN ID and does not carry the node number of the host. The virtual LAN management server deletes the record of the virtual LAN corresponding to the VLAN ID and deletes all hosts. . The node number information of the host carried in the modification message may be the node number information of the host that sends the modification notification, indicating that the host that sends the message is added or deleted in the virtual local area network corresponding to the VLAN ID, or may be other than the host that sends the message. The node number information of other hosts indicates that other hosts corresponding to the node number information of the host to be carried are in the virtual local area network. Add or remove. Of course, the information representing the VLAN and the host carried in the modification notification is corresponding to the information representing the VLAN and the host in the correspondence between the virtual local area network and the host. For convenience of explanation, the VLAN ID is used to represent the VLAN, and the node of the host is used. The number represents the host and does not limit the scope of protection of the present invention.

S303. The virtual local area network management server updates the correspondence between the virtual local area network and the host according to the modification notification.

The virtual local area network management server receives the modification notification. When the modification notification is to add the host to a VLAN, if the VLAN ID already exists, add the node number of the host to the virtual local area network corresponding to the VLAN ID in the corresponding relationship between the virtual local area network and the host. If the VLAN ID does not exist or the modification notification does not include the VLAN ID, add a new record for the new record or the assigned new VLAN ID of the VLAN ID in the mapping between the virtual LAN and the host. Contains the node number of this host. When the modification notification received by the virtual local area network management server is to delete the host from a VLAN, the virtual local area network management server searches for a record corresponding to the VLAN ID in the correspondence between the virtual local area network and the host, and sets the node number of the host from the VLAN ID. The corresponding LAN is included in the host removed.

S304. The virtual local area network management server sends the updated correspondence between the virtual local area network and the host to all hosts in the network it manages. The virtual local area network management server may first return the updated relationship between the virtual local area network and the host to the host that sends the modification notification, and then send it to other hosts in the network, or simultaneously to all hosts in the network. Of course, the virtual local area network management server may also send only the corresponding relationship between the updated virtual local area network and the host to each host included in the virtual local area network in which the host operation is added/deleted.

S 305. Each host updates a correspondence between the locally saved virtual local area network and the host.

Each host receives the corresponding relationship between the updated virtual local area network and the host sent by the virtual local area network management server, and updates the corresponding relationship saved locally: the original saved correspondence relationship may be deleted, and the corresponding relationship sent by the virtual local area network management server may be copied, or according to The corresponding relationship sent by the virtual local area network management server updates the corresponding record with the change in the locally saved correspondence.

The method for updating the correspondence between the virtual local area network and the host is effectively ensured the accuracy and flexibility of the correspondence between the virtual local area network and the host on the virtual local area network management server, and the local correspondence of each host can also be ensured. It is consistent with the correspondence on the virtual LAN management server.

S203. Determine the TCP/IP data packet according to the address information in the TCP/IP data packet. a destination host, where the destination host is included in a host included in the virtual local area network. This step can be specifically performed by the PCIE vNIC driver module in the host operating system.

Specifically, when the address information indicates a broadcast address, the destination host of the TCP/IP data packet is all other hosts except the host among all the hosts included in the virtual local area network obtained by the query correspondence.

Specifically, when the address information indicates a unicast address, if the host included in the virtual local area network obtained by the query correspondence includes the host corresponding to the unicast address, the destination host of the TCP/IP data packet is The host corresponding to the unicast address; if the host included in the virtual local area network obtained by the query correspondence does not include the host corresponding to the unicast address, confirm that the TCP/IP data packet is an illegal data packet, and discard the The TCP/IP packet will not be sent.

S204. Send the TCP/IP data packet to the destination host of the TCP/IP data packet by using a PCIE switch.

This step is specifically performed by the PCIE vNIC driver module in the host operating system. Specifically, when the address information is a broadcast address, the PCIE vNIC driver module sends the TCP/IP data packet to all other hosts except the local machine through the PCIE switch; when the address information is a unicast address, If the destination host corresponding to the unicast address is one of the hosts included in the virtual local area network obtained by querying the correspondence, the TCP/IP data packet is sent to the destination host through the PCIE switch.

The other hosts in the virtual local area network receive the TCP/IP data packet, and the same data packet of the virtual local area network label (here, the virtual local area network identifier) is added to the TCP/IP stack through the network device interface, thereby transmitting the data packet to the corresponding upper layer application. Specifically, the data packet can be sent to the VL AN module in the host operating system through the network device interface for parsing, and then transmitted to the TCP/IP stack, and finally the data packet is delivered to the corresponding upper application. That is, the method described in the embodiment of the present invention can be applied to security isolation between physical machines, and each physical host is in the same PCIE network, and the users are divided into different VLANs according to service requirements. Only hosts in the same VLAN can communicate with each other. For example, when a host in a VLAN sends a broadcast packet, its transmission range is limited to the host in the VLAN, and the message is not sent to hosts other than the VLAN. Similarly, the method in the embodiment of the present invention is also applicable to a security isolation service scenario between a virtual machine and a virtual machine and a physical machine. The user divides the virtual machine and the physical machine into different VLANs, and the communication in the VLAN is only in the The physical machine and virtual machine in the VLAN are not sent to the virtual machine or physical machine outside the VLAN. Of course, for a virtual machine, the correspondence between the virtual local area network and the host is also the correspondence between the virtual local area network and the physical host. The physical host here is the physical host where the virtual machine is located, that is, the virtual record recorded in the correspondence between the virtual local area network and the host. Correspondence between the local area network identifier and the node number of the host included in the virtual local area network. The node number of the host here may be the node number of the physical host included in the virtual local area network or the node of the physical host where the virtual machine included in the virtual local area network is located. number.

PCIE networks, whether ID routing or address routing, are point-to-point communication transmission data. For example, IPoPCIE broadcast/multicast is actually point-to-point data transmission for all hosts in turn. In the embodiment of the present invention, by determining the destination host in the virtual local area network that needs to send the TCP/IP data packet, the data packet is sent only to the host belonging to the VLAN through the PCIE switch, so that only the hosts in the same virtual local area network are allowed to be performed. The point-to-point data transmission in the virtual local area network can better solve the security problem of the VLAN of the IPoPCIE system, so as to effectively isolate the data packets between the hosts, ensure security, and avoid network storms. Moreover, it avoids the problem that when a PCIE network accesses a large number of hosts, each host may receive a large number of unnecessary broadcast packets and seriously affect the performance of the host.

The structure of a host 200 provided in Embodiment 3 of the present invention is as shown in FIG. 4, and includes:

The virtual local area network determining module 201 is configured to obtain a TCP/IP data packet that needs to be sent in the virtual local area network, and find a correspondence between the virtual local area network and the host according to the virtual local area network identifier carried in the TCP/IP data packet, and obtain the corresponding relationship between the virtual local area network and the host. The host determines the destination host of the TCP/IP data packet according to the address information in the TCP/IP data packet, where the destination host is included in the host included in the virtual local area network;

The transceiver module 202 is configured to send to the destination host of the TCP/IP data packet through the PCIE switch. The TCP/IP packet.

Specifically, the virtual local area network determining module 201 is configured to obtain a TCP/IP data packet that needs to be sent in the virtual local area network, and search for the virtual local area network according to the virtual local area network identifier carried by the TCP/IP data packet in the corresponding relationship between the virtual local area network and the host. Identifying the record in the table, obtaining a host included in the virtual local area network corresponding to the VLAN ID, and determining a destination host of the TCP/IP data packet according to the address information in the TCP/IP data packet, where the destination host is included The host included in the virtual LAN. The correspondence between the virtual local area network and the host records the correspondence between the VL AN I D and the node number of the host included in the corresponding virtual local area network.

Specifically, the transceiver module 202 is configured to send the TCP/IP data packet including the virtual local area network identifier to the destination host of the TCP/IP data packet through the PCIE switch. Specifically, the transceiver module is configured to send the TCP/IP data packet to the destination host of the TCP/IP data packet determined by the virtual local area network determining module 201 through the PCIE switch: when the address information is a broadcast address, pass the PCIE

If the destination information is a unicast address, if the destination host corresponding to the unicast address is a host in the virtual local area network obtained by the query correspondence, the TCP/IP data is sent to the destination host through the PCIE switch. package. The other hosts in the virtual local area network receive the TCP/IP data packet, and then pass the data packet to the VLAN module in the host operating system through the network device interface for parsing and input to the TCP/IP stack, thereby transmitting the data packet to the corresponding upper application. . The host 200 in the embodiment of the present invention transmits a data packet to a host in the VLAN only through a PCIE switch by determining a host in a virtual local area network that needs to send a TCP/IP data packet, thereby implementing a host that is only allowed in the same virtual local area network. The data transmission in the virtual local area network is performed, so that the data packets in the VLAN of the IPoPCIE system are effectively isolated between the hosts, and the network storm is avoided.

Preferably, the corresponding relationship between the virtual local area network identifier of the virtual local area network and the node number of the host included in the virtual local area network is recorded in the corresponding relationship between the virtual local area network and the host, and the specific content of the correspondence between the virtual local area network and the host is similar to the previous embodiment. I will not repeat them here.

Specifically, when the address information of the TCP/IP data packet indicates a broadcast address, the destination host of the TCP/IP data packet determined by the virtual local area network determining module 201 is the host included in the acquired virtual local area network. All other hosts except the host; when the address information of the TCP/IP packet indicates a unicast address, if the host included in the virtual local area network acquired by the virtual local area network determining module 201 includes the unicast address The host, the destination host of the TCP/IP data packet determined by the virtual local area network determining module 201 is the host corresponding to the unicast address.

Optionally, as shown in FIG. 4, the host 200 further includes: a correspondence management module 203, configured to receive a correspondence between the virtual local area network and the host from the virtual local area network management server, where the correspondence between the virtual local area network and the host is determined by the virtual local area network Management server setup and maintenance. The correspondence between the virtual local area network and the host is established by the virtual local area network management server, and is updated and maintained according to the change (addition/delete) of the host in the virtual local area network. The correspondence management module 203 is configured to receive a correspondence between the virtual local area network and the host that is received from the virtual local area network management server, and save the information locally. Further, the mapping between the locally saved virtual local area network and the host is consistent with the corresponding relationship on the virtual local area network management server.

Further, the correspondence management module 203 is further configured to acquire a command for modifying the virtual local area network, send a modification notification to the virtual local area network management server, and according to the corresponding relationship between the virtual local area network and the host that is updated according to the tamper notification returned by the virtual local area network management server. The local correspondence is updated. Specifically, when the user needs to modify the virtual local area network, the command to modify the virtual local area network is executed. For example, when the host needs to be added to a VLAN or deleted from a VLAN, the user performs a command of adding a VLAN or deleting a VLAN. The correspondence management module 203 obtains a command for the user to add a VLAN or delete a VLAN. The command to modify the VLAN may be set in the corresponding relationship management module 203. When the user performs the command to modify the VLAN, the correspondence management module 203 responds in time to obtain the command. The corresponding relationship management module 203 sends a modification notice for updating the correspondence between the virtual local area network and the host to the virtual local area network management server, where the modification notification carries the VLAN ID to be modified and/or the node number information of the host, and most of them are added in the VLAN or If you delete a host, you need to carry the VLAN ID and the node number of the host. However, you can carry only one parameter for some applications. For example, when you create a new VLAN, the modification notification of the host can only carry the node number of the host. VLAN ID, when the VLAN ID is assigned by the virtual LAN management server, or when a VLAN is deleted, the modification notice of the host can carry only the VLAN ID and does not carry the node number of the host. The virtual LAN management server deletes the virtual LAN corresponding to the VLAN ID. Record, delete all hosts. The node number information of the host carried in the modification message may be the node number information of the host that sends the modification notification, indicating that The host that sends the message is added or deleted in the virtual local area network corresponding to the VLAN ID, and may also be the node number information of the host other than the host that sends the message, indicating that the other host corresponding to the node number information of the carried host is in the virtual local area network. Add or remove. Of course, the information representing the VL AN and the host carried in the modification notification is corresponding to the information representing the VLAN and the host in the correspondence between the virtual local area network and the host. For convenience of explanation, the VLAN ID is used to represent the VLAN, and the host The node number represents the host and does not limit the scope of protection of the present invention. When receiving the modification notification, the virtual local area network management server updates the correspondence between the virtual local area network and the host according to the modification notification, and sends the updated virtual local area network and the host corresponding relationship to each host in the network managed by the virtual local area network. The method for the specific update is the same as that of the embodiment 2 of the present invention, and details are not described herein again. The corresponding relationship management module 203 receives the correspondence between the virtual local area network and the host sent by the virtual local area network management server, and updates the corresponding relationship saved locally: the original saved correspondence relationship may be deleted, and the corresponding relationship sent by the virtual local area network management server may be copied, or According to the correspondence sent by the virtual local area network management server, the corresponding record with the change in the locally saved correspondence relationship is updated. By updating the correspondence between the virtual local area network and the host, the accuracy of the correspondence between the virtual local area network and the host on the virtual local area network management server is effectively ensured, and the corresponding relationship between the hosts and the host can be maintained with the corresponding relationship on the virtual local area network management server. Consistent.

As in the embodiment of the foregoing method, the virtual local area network in the embodiment of the present invention may include a physical host or a virtual machine. Of course, for a virtual machine, the correspondence between the virtual local area network and the host is also the correspondence between the virtual local area network and the physical host. The physical host here is the physical host where the virtual machine is located, that is, the virtual record recorded in the correspondence between the virtual local area network and the host. Correspondence between the local area network identifier and the node number of the host included in the virtual local area network. The node number of the host here may be the node number of the physical host included in the virtual local area network or the node of the physical host where the virtual machine included in the virtual local area network is located. number.

Optionally, as shown in FIG. 4, the host 200 further includes: a virtual local area network module 204, configured to obtain, from the TCP/1P protocol stack, a TCP/IP data packet that needs to be sent in a VLAN, add a virtual local area network identifier, and send the Virtual local area network determination module 201. Preferably, the virtual local area network module 204 is specifically configured to obtain a TCP/IP data packet that needs to be sent in the virtual local area network of the upper layer application, and add the upper layer application running on the host 200 to the TCP/IP data packet, and the data packet needs to be in the virtual local area network. When sending, the upper layer The application adds the data packet that needs to be sent in the VLAN to the TCP/IP protocol stack. The virtual local area network module 204 obtains the TCP/IP data packet to be sent from the TCP/IP protocol stack, and adds the VLAN ID to the TCP/IP data packet. The incoming virtual local area network determining module 201 receives the TCP/IP data packet to which the virtual local area network tag is added from the virtual local area network module 204.

In the embodiment of the present invention, in the host 200 shown in FIG. 4, the corresponding relationship management module 203 and the virtual local area network module 204 may exist at the same time, or the host 200 may include only the corresponding relationship management module 203 without the virtual local area network module 204, or Only the virtual local area network module 204 is included, and there is no correspondence management module 203.

PCIE networks, whether ID routing or address routing, are point-to-point communication transmission data. IPoPCIE broadcast/multicast is actually point-to-point data transmission for all hosts in turn. The host provided in the embodiment of the present invention can only send the data packet to the host belonging to the VLAN through the PCIE switch by determining the destination host in the virtual local area network that needs to send the TCP/IP data packet, so that only the same virtual local area network can be allowed in the same virtual local area network. The data transmission between the hosts in the virtual local area network can better solve the security problem of the VLAN of the IPoPC IE system, so as to effectively isolate the data packets between the hosts and avoid network storms. Moreover, when the PCIE network accesses a large number of hosts, each host may receive a large number of unnecessary broadcast packets and seriously affect the performance of the host.

5 is a diagram showing the structure of a host according to Embodiment 4 of the present invention. As shown, the host 300 includes at least one processor 301, a memory 305, at least one network interface card 304, and at least one communication bus 302. The host 300 optionally includes a user interface 303, including a display, a keyboard or a pointing device. The memory 305 stores execution instructions. When the host 300 is running, the processor 301 communicates with the memory 305, and the processor 301 executes the execution instructions to cause the host 300 to execute the method described in Embodiment 1 of the present invention. The implementation principle and technical effects are the same as the foregoing. Embodiment 2 is similar and will not be described again here. The operating system 306 includes various programs for implementing various basic services and processing hardware-based tasks. The host 300 also includes a display interface card. In addition, the embodiment of the present invention further provides a computer readable medium, which includes a computer-executed instruction, and the computer-executable instruction enables the host 300 to perform the method described in Embodiment 2 of the present invention, and the implementation principle and technical effect thereof are the same as the previous embodiment 2. Similar, it will not be described here.

The host provided in the embodiment of the present invention determines the destination host included in the virtual local area network that needs to send the TCP/IP data packet by executing the instruction, and only uses the PCIE switch to belong to the VLAN. The host sends data packets, which allows data transmission in the virtual local area network only between hosts in the same virtual local area network, thereby better solving the security problem of the VLAN of the IPoPCIE system, so that the data packets are effectively valid between the hosts. Isolation, avoiding network storms. Moreover, when the PCIE network accesses a large number of hosts, each host may receive a large number of unnecessary broadcast packets and seriously affect the performance of the host.

In the high-speed peripheral component interconnection system shown in FIG. 1, a virtual local area network management server 30 is configured to establish and maintain a correspondence between a virtual local area network and a host. And further, after receiving the modification notification sent by any one of the at least two hosts 10, updating the correspondence between the virtual local area network and the host according to the received modification notification, and updating the updated virtual local area network and the host The correspondence is sent to all hosts 10 in the system.

In the IPoPCIE system provided in the embodiment of the present invention, by determining the host included in the virtual local area network that needs to send the TCP/IP data packet, the data packet is sent only to the destination host belonging to the VLAN through the PCIE switch, so that only the same one is allowed. The data transmission in the virtual local area network between the hosts in the virtual local area network can better solve the security problem of the VLAN of the IPoPCIE system, so as to effectively isolate the data packets between the hosts and avoid network storms. Moreover, it avoids the problem that when a PCIE network accesses a large number of hosts, each host may receive a large number of unnecessary broadcast packets and seriously affect the performance of the host.

Through the description of the above embodiments, it will be apparent to those skilled in the art that the present invention can be implemented in hardware, firmware implementation, or a combination thereof. When implemented in software, the functions described above may be stored in or transmitted as one or more instructions or code on a computer readable medium. Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another. A storage medium may be any available media that can be accessed by a computer. By way of example and not limitation, the computer readable medium can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage media or other magnetic storage device, or can be used to carry or store an instruction or data structure. The desired program code and any other medium that can be accessed by the computer. This evening. Any connection may suitably be a computer readable medium. For example, if the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable , Fiber optic cables, twisted pair, DSL, or wireless technologies such as infrared, wireless, and microwaves are included in the fixing of the associated media. As used in the present invention, a disk and a disc include a compact disc (CD), a laser disc, a disc, a digital versatile disc (DVD), a floppy disc, and a Blu-ray disc, wherein the disc is usually magnetically copied, and the disc is The laser is used to optically replicate the data. Combinations of the above should also be included within the scope of the computer readable media.

In summary, the above description is only a preferred embodiment of the technical solution of the present invention, and is not intended to limit the scope of the present invention. Any modifications, equivalents, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Claims

Rights request

A method for communicating in a virtual local area network, comprising:

Obtain TCP/IP packets that need to be sent in the virtual LAN;

Determining, according to the address information in the TCP/IP data packet, a destination host of the TCP/IP data packet, where the destination host is included in a host included in the virtual local area network;

2. The method of claim 1 wherein:

The corresponding relationship between the virtual local area network and the host is from a virtual local area network management server, and is established and maintained by the virtual local area network management server.

3. Method according to claim 1 or 2, characterized in that it:

4. The method of claim 3, wherein:

The node number of the host included in the virtual local area network is an object number included in the virtual local area network.

5. A method according to any one of claims 2 to 4, characterized in that:

6. Method according to any one of claims 1 to 5, characterized in that, if TCP/IP number According to the package obtained by the source host, then:

When the address information indicates a broadcast address, the destination host of the TCP/IP data packet is all other hosts in the host included in the virtual local area network except the source host; when the address information indicates a single When the address is broadcast, if the host included in the virtual local area network includes the host corresponding to the unicast address, the destination host of the TCP/IP data packet is the host corresponding to the unicast address.

7. A host, characterized in that:

a virtual local area network determining module, configured to acquire a TCP/IP data packet that needs to be sent in a virtual local area network, and find a correspondence between the virtual local area network and the host according to the virtual local area network identifier carried in the TCP/IP data packet, and obtain the virtual local area network to include Determining, by the host, the destination host of the TCP/IP data packet according to the address information in the TCP/IP data packet, where the destination host is included in a host included in the virtual local area network;

8. The host of claim 7 wherein:

9. The host of claim 8 wherein:

The host according to any one of claims 7 to 9, further comprising: a correspondence management module, configured to receive a correspondence between the virtual local area network and the host from the virtual local area network management server, the virtual The correspondence between the local area network and the host is established and maintained by the virtual local area network management server.

11. The host of claim 10, wherein: The corresponding relationship management module is further configured to acquire a command for modifying a virtual local area network, send a modification notification to the virtual local area network management server, and update the virtual local area network according to the modification notification according to the virtual local area network management server The correspondence between the hosts updates the corresponding relationship between the local virtual local area network and the host.

12. The host according to any one of claims 7 to 11, characterized in that:

When the address information indicates a broadcast address, the destination host of the TCP/PIP packet is all other hosts in the host included in the virtual local area network except the host; when the address information indicates a single When the address is broadcast, if the host included in the virtual local area network includes the host corresponding to the unicast address, the destination host of the TCP/IP data packet is the host corresponding to the unicast address.

13. A host, comprising: a processor and a memory, the memory storing execution instructions, when the host is running, the processor is in communication with the memory, the processor executing the execution The instructions cause the host to perform the method of any of claims 1 to 6.

A computer readable medium comprising computer executed instructions for causing a host to perform the method of any one of claims 1 to 6.

A high-speed peripheral component interconnection system, comprising: at least two hosts according to any one of claims 7 to 13, a PC IE switch, and a virtual local area network management server, wherein each of the at least two hosts The host is connected to the PCIE switch, and the virtual local area network management server is connected to the PI CE switch.

The virtual local area network management server is configured to establish and maintain a correspondence between the virtual local area network and a host.

16. The system of claim 15 wherein:

The virtual local area network management server is further configured to: after receiving the modification notification sent by any one of the at least two hosts, update the correspondence between the virtual local area network and the host according to the modification notification, and update the corresponding relationship The corresponding relationship between the virtual local area network and the host is sent to each of the at least two hosts.