WO2015196774A1

WO2015196774A1 - Virtual machine migration method and device

Info

Publication number: WO2015196774A1
Application number: PCT/CN2014/095477
Authority: WO
Inventors: 李金明; 涂彬; 王丽娜
Original assignee: 华为技术有限公司
Priority date: 2014-06-24
Filing date: 2014-12-30
Publication date: 2015-12-30
Also published as: CN105262604A; CN105262604B

Abstract

Disclosed are a virtual machine migration method and device, which are used for realizing the synchronization migration of a network configuration corresponding to a virtual machine when the virtual machine is migrated. The method in the embodiments of the present invention comprises: when a management platform receives a migration request for a virtual machine, sending, by the management platform, a first network configuration to a destination host according to the migration request, wherein the first network configuration is a network configuration of the virtual machine in a source host, so that the destination host injects the first network configuration into the destination host; and when the migration is completed, sending, by the management platform, a selection message to a related host so as to select the destination host as a communication object of the virtual machine.

Description

Virtual machine migration method and device

The present application claims priority to Chinese Patent Application No. 201410289648.5, the entire disclosure of which is incorporated herein by reference.

Technical field

The present invention relates to the field of computer information security technologies, and in particular, to a virtual machine migration method and device.

Background technique

In recent years, virtualization technology has become a core technology and backbone technology in cloud computing, grid computing and high-performance computing environments with good isolation, easy maintenance, cost saving and support for cross-platform applications. Virtualization One of the most important advantages of technology is the migration of virtual machines. However, in a network virtualization environment, software-defined virtual network configurations and network security policies need to be migrated synchronously with virtual machine migration.

Currently, the mainstream Virtual Machine Monitor (VMM) supports the migration of virtual machines (VMs). The representative technology in this regard is VMware's Vmotion. Vmotion encapsulates virtual machine state on a shared storage device and quickly transfers the virtual machine's active memory and execution state over a high-speed network, ensuring seamless migration.

However, most of the existing migration methods are only the migration of the virtual machine itself, and cannot effectively manage the synchronous migration of the network configuration when the virtual machine is migrated.

Summary of the invention

The embodiment of the invention provides a virtual machine migration method and device, which is used to implement synchronous migration of the network configuration corresponding to the virtual machine when the virtual machine is migrated.

A first aspect of the embodiments of the present invention provides a virtual machine migration method, including:

When the management platform receives the migration request for the virtual machine, the management platform sends the first network configuration to the destination host according to the migration request, so that the destination host injects the first network configuration into the destination host. The first network is configured as a network configuration of the virtual machine in a source host, and the migration request is used to request to migrate the virtual machine from the source host to the destination host;

When the management platform receives the migration completion information sent by the destination host, the management platform notifies the communication host to select the destination host as a communication target, and the communication host uses the source host as the virtual machine. The host of the communication target.

With reference to the first aspect of the embodiments of the present invention, in a first implementation manner of the first aspect of the embodiments of the present disclosure, after the management platform sends the first network configuration to the destination host according to the migration request, the method further includes:

Receiving, by the management platform, a second network configuration that is sent by the destination host, where the second network is configured as a network configuration that is matched by the destination host and that is generated by the target host according to the first network configuration;

The management platform saves the second network configuration as a network configuration of the virtual machine in the destination host.

With reference to the first aspect of the embodiment of the present invention or the first implementation manner of the first aspect, in a second implementation manner of the first aspect of the embodiments, the method further includes:

And the management platform sends a redundancy policy to the communication host according to the migration request, where the redundancy policy is used to enable the source host and the destination host to simultaneously receive network data of the virtual machine;

The management platform receives virtual network interface information that is sent by the destination host and allocated to the virtual machine;

The management platform sends the virtual network interface information to the communication host, so that the communication host sends the virtual to the source host and the destination host simultaneously according to the redundancy policy and the network interface information. Machine network data.

With reference to any one of the first aspect of the embodiment of the present invention to the second implementation of the first aspect, in a third implementation manner of the first aspect of the embodiment, the method further includes:

When the management platform receives the migration request for the virtual machine, the management platform sends the original security policy to the destination host according to the migration request, where the original security policy is a security policy of the virtual machine in the source host. And causing the destination host to inject the original security policy into the destination host.

A second aspect of the embodiments of the present invention provides a virtual machine migration method, including:

The destination host receives the first network configuration sent by the management platform, where the first network configuration is a network configuration of the virtual machine in the source host;

The destination host injects the first network configuration into the destination host;

When the destination host detects that the virtual machine migration is completed, the destination host sends migration completion information to the management platform, so that the management platform notifies the communication host to select the destination host as a communication target, and the communication The host is the host of the source host as the communication target of the virtual machine.

With reference to the second aspect of the embodiments of the present invention, in a first implementation manner of the second aspect of the embodiments of the present disclosure, the injecting, by the destination host, the first network configuration into the destination host includes:

Performing, by the destination host, the first network configuration, to generate a second network configuration that matches the destination host;

After the destination host injects the first network configuration into the destination host, the method further includes:

The destination host sends the second network configuration to the management platform, so that the management platform saves the second network configuration as a network configuration of the virtual machine in the destination host.

With reference to the first implementation manner of the second aspect of the embodiment of the present invention, in a second implementation manner of the second aspect of the embodiment, the method further includes:

The destination host sends virtual network interface information allocated to the virtual machine to the management platform.

With reference to the implementation of the second aspect of the second aspect of the present invention, the second implementation manner of the second aspect of the embodiment of the present disclosure, the method further includes:

The destination host receives the original security policy sent by the management platform, where the original security policy is a security policy of the virtual machine in the source host;

The destination host injects the original security policy into the destination host.

A third aspect of the embodiments of the present invention provides a configuration distribution method, including:

When the management platform detects that the virtual machine is created in the host, the management platform acquires a network configuration corresponding to the virtual machine;

The management platform sends a network configuration corresponding to the virtual machine to the host, so that the host updates the forwarding table according to the network configuration;

When the management platform detects that the virtual machine is created in the host, the management platform sends a security policy corresponding to the virtual machine to the host, so that the host executes the security policy.

With reference to the third aspect of the embodiments of the present invention, in a first implementation manner of the third aspect of the embodiments of the present disclosure, the acquiring, by the management platform, the network configuration corresponding to the virtual machine includes:

The management platform displays a list of network card information corresponding to the virtual machine, and prompts the user to set a network configuration corresponding to the virtual machine according to the network card information list;

The management platform receives a network configuration corresponding to the virtual machine set by a user.

With reference to the third aspect of the embodiments of the present invention, in a second implementation manner of the third aspect of the embodiments of the present disclosure, the acquiring, by the management platform, the network configuration corresponding to the virtual machine includes:

The management platform generates a network configuration corresponding to the virtual machine according to a communication state of the virtual machine.

A fourth aspect of the embodiments of the present invention provides a configuration distribution method, including:

When the host detects that the virtual machine is created in the host, the host receives a network configuration and a security policy corresponding to the virtual machine sent by the management platform, where the security policy is performed by an administrator on each virtual network of the virtual machine. Interface settings are generated;

The host updates the forwarding table according to the network configuration;

The host executes the security policy.

With reference to the fourth aspect of the embodiments of the present invention, in a first implementation manner of the fourth aspect of the embodiments, the method further includes:

When the host detects that the virtual machine is created in the host, the host creates a rule chain for each virtual network interface of the virtual machine;

The security policy includes: a filtering rule;

The executing the security policy by the host specifically includes:

The host adds the filtering rule to a corresponding rule chain.

With reference to the first implementation manner of the fourth aspect of the embodiments of the present invention, in the second implementation manner of the fourth aspect of the embodiments, the security policy further includes: a quality of service QoS policy;

The executing the security policy by the host specifically includes:

The host adds the filtering rule to a corresponding rule chain and sets a classifier for the corresponding virtual network interface according to the QoS policy.

A fifth aspect of the embodiments of the present invention provides a management platform, including:

a first configuration sending module, configured to send a first network configuration to the destination host according to the migration request, when the migration request is received, so that the destination host injects the first network configuration into the destination host The first network is configured as a network configuration of the virtual machine in a source host, where The migration request is used to request to migrate the virtual machine from the source host to the destination host;

a selection module, configured to notify the communication host to select the destination host as a communication target when receiving the migration completion information sent by the destination host, where the communication host is the source host as a communication target of the virtual machine Host.

With reference to the fifth aspect of the embodiments of the present invention, in a first implementation manner of the fifth aspect of the embodiments, the management platform further includes:

a second configuration receiving module, configured to receive a second network configuration sent by the destination host, where the second network configuration is a network configuration that is matched by the target host and generated by the destination host according to the first network configuration ;

And a configuration saving module, configured to save the second network configuration as a network configuration of the virtual machine in the destination host.

With reference to the fifth aspect of the embodiment of the present invention or the first implementation manner of the fifth aspect, in the second implementation manner of the fifth aspect of the embodiment, the management platform further includes:

a redundancy issuing module, configured to send a redundancy policy to the communication host according to the migration request, where the redundancy policy is configured to enable the source host and the destination host to simultaneously receive network data of the virtual machine ;

An interface information receiving module, configured to receive virtual network interface information that is sent by the destination host and allocated to the virtual machine;

An interface information sending module, configured to send the virtual network interface information to the communication host, so that the communication host sends the network interface information to the source host and the destination host according to the redundancy policy and the network interface information Network data of the virtual machine.

With reference to any one of the implementation manners of the fifth to fifth aspects of the embodiments of the present invention, in a third implementation manner of the fifth aspect of the embodiments, the management platform further includes:

The first policy sending module is configured to: when the management platform migrates the virtual machine, send the original security policy to the destination host according to the migration request, where the original security policy is a security policy of the virtual machine in the source host And causing the destination host to inject the original security policy into the destination host.

A sixth aspect of the embodiments of the present invention provides a host, which is used as a destination host, and includes:

a first configuration receiving module, configured to receive a first network configuration sent by the management platform, where the first network configuration is a network configuration of the virtual machine in the source host;

Configuring an injection module, configured to inject the first network configuration into the destination host;

And completing the information sending module, configured to send the migration completion information to the management platform when the destination host detects that the virtual machine migration is completed, so that the management platform notifies the communication host to select the destination host as a communication target, The communication host is a host that uses the source host as a communication target of the virtual machine.

With reference to the sixth aspect of the embodiments of the present invention, in a first implementation manner of the sixth aspect, the configuration injection module is specifically configured to perform the first network configuration, and generate a match with the destination host. Second network configuration;

The host also includes:

The second configuration sending module is configured to send the second network configuration to the management platform, so that the management platform saves the second network configuration as a network configuration of the virtual machine in the destination host.

With reference to the first implementation manner of the sixth aspect of the embodiments of the present invention, in a second implementation manner of the sixth aspect of the embodiments, the host further includes:

An interface information distribution module is configured to send virtual network interface information allocated to the virtual machine to the management platform.

With reference to any one of the implementation manners of the sixth to sixth aspects of the embodiments of the present invention, in a third implementation manner of the sixth aspect of the embodiments, the host further includes:

a first policy receiving module, configured to receive an original security policy sent by the management platform, where the original security policy is a security policy of the virtual machine in a source host;

The security policy injection module is configured to inject the original security policy into the destination host.

A seventh aspect of the embodiments of the present invention provides a management platform, including:

The acquiring module is configured to acquire a network configuration corresponding to the virtual machine when the management platform detects that the virtual machine is created in the host;

a third configuration sending module, configured to send a network configuration corresponding to the virtual machine to the host, so that the host updates the forwarding table according to the network configuration;

And a second policy sending module, configured to send a security policy corresponding to the virtual machine to the host when the management platform detects that the virtual machine is created in the host, so that the host performs the security policy.

With reference to the seventh aspect of the embodiments of the present invention, in the first implementation manner of the seventh aspect of the embodiments, the configuration acquiring module specifically includes:

An information display unit, configured to display a network card information list corresponding to the virtual machine, and prompt the user to set a network configuration corresponding to the virtual machine according to the network card information list;

The receiving unit is configured to receive a network configuration corresponding to the virtual machine set by the user.

With reference to the seventh aspect of the embodiments of the present invention, in a second implementation manner of the seventh aspect, the configuration acquiring module is configured to automatically generate, according to a communication state of the virtual machine, a virtual machine corresponding to the virtual machine Network Configuration.

An eighth aspect of the embodiments of the present invention provides a host, including:

a receiving module, configured to: when the host detects that the virtual machine is created in the host, receive a network configuration and a security policy corresponding to the virtual machine sent by the management platform;

And an execution execution module, configured to update the forwarding table according to the network configuration;

a policy execution module, configured to execute the security policy.

With reference to the eighth aspect of the embodiments of the present invention, in a first implementation manner of the eighth aspect of the embodiments, the host further includes:

a creating module, configured to create a rule chain for each virtual network interface of the virtual machine when the host monitors that the virtual machine is created in the host;

When the security policy includes a filtering rule, the policy execution module is specifically configured to add the filtering rule to a corresponding rule chain.

With reference to the first implementation manner of the eighth aspect of the embodiment of the present invention, in the second implementation manner of the eighth aspect of the embodiment of the present invention, when the security policy further includes a QoS policy, the policy execution module is specifically configured to: Adding the filtering rule to the corresponding rule chain and setting a classifier for the corresponding virtual network interface according to the QoS policy.

As can be seen from the foregoing technical solutions, the embodiment of the present invention has the following advantages: In the embodiment of the present invention, when the management platform receives the migration request for the virtual machine, the management platform sends the first network configuration to the destination host according to the migration request. The first network is configured as a network configuration of the virtual machine in the source host, so that the destination host injects the first network configuration into the destination host. When the migration is completed, the management platform notifies the communication host to select the destination host as the communication target. The communication host is the host of the source host as the communication target of the virtual machine, so that through the interaction between the management platform and the destination host, during the migration process, Synchronize the network configuration of the virtual machine in the source host to the destination host of the virtual machine migration, and realize the synchronous migration of the corresponding network configuration when the virtual machine is migrated.

DRAWINGS

FIG. 1 is a schematic flowchart of a virtual machine migration method according to an embodiment of the present invention;

2 is another schematic flowchart of a virtual machine migration method according to an embodiment of the present invention;

3 is a schematic flowchart of a configuration and distribution method according to an embodiment of the present invention;

4 is another schematic flowchart of a configuration distribution method according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a management platform according to an embodiment of the present invention; FIG.

6 is another schematic structural diagram of a management platform according to an embodiment of the present invention;

FIG. 7 is another schematic structural diagram of a management platform according to an embodiment of the present invention; FIG.

FIG. 8 is another schematic structural diagram of a management platform according to an embodiment of the present invention; FIG.

9 is a schematic structural diagram of a host in an embodiment of the present invention;

FIG. 10 is a schematic diagram of another structure of a host according to an embodiment of the present invention; FIG.

11 is another schematic structural diagram of a host in an embodiment of the present invention;

FIG. 12 is a schematic diagram of another structure of a host according to an embodiment of the present invention; FIG.

FIG. 13 is another schematic structural diagram of a management platform according to an embodiment of the present invention; FIG.

FIG. 14 is another schematic structural diagram of a management platform according to an embodiment of the present invention; FIG.

FIG. 15 is a schematic diagram of another structure of a host according to an embodiment of the present invention; FIG.

16 is a schematic structural diagram of another host in an embodiment of the present invention;

FIG. 17 is a schematic structural diagram of a virtual machine migration method according to an embodiment of the present invention; FIG.

FIG. 18 is a schematic structural diagram of a policy management system according to an embodiment of the present invention; FIG.

FIG. 19 is a schematic structural diagram of a server according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are only a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by a person skilled in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The following describes the virtual machine migration method in the embodiment of the present invention from the perspective of the management platform and the host:

First, the operation of the management platform:

Referring to FIG. 1, an embodiment of a virtual machine migration method in an embodiment of the present invention includes:

When the management platform receives the migration request for the virtual machine, the management platform sends the first network configuration to the destination host according to the migration request, so that the destination host injects the first network configuration into the destination host. ;

The first network is configured as a network configuration of the virtual machine in a source host, and the migration request is used to request to migrate the virtual machine from the source host to the destination host.

When a migration event for a virtual machine is issued, the virtual machine management system starts to migrate the virtual machine. When the virtual machine management system migrates the virtual machine, the management platform may send the first to the destination host according to the migration request generated by the migration event. a network configuration, the destination host injects the first network configuration into the destination host. In an actual application, injecting the first network configuration into the destination host may be a kernel control module injected into the destination host, where the first network is configured as The network configuration of the virtual machine saved in the database in the source host. The migration request is used to request that the virtual machine be migrated from the source host to the destination host.

It is to be understood that the migration request may be directly received by the management platform, or may be forwarded to the management platform after receiving the migration request by the virtual machine management system, which is not limited herein.

The virtual machine management system is used to migrate the virtual machine itself, and the management platform is used to manage and migrate the virtual machine configuration and policies. The management platform may be located in the virtual machine management system or may be independent of the virtual machine management system. This is not a limitation.

It should be noted that the network configuration of the virtual machine can be saved in the database, or other storage manners can be used. If the data is saved in the database, the network configuration of the virtual machine stored in the database in the source host can be a virtual machine. The source host is synchronized to the database by the source host. In addition, the migration event may be sent by the administrator, or may be issued by the management platform or other related system according to a preset trigger condition, which is not limited herein.

The network configuration may include a virtual network interface address, a kernel forwarding table, and a tunnel configuration.

102. When the management platform receives the migration completion information sent by the destination host, the management platform notifies the communication host to select the destination host as a communication target.

The communication host is a host that uses the source host as a communication target of the virtual machine.

When the management platform receives the migration completion information sent by the destination host, the management platform notifies the communication host to select the destination host as the communication target. In an actual application, the management platform may send a selection message to the communication host, and the migration completion information may be Is sent by the control node of the destination host, the selection message is used to notify the communication host to select the destination host as the communication target of the virtual machine, and the migration completion information is used to indicate that the virtual machine migration is completed, and the communication host is the source host The host of the virtual machine's communication target.

In the embodiment of the present invention, when the management platform receives the migration request for the virtual machine, the management platform sends the first network configuration to the destination host according to the migration request, where the first network configuration is a network configuration of the virtual machine in the source host. And causing the destination host to inject the first network configuration into the destination host. When the migration is completed, the management platform notifies the communication host to select the destination host as the communication target, and the communication host is the host of the source host as the communication target of the virtual machine, such that Through the interaction between the management platform and the destination host, during the migration process, the network configuration of the virtual machine in the source host is synchronized to the destination host of the virtual machine migration, and the virtual network is synchronized when the virtual machine is migrated. migrate.

Optionally, after the management platform sends the first network configuration to the destination host according to the migration request, the management platform may receive the second network configuration sent by the destination host, where the second network configuration is generated by the destination host according to the first network configuration. a network configuration matching the destination host. In an actual application, when the destination host injects the first network configuration into the destination host, the kernel control module of the destination host generates the host corresponding to the destination network according to the first network configuration. The matching network configuration, after receiving the second network configuration, the management platform may save the second network configuration as a network configuration of the virtual machine in the destination host.

In this way, the network configuration in the source host is migrated to the new host, and the new network configuration is saved after matching with the new host, so that the next migration can be prepared, so that when the virtual machine is migrated at any time, the virtual The network configuration corresponding to the machine can also be migrated synchronously, ensuring synchronization of virtual machine migration and network configuration migration.

Optionally, when the management platform receives the migration request for the virtual machine, the management system may issue a redundancy policy to the communication host according to the migration request, where the redundancy policy is configured to enable the source host and the destination host to receive the same The network data of the virtual machine may be implemented by the virtual machine management system, and the virtual machine management system may send the migration instruction information to the destination host, and trigger the destination host to send the virtual information allocated to the virtual machine. The network interface information is sent to the management platform. After receiving the virtual network interface information sent by the destination host and allocated to the virtual machine, the management platform may send the virtual network interface information to the communication host, so that the communication host follows the redundancy. The policy and the virtual network interface information simultaneously send network data of the virtual machine to the source host and the destination host, and the management platform may further synchronize the virtual network interface information into the interface database.

It can be understood that after the communication host selects the destination host as the communication target, the management platform can also send a message to the communication host to cancel the redundancy policy. In the actual application, since the destination host has been selected as the communication target of the communication host, The message for canceling the redundancy policy may not be sent, and is not limited herein.

In this way, by using the redundancy policy, the source host and the destination host can simultaneously receive the network data of the virtual machine sent by the communication host during the virtual machine migration process, thereby avoiding the loss of the network data sent by the communication host to the virtual machine during the migration process. To ensure the integrity of the data received by the virtual machine during the migration process, after the migration is completed, the redundancy policy is cancelled, and the efficiency of the system operation is improved.

Optionally, when the management platform receives the migration request for the virtual machine, the management platform may send the original security policy to the destination host according to the migration request, where the original security policy is a security policy of the virtual machine in the source host. The destination host injects the original security policy into the destination host, and in an actual application, may be injected into the kernel control module of the destination host.

It can be understood that after the original security policy is sent to the destination host to adapt the new security policy corresponding to the new host, the management platform can also use the new security policy as the security policy of the virtual machine in the destination host. Save and prepare for the next migration.

The security policy can be a rule chain or a quality of service (QoS) policy.

In this way, the unified configuration of the network configuration and the security policy is implemented. When the virtual machine is migrated, the network configuration and the security policy can be simultaneously migrated to ensure that the security level of the migrated virtual machine is not affected.

Second, the operation of the host:

Referring to FIG. 2, another embodiment of the virtual machine migration method in the embodiment of the present invention includes:

201. The destination host receives the first network configuration sent by the management platform.

When the management platform receives the migration request for the virtual machine, and sends the first network configuration corresponding to the virtual machine to the destination host, the destination host receives the first network configuration sent by the management platform, and in actual application, The first network configuration may be received by a control node of the destination host, where the first network is configured as a network configuration of the virtual machine in the source host saved in the database.

It can be understood that, at the same time, the virtual machine management system is migrating the virtual machine according to the migration request.

202. The destination host injects the first network configuration into the destination host.

After receiving the first network configuration, the destination host injects the first network configuration into the destination host. In an actual application, the control node of the destination host may inject the first network configuration into the kernel control module of the destination host.

203. When the destination host detects that the virtual machine migration is completed, the destination host sends the migration completion information to the management platform, so that the management platform notifies the communication host to select the destination host as the communication target.

After the administrator issues a migration event to the virtual machine, the virtual machine management system migrates the virtual machine. The destination host (in the actual application, the control node in the destination host) can monitor the virtual machine management system for the virtual machine. a migration process, when the destination host detects that the virtual machine migration is completed, sending migration completion information to the management platform, so that the management platform notifies the communication host to select the destination host as a communication target, and the communication host is The source host is the host of the communication target of the virtual machine.

In the embodiment of the present invention, the destination host receives the first network configuration sent by the management platform, where the first network is configured as a network configuration of the virtual machine in the source host, and the first network configuration is injected into the destination host, and the target host monitors After the virtual machine migration is completed, the migration completion information is sent to the management platform, so that the management platform notifies the communication host to select the destination host as the communication target, so that the interaction between the management platform and the destination host is performed during the migration process. The network configuration of the virtual machine in the source host is synchronized to the destination host of the virtual machine migration. When the virtual machine is migrated, the corresponding network configuration is synchronously migrated.

Optionally, the destination host injecting the first network configuration into the destination host may perform the first network configuration. In an actual application, the kernel control module of the destination host may perform the first network configuration, generate a second network configuration that matches the destination host, and then the destination host may further send the second network configuration to the management platform. And causing the management platform to save the second network configuration as a network configuration of the virtual machine in the destination host.

In this way, the network configuration in the source host is injected into the destination host, matched with the destination host, and then saved, so that the next migration can be prepared, so that when the virtual machine is migrated at any time, the network configuration corresponding to the virtual machine is configured. Migration can also be synchronized to ensure synchronization of virtual machine migration and network configuration migration.

Optionally, when the virtual machine management platform migrates the virtual machine, the destination host may send the virtual network interface information allocated to the virtual machine to the management platform, so that the management platform sends the virtual network interface to the communication host. The communication host sends the network data of the virtual machine to the source host and the destination host at the same time, and the management platform can also synchronize the virtual network interface information to the interface database.

The communication host simultaneously sends the network data of the virtual machine to the source host and the destination host, and avoids the loss of the network data sent by the communication host to the virtual machine during the virtual machine migration process, thereby ensuring the integrity of the virtual machine receiving data during the migration process. .

Optionally, when the virtual machine management system migrates the virtual machine, the destination host can receive the original security policy sent by the management platform, and in the actual application, the control node sent by the management platform can receive the original security sent by the management platform. The policy is that the original security policy is a security policy of the virtual machine in the source host, and the control node of the destination host can inject the original security policy into the kernel control module of the destination host.

It can be understood that the kernel control module of the destination host can adapt the new security policy to match the destination host after executing the original security policy, and can send the new security policy to the management platform, so that the management platform can The new security policy is used as a security policy for the virtual machine in the destination host to prepare for the next migration.

The security policy can include a rule chain or a quality of service QoS policy.

In this way, when the virtual machine is migrated, the unified migration of the network configuration and the security policy is implemented, ensuring that the security level of the migrated virtual machine is not affected.

The configuration and distribution method in the embodiment of the present invention is described below from the perspective of the management platform and the host.

First, the operation of the management platform:

Referring to FIG. 3, an embodiment of the configuration distribution method in the embodiment of the present invention includes:

301. When the management platform detects that the virtual machine is created in the host, the management platform acquires a network configuration corresponding to the virtual machine.

It can be understood that the management platform can detect whether the virtual machine is created in the host at a certain time, and can also determine that the virtual machine is created by receiving the virtual machine creation completion message sent by the host, which is not limited herein.

302. The management platform sends a network configuration corresponding to the virtual machine to the host, so that the host updates the forwarding table according to the network configuration.

After obtaining the network configuration corresponding to the virtual machine, the management platform sends the network configuration to the host where the virtual machine is located, so that the host updates the forwarding table according to the network configuration, and the forwarding module in the host can also perform related policies according to the network configuration. .

303. When the management platform detects that the virtual machine is created in the host, the management platform sends the security policy corresponding to the virtual machine to the host, so that the host executes the security policy.

When the management platform detects that the virtual machine is created in the host, the management platform can also send the security policy corresponding to the virtual machine to the host, so that the host executes the security policy.

In the embodiment of the present invention, when the management platform detects that the virtual machine is created in the host, the management platform may obtain the network configuration corresponding to the virtual machine, and then send the network configuration to the host, and the management platform may also send the virtual The security policy corresponding to the machine is sent to the host, so that the host executes the security policy, so that the management platform performs unified distribution of the network configuration and the security policy, simplifies the operations required by the user, and improves the efficiency of network configuration and security policy distribution. Accuracy.

In the above embodiment, the management platform obtains the network configuration corresponding to the virtual machine. In the actual application, the management platform can obtain the network configuration corresponding to the virtual machine in multiple manners.

Optionally, the management platform may display a list of network card information corresponding to the virtual machine, and prompt the user to set a network configuration corresponding to the virtual machine according to the network card information list. After the user is configured, the management platform may receive the virtual machine corresponding to the user. Network configuration.

This can reduce the user's operation and accurately send the network configuration set by the user to the host.

Optionally, the management platform may further generate a network setting corresponding to the virtual machine according to the communication state of the virtual machine.

This automated generation of network settings further reduces the need for users to perform operations and improves the efficiency of virtual machine network configuration creation.

In the above embodiment, the management platform may also send a security policy corresponding to the virtual machine to the host, so that The security policy may be implemented by the host. In actual applications, the security policy may include a filtering rule or a QoS policy.

Optionally, as another embodiment of the configuration distribution method, the management platform sends the security policy corresponding to the virtual machine to the host, so that the host performs the security policy, which may include: the management platform may send the filtering rule to the host. (In an actual application, it may be a control node of the host), so that the host adds the filtering rule to a corresponding rule chain, and the rule chain is generated by the host for each virtual network interface of the virtual machine.

It should be noted that each virtual network interface can be distinguished from each other by distinguishing the mark mark (composed of the virtual machine ID and the virtual network interface ID) of the kernel network data structure sk_buff in the kernel communication module. This flag is stored in sk_buff (not in the data frame). This tag can be identified by the existing firewall and QoS mechanism, so that each virtual network interface can be identified locally without modifying the contents of the network frame.

When the rule chain is set, when the data processing is performed, the control node of the host can use NF_HOOK to hand over the data frame to the netfilter, and the control node of the host receives the data frame processed by the netfilter in the PREROUTING and POSTROUTING rule list of the ebtables. According to the set mark, the source of the frame can be identified, so that the data can be transmitted to the corresponding rule chain for processing, and finally, the tunnel technology can be used for packet forwarding.

Optionally, the management platform sends the security policy corresponding to the virtual machine to the host, so that the host performs the security policy, and may further include: when the virtual machine is created in the host, the management platform may further save the QoS policy. Sent to the host (in the actual application, it can be the control node of the host), the QoS policy is generated by the administrator for each virtual network interface setting of the virtual machine, so that the host (in actual applications, the The control node of the host sets a classifier for the corresponding virtual network interface according to the QoS policy.

The QoS policy can also be saved in the management platform, and the transmitting end of the virtual network interface corresponds to the input end QoS, and the receiving end of the virtual network interface corresponds to the output end QoS.

When the QoS policy is set, the data is processed. On the sender side, before the kernel encapsulates the data UDP, the same flag can be marked on the sk_buff, and the data frame is handed over to the Ingress QoS processing using the Qdisc->enqueue method. The tag finds the corresponding QoS policy for processing, and after the processing is completed, the data is encapsulated into a UDP packet and sent out; at the receiving end, the kernel obtains After the packet is decapsulated and tagged with the receiver, the data frame is handed over to Qdisc for output QoS.

In this way, after the network configuration is distributed, the management platform can uniformly distribute security policies including filtering rules or QoS policies, and implement centralized distribution of network configuration and security policies, which can effectively improve the efficiency of distribution.

Second, the operation of the host:

Please refer to FIG. 4, another embodiment of the configuration distribution method in the embodiment of the present invention includes:

401. When the host detects that the virtual machine is created in the host, the host receives a network configuration and a security policy corresponding to the virtual machine sent by the management platform.

When the host detects that the virtual machine is created in the host, the management platform sends the network configuration and security policy corresponding to the virtual machine to the host (in actual applications, it may be the control node of the host), and the security policy may be The administrator generates a virtual network interface setting for the virtual machine, and the host receives the network configuration and security policy sent by the management platform.

402. The host updates the forwarding table according to the network configuration.

After receiving the network configuration, the host updates the forwarding table according to the network configuration. In the actual application, after receiving the network configuration, the control node of the host may inject the network configuration into the kernel control module of the host, and the kernel control module Update the forwarding table according to the network configuration.

403. The host executes the security policy.

After receiving the security policy, the host executes the security policy. In an actual application, the security policy may be received by the control node in the host, and then injected into the kernel control module in the host, and the kernel control module of the host executes the security policy. .

It can be understood that step 403 can also be located before step 402, which is not limited herein.

In the embodiment of the present invention, when the virtual machine is created in the host, the host receives the network configuration and the security policy sent by the management platform, so that the host updates the forwarding table according to the network configuration, and executes the policy, so that the management platform performs Network configuration and security policy distribution, the control node in the host performs network configuration and security policy receiving and injecting, which simplifies the operations that users need to perform, and realizes centralized distribution of network configuration and security policies.

Optionally, as another embodiment of the configuration distribution method, when the host detects that the virtual machine is created in the host, the host may create a rule chain for each virtual network interface of the virtual machine;

The security policy may include a filtering rule. In this case, the host performs the security policy, and the host may add the filtering rule to the corresponding rule chain.

It can be understood that the filtering rule can be set by the user, or can be automatically generated by the management platform according to the running environment of the virtual machine or the preset rule, which is not limited herein.

Optionally, the security policy may further include: a QoS policy, where the QoS policy is generated by the administrator for each virtual network interface setting of the virtual machine; the executing the security policy by the host may include: Join the corresponding rule chain and set the classifier for the corresponding virtual network interface according to the QoS policy.

When the QoS policy is set, the data is processed. On the sender side, before the kernel encapsulates the data UDP, the same flag can be marked on the sk_buff, and the data frame is handed over to the Ingress QoS processing using the Qdisc->enqueue method. The tag finds the corresponding QoS policy for processing. After the processing is completed, the data is encapsulated into UDP data packets and sent out. At the receiving end, the kernel obtains the data packet, decapsulates and marks the receiving end, and then passes the data frame to Qdisc for output. End QoS.

In this way, when the host distributes the security policy, not only the filtering rules can be distributed, but also the QoS policy can be distributed, which further ensures the security of the virtual machine.

The following describes the management platform for the virtual machine migration in the embodiment of the present invention. Referring to FIG. 5, an embodiment of the management platform 500 in the embodiment of the present invention includes:

The first configuration sending module 501 is configured to: when receiving the migration request for the virtual machine, send the first network configuration to the destination host according to the migration request, so that the destination host injects the first network configuration into the destination a host, the first network is configured as a network configuration of the virtual machine in a source host, and the migration request is used to request to migrate the virtual machine from the source host to the destination host;

The selecting module 502 is configured to notify the communication host to select the destination host as the communication target when receiving the migration completion information sent by the destination host, where the communication host is the source host as the communication target of the virtual machine Host.

In the embodiment of the present invention, when receiving the migration request for the virtual machine, the first configuration sending module 501 sends the first network configuration to the destination host according to the migration request, where the first network is configured as the network of the virtual machine in the source host. The configuration is such that the destination host injects the first network configuration into the destination host. When the migration is completed, the selection module 502 notifies the communication host to select the destination host as the communication target, so that the interaction between the management platform and the destination host is performed. During the process, the network configuration of the virtual machine in the source host is synchronized to the destination host of the virtual machine migration, and the virtual network is migrated synchronously.

Optionally, referring to FIG. 6, in another embodiment of the management platform 600 in the embodiment of the present invention, the management platform 600 may further include:

The second configuration receiving module 601 is configured to receive a second network configuration that is sent by the destination host, where the second network is configured to be a network that is matched by the target host and configured by the destination host according to the first network configuration. Configuration

The configuration saving module 602 is configured to save the second network configuration as a network configuration of the virtual machine in the destination host.

In this way, the network configuration in the source host is migrated to the new host, and after matching with the new host, the configuration save module 602 is synchronized to the database, and the next migration can be prepared to migrate the virtual machine at any time. The network configuration corresponding to the virtual machine can also be migrated synchronously, ensuring synchronization of virtual machine migration and network configuration migration.

Optionally, referring to FIG. 7, in another embodiment of the management platform 700 in the embodiment of the present invention, the management platform 700 may further include:

a redundancy issuing module 701, configured to send a redundancy policy to the communication host according to the migration request, where the redundancy policy is configured to enable the source host and the destination host to simultaneously receive the virtual machine Network data;

The interface information receiving module 702 is configured to receive virtual network interface information that is sent by the destination host and that is allocated to the virtual machine.

The interface information sending module 703 is configured to send the virtual network interface information to the communication host, so that the communication host simultaneously sends the network interface information to the source host and the destination host according to the redundancy policy. Sending network data of the virtual machine;

In this way, with the redundancy policy, the source host and the destination host can simultaneously receive the network data of the virtual machine sent by the relevant host during the virtual machine migration process, thereby avoiding the loss of the network data sent by the relevant host to the virtual machine during the migration process. To ensure the integrity of the data received by the virtual machine during the migration process, after the migration is completed, the redundancy policy is cancelled, and the efficiency of the system operation is improved.

Optionally, referring to FIG. 8, in another embodiment of the management platform 800 in the embodiment of the present invention, the management platform 800 may further include:

The first policy sending module 801 is configured to: when the virtual machine management system migrates the virtual machine, send the original security policy to the destination host according to the migration request, where the original security policy is that the virtual machine is in the source host. The security policy causes the destination host to inject the original security policy into the destination host.

The following describes the host used as the destination host for the virtual machine migration in the embodiment of the present invention. Referring to FIG. 9, an embodiment of the host 900 in the embodiment of the present invention includes:

The first configuration receiving module 901 is configured to receive a first network configuration sent by the management platform, where the first network configuration is a network configuration of the virtual machine in the source host;

The configuration injection module 902 is configured to inject the first network configuration into the destination host;

The completion information sending module 903 is configured to: when the destination host detects that the virtual machine migration is completed, send migration completion information to the management platform, so that the management platform notifies the communication host to select the destination host as a communication target. The communication host is a host that uses the source host as a communication target of the virtual machine.

In the embodiment of the present invention, the first configuration receiving module 901 receives the first network configuration sent by the management platform. The first network is configured as a network configuration of the virtual machine in the source host, and the configuration injection module 902 injects the first network configuration into the destination host. When the destination host detects that the virtual machine migration is completed, the information is sent. The module 903 sends the migration completion information to the management platform, so that the management platform notifies the communication host to select the destination host as the communication target, so that the virtual machine is at the source host during the migration process by the interaction between the management platform and the destination host. The network configuration in the synchronization is synchronized to the destination host of the virtual machine migration, and the virtual network migration is synchronized with the corresponding network configuration.

Optionally, referring to FIG. 10, in another embodiment of the host 1000 in the embodiment of the present invention, the configuration injection module 902 is specifically configured to execute the first network configuration, and generate a second network that matches the destination host. Configuration

The host 1000 further includes: a second configuration sending module 1001, configured to send the second network configuration to the management platform, so that the management platform uses the second network configuration as the virtual machine in the destination host The network configuration in the middle is saved.

In this way, the network configuration in the source host is injected into the destination host, matched with the destination host, and then synchronized to the database, which can prepare for the next migration, so that when the virtual machine is migrated at any time, the corresponding network of the virtual machine Configurations can also be migrated synchronously, ensuring synchronization of virtual machine migration and network configuration migration.

Optionally, referring to FIG. 11, in another embodiment of the host 1100 in the embodiment of the present invention, the host 1100 may further include:

The interface information distribution module 1101 is configured to send virtual network interface information allocated to the virtual machine to the management platform, so that the management platform sends the virtual network interface to the communication host, so that the communication host simultaneously sends the source host and the destination The host sends the network data of the virtual machine, and the management platform can also synchronize the virtual network interface information to the interface database.

The communication host simultaneously sends the network data of the virtual machine to the source host and the destination host, and avoids the loss of the network data sent by the related host to the virtual machine during the virtual machine migration process, thereby ensuring the integrity of the virtual machine receiving data during the migration process. .

Optionally, referring to FIG. 12, in another embodiment of the host 1200 in the embodiment of the present invention, the host 1200 may further include:

The first policy receiving module 1201 is configured to receive an original security policy sent by the management platform, where the original security policy is a security policy of the virtual machine in the source host.

The security policy injection module 1202 is configured to inject the original security policy into the destination host.

The following describes the management platform for configuring the distribution in the embodiment of the present invention. Referring to FIG. 13, another embodiment of the management platform 1300 in the embodiment of the present invention includes:

The configuration obtaining module 1301 is configured to acquire a network configuration corresponding to the virtual machine when the management platform detects that the virtual machine is created in the host.

The third configuration sending module 1302 is configured to send a network configuration corresponding to the virtual machine to the host, so that the host updates the forwarding table according to the network configuration;

The second policy sending module 1303 is configured to: when the management platform detects that the virtual machine is created in the host, send the security policy corresponding to the virtual machine to the host, so that the host performs the security policy.

In the embodiment of the present invention, when the management platform detects that the virtual machine is created in the host, the configuration obtaining module 1301 may obtain the network configuration corresponding to the virtual machine, and the third configuration sending module 1302 sends the network configuration to the host, The second policy sending module 1303 sends the security policy to the host, so that the management platform performs network configuration and unified distribution of the security policy, which simplifies the operations required by the user, and improves the efficiency and accuracy of network configuration and security policy distribution.

In the above embodiment, the configuration obtaining module 1301 obtains the network configuration corresponding to the virtual machine. In an actual application, the configuration obtaining module 1301 can obtain the network configuration corresponding to the virtual machine in multiple manners.

Optionally, referring to FIG. 14, in another embodiment of the management platform 1400 in the embodiment of the present invention, the configuration obtaining module 1301 may specifically include:

The information display unit 14011 is configured to display a network card information list corresponding to the virtual machine, and prompt the user to set a network configuration corresponding to the virtual machine according to the network card information list;

The configuration receiving unit 14012 is configured to receive a network configuration corresponding to the virtual machine set by the user.

Optionally, in another embodiment of the management platform in the embodiment of the present invention, the configuration obtaining module 1301 may be configured to automatically generate a network configuration corresponding to the virtual machine according to the communication state of the virtual machine.

This automated generation of network settings further reduces the number of operations users need to perform, increasing the efficiency of virtual machine creation.

Optionally, in another embodiment of the management platform in the embodiment of the present invention, the second policy sending module 1303 may be specifically configured to: when the virtual machine is created in the host, send the filtering rule to the host, so that The host adds the filtering rule to a corresponding rule chain, and the rule chain is generated by the host for each virtual network interface of the virtual machine.

Optionally, in another embodiment of the management platform in the embodiment of the present invention, the second policy sending module 1303 may be further configured to: when the virtual machine is created in the host, send the saved QoS policy to the host, The QoS policy is generated by an administrator for each virtual network interface setting of the virtual machine, so that the host sets a classifier for the corresponding virtual network interface according to the QoS policy.

In this way, after the third configuration sending module 1302 performs the distribution of the network configuration, the second policy sending module 1303 can uniformly distribute the security policy including the filtering rule or the QoS policy, thereby realizing the centralized distribution of the network configuration and the security policy. More effective in improving the efficiency of distribution.

The following describes the host for configuring the distribution in the embodiment of the present invention. Referring to FIG. 15, another embodiment of the host 1500 in the embodiment of the present invention includes:

The receiving module 1501 is configured to: when the host monitors that the virtual machine is created in the host, receive a network configuration and a security policy corresponding to the virtual machine sent by the management platform, where the security policy may be used by an administrator to the virtual Each virtual network interface setting of the machine is generated;

The configuration execution module 1502 is configured to update the forwarding table according to the network configuration.

The policy execution module 1503 is configured to execute the security policy.

In the embodiment of the present invention, when the virtual machine is created in the host, the receiving module 1501 receives the network configuration and security policy sent by the management platform, and the configuration execution module 1502 updates the forwarding table according to the network configuration, and the policy execution module 1503 executes the security policy. In this way, the management platform performs unified distribution of network configuration and security policies, which simplifies the operations that users need to perform, and improves the efficiency and accuracy of network configuration and security policy distribution.

Optionally, referring to FIG. 16, in another embodiment of the host 1600 in the embodiment of the present invention, the host 1600 may further include:

a creating module 1601, configured to create a rule chain for each virtual network interface of the virtual machine when the host detects that the virtual machine is created in the host;

When the security policy includes a filtering rule, the policy execution module 1505 is specifically configured to add the filtering rule to a corresponding rule chain.

Optionally, in another embodiment of the host in the embodiment of the present invention, when the security policy further includes a QoS policy, the policy execution module 1505 is specifically configured to add the filtering rule to the corresponding rule chain and follow the The QoS policy sets a classifier for the corresponding virtual network interface.

It can be understood that, in practical applications, modules for performing configuration and policy execution in the host may be located in the kernel control module of the host, such as the policy execution module 1504 and the configuration execution module 1503, and the modules for configuration and policy reception and distribution are both It can be located in the control node of the host, for example, the third configuration sending module 1302, etc. Please refer to FIG. 17, which is a structural diagram of a specific scenario of the management platform and the source host and the destination host in the virtual machine migration.

Referring to FIG. 18, the control node and the kernel control module in each host connected to the management platform may constitute a policy management system, wherein the set of control nodes in each host may be regarded as the main control program of the policy management system. The set of kernel control modules in each host can be seen as the kernel communication module of the policy management system.

Among them, the purpose of each part of the policy management system is:

Management platform: maintains the status information of virtual machines and virtual network interfaces in the entire data center in the database of the management platform, and saves the network configuration and network security policy information for the virtual network interface. The management platform automatically updates the configuration and policy information to the master program based on the configuration information saved by the database and the virtual machine running state changes submitted by the master program (including the startup, shutdown, and migration of the virtual machine).

The main control program: the communication process is synchronized between the main control program and the upper management platform. On the other hand, the main control program needs to be timely transmitted to the kernel communication module when receiving the communication strategy information sent from the management platform. In addition, the master program also needs to monitor the status of the local virtual machine and notify the management platform of the virtual machine status update event in time to issue a security policy according to the change of the virtual machine state.

Kernel communication module: The kernel communication module is responsible for information interaction with the upper layer master program, and the kernel communication module has a Cache cache to record the existing policies and complete the local communication policy Cache filtering work.

The management platform and the host in the embodiment of the present invention are described above from the perspective of the unitized functional entity. The management platform and the host in the embodiment of the present invention are described from the perspective of hardware processing. It can be understood that in practical applications, , management platform, source host, destination host, related host The device can be a server, as shown in FIG. 19, which is a schematic diagram of the structure of the server, and can also be used as a schematic diagram of the management platform or the host in the embodiment of the present invention.

The management platform for virtual machine migration in the embodiment of the present invention is described below from the perspective of hardware processing. Referring to FIG. 19, another embodiment of the management platform in the embodiment of the present invention includes:

The input device 1901, the output device 1902, the processor 1903, and the memory 1904 (wherein the number of the processors 1903 may be one or more, and one processor 1903 is taken as an example in FIG. 19). In some embodiments of the present invention, the input device 1901, the output device 1902, the processor 1903, and the memory 1904 may be connected by a bus or other manner, wherein the bus connection is taken as an example in FIG. 19;

The processor 1903 is configured to perform the following steps by calling an operation instruction stored in the memory 1904:

When receiving the migration request for the virtual machine, sending the first network configuration to the destination host according to the migration request, so that the destination host injects the first network configuration into the destination host, where the first network is configured as a network configuration of the virtual machine in the source host, the migration request is used to request to migrate the virtual machine from the source host to the destination host;

Receiving the migration completion information sent by the destination host, notifying the communication host to select the destination host as a communication target, and the communication host is the host of the communication target of the virtual machine;

In some embodiments of the present invention, the processor 1903 is further configured to perform the following steps:

Receiving a second network configuration that is sent by the destination host, where the second network is configured as a network configuration that is matched by the destination host and that is generated according to the first network configuration;

And saving the second network configuration as a network configuration of the virtual machine in the destination host;

And issuing a redundancy policy to the communication host according to the migration request, where the redundancy policy is configured to enable the source host and the destination host to simultaneously receive network data of the virtual machine;

Receiving virtual network interface information that is sent by the destination host and allocated to the virtual machine;

Sending the virtual network interface information to the communication host, so that the communication host simultaneously sends the network data of the virtual machine to the source host and the destination host according to the redundancy policy and the network interface information. ;

When the management platform receives the migration request for the virtual machine, the original security policy is sent to the destination host according to the migration request, where the original security policy is a security policy of the virtual machine in the source host, so that the destination is The host injects the original security policy into the destination host.

The following describes the host for the virtual machine migration in the embodiment of the present invention from the perspective of the hardware processing. The host is used as the destination host. Referring to FIG. 19, another embodiment of the host in the embodiment of the present invention includes:

Receiving, by the management platform, a first network configuration, where the first network is configured as a network configuration of the virtual machine in the source host;

Injecting the first network configuration into the destination host;

Sending migration completion information to the management platform when the virtual machine migration is completed, so that the management platform notifies the communication host to select the destination host as a communication target, and the communication host is the source host a host of a communication target of the virtual machine;

In some embodiments of the present invention, the processor 1903 specifically performs the following steps:

Performing the first network configuration to generate a second network configuration that matches the destination host;

The processor 1903 also performs the following steps:

Sending the second network configuration to the management platform, so that the management platform saves the second network configuration as a network configuration of the virtual machine in the destination host;

In some embodiments of the present invention, the processor 1903 further performs the following steps:

Sending virtual network interface information allocated to the virtual machine to the management platform;

Receiving the original security policy sent by the management platform, where the original security policy is a security policy of the virtual machine in the source host;

Injecting the original security policy into the destination host.

The management platform for configuration distribution in the embodiment of the present invention is performed from the perspective of hardware processing. Description, please refer to FIG. 19, another embodiment of the management platform in the embodiment of the present invention includes:

Obtaining a network configuration corresponding to the virtual machine when the management platform detects that the virtual machine is created in the host;

Sending a network configuration corresponding to the virtual machine to the host, so that the host updates the forwarding table according to the network configuration;

When the management platform detects that the virtual machine is created in the host, the security policy corresponding to the virtual machine is sent to the host, so that the host executes the security policy;

Displaying a network card information list corresponding to the virtual machine, and prompting the user to set a network configuration corresponding to the virtual machine according to the network card information list;

Receiving a network configuration corresponding to the virtual machine set by the user;

Generating a network configuration corresponding to the virtual machine according to a communication state of the virtual machine.

The host for configuring the distribution in the embodiment of the present invention is described below from the perspective of hardware processing. Referring to FIG. 19, another embodiment of the host in the embodiment of the present invention includes:

When the host detects that the virtual machine is created in the host, the network configuration and the security policy corresponding to the virtual machine sent by the management platform are received, and the security policy is generated by the administrator for each virtual network interface setting of the virtual machine. ;

Updating the forwarding table according to the network configuration;

Executing the security policy;

In some embodiments of the invention, the processor 1903 also performs the following operations:

When the host detects that the virtual machine is created in the host, a rule chain is created for each virtual network interface of the virtual machine;

When the security policy includes a filtering rule, the processor 1903 specifically performs the following operations:

Adding the filtering rule to a corresponding rule chain;

In some embodiments of the present invention, when the security policy further includes a QoS policy, the processor 1903 specifically performs the following operations:

Adding the filtering rule to the corresponding rule chain and setting a classifier for the corresponding virtual network interface according to the QoS policy.

A person skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed system, apparatus, and method may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be in an electrical, mechanical or other form.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit is implemented in the form of a software functional unit and sold as a standalone product Or when used, it can be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or all or part of the technical solution, may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the embodiments are modified, or the equivalents of the technical features are replaced by the equivalents of the technical solutions of the embodiments of the present invention.

Claims

A virtual machine migration method, comprising:

When the management platform receives the migration request for the virtual machine, the management platform sends the first network configuration to the destination host according to the migration request, so that the destination host injects the first network configuration into the destination host. The first network is configured as a network configuration of the virtual machine in a source host, and the migration request is used to request to migrate the virtual machine from the source host to the destination host;

When the management platform receives the migration completion information sent by the destination host, the management platform notifies the communication host to select the destination host as a communication target, and the communication host uses the source host as the virtual machine. The host of the communication target.
The method of claim 1, further comprising: after the management platform sends the first network configuration to the destination host according to the migration request, further comprising:

Receiving, by the management platform, a second network configuration that is sent by the destination host, where the second network is configured as a network configuration that is matched by the destination host and that is generated by the target host according to the first network configuration;

The management platform saves the second network configuration as a network configuration of the virtual machine in the destination host.
The method according to claim 1 or 2, wherein the method further comprises:

And the management platform sends a redundancy policy to the communication host according to the migration request, where the redundancy policy is used to enable the source host and the destination host to simultaneously receive network data of the virtual machine;

The management platform receives virtual network interface information that is sent by the destination host and allocated to the virtual machine;

The management platform sends the virtual network interface information to the communication host, so that the communication host sends the virtual to the source host and the destination host simultaneously according to the redundancy policy and the network interface information. Machine network data.
The method according to any one of claims 1 to 3, further comprising:

When the management platform receives the migration request for the virtual machine, the management platform sends the original security policy to the destination host according to the migration request, where the original security policy is a security policy of the virtual machine in the source host. And causing the destination host to inject the original security policy into the destination host.
A virtual machine migration method, comprising:

The destination host receives the first network configuration sent by the management platform, where the first network configuration is a network configuration of the virtual machine in the source host;

The destination host injects the first network configuration into the destination host;

When the destination host detects that the virtual machine migration is completed, the destination host sends migration completion information to the management platform, so that the management platform notifies the communication host to select the destination host as a communication target, and the communication The host is the host of the source host as the communication target of the virtual machine.
The method according to claim 5, wherein the injecting, by the destination host, the first network configuration into the destination host comprises:

Performing, by the destination host, the first network configuration, to generate a second network configuration that matches the destination host;

After the destination host injects the first network configuration into the destination host, the method further includes:

The destination host sends the second network configuration to the management platform, so that the management platform saves the second network configuration as a network configuration of the virtual machine in the destination host.
The method of claim 6 wherein the method further comprises:

The destination host sends virtual network interface information assigned to the virtual machine to the management platform.
The method according to any one of claims 5 to 7, wherein the method further comprises:

The destination host receives the original security policy sent by the management platform, where the original security policy is a security policy of the virtual machine in the source host;

The destination host injects the original security policy into the destination host.
A configuration distribution method, comprising:

When the management platform detects that the virtual machine is created in the host, the management platform acquires a network configuration corresponding to the virtual machine;

The management platform sends a network configuration corresponding to the virtual machine to the host, so that the host updates the forwarding table according to the network configuration;

When the management platform detects that the virtual machine is created in the host, the management platform sends the virtual The security policy corresponding to the virtual machine is sent to the host, so that the host executes the security policy.
The method according to claim 9, wherein the acquiring, by the management platform, the network configuration corresponding to the virtual machine comprises:

The management platform displays a list of network card information corresponding to the virtual machine, and prompts the user to set a network configuration corresponding to the virtual machine according to the network card information list;

The management platform receives a network configuration corresponding to the virtual machine set by a user.
The method according to claim 9, wherein the acquiring, by the management platform, the network configuration corresponding to the virtual machine comprises:

The management platform generates a network configuration corresponding to the virtual machine according to a communication state of the virtual machine.
A configuration distribution method, comprising:

When the host detects that the virtual machine is created in the host, the host receives a network configuration and a security policy corresponding to the virtual machine sent by the management platform;

The host updates the forwarding table according to the network configuration;

The host executes the security policy.
The method of claim 12, wherein the method further comprises:

When the host detects that the virtual machine is created in the host, the host creates a rule chain for each virtual network interface of the virtual machine;

The security policy includes: a filtering rule;

The executing the security policy by the host specifically includes:

The host adds the filtering rule to a corresponding rule chain.
The method according to claim 13, wherein the security policy further comprises: a quality of service QoS policy;

The executing the security policy by the host specifically includes:

The host adds the filtering rule to a corresponding rule chain and sets a classifier for the corresponding virtual network interface according to the QoS policy.
A management platform, comprising:

a first configuration sending module, configured to send a first network configuration to the destination host according to the migration request, when the migration request for the virtual machine is received, so that the destination host configures the first network configuration Entering the destination host, the first network is configured as a network configuration of the virtual machine in the source host, and the migration request is used to request to migrate the virtual machine from the source host to the destination host;

a selection module, configured to notify the communication host to select the destination host as a communication target when receiving the migration completion information sent by the destination host, where the communication host is the source host as a communication target of the virtual machine Host.
The management platform according to claim 15, wherein the management platform further comprises:

a second configuration receiving module, configured to receive a second network configuration sent by the destination host, where the second network configuration is a network configuration that is matched by the target host and generated by the destination host according to the first network configuration ;

And a configuration saving module, configured to save the second network configuration as a network configuration of the virtual machine in the destination host.
The management platform according to claim 15 or 16, wherein the management platform further comprises:

a redundancy issuing module, configured to send a redundancy policy to the communication host according to the migration request, where the redundancy policy is configured to enable the source host and the destination host to simultaneously receive network data of the virtual machine ;

An interface information receiving module, configured to receive virtual network interface information that is sent by the destination host and allocated to the virtual machine;

An interface information sending module, configured to send the virtual network interface information to the communication host, so that the communication host sends the network interface information to the source host and the destination host according to the redundancy policy and the network interface information Network data of the virtual machine.
The method according to any one of claims 15 to 17, wherein the management platform further comprises:

a first policy sending module, configured to send an original security policy to the destination host according to the migration request, when the migration request for the virtual machine is received, where the original security policy is the security of the virtual machine in the source host The policy is such that the destination host injects the original security policy into the destination host.
A host, used as a destination host, is characterized by:

a first configuration receiving module, configured to receive a first network configuration sent by the management platform, where the first network Network configuration is the network configuration of the virtual machine in the source host;

Configuring an injection module, configured to inject the first network configuration into the destination host;

And completing the information sending module, configured to send the migration completion information to the management platform when the destination host detects that the virtual machine migration is completed, so that the management platform notifies the communication host to select the destination host as a communication target, The communication host is a host that uses the source host as a communication target of the virtual machine.
A host according to claim 19, wherein:

The configuration injection module is specifically configured to: execute the first network configuration, and generate a second network configuration that matches the destination host;

The host also includes:

The second configuration sending module is configured to send the second network configuration to the management platform, so that the management platform saves the second network configuration as a network configuration of the virtual machine in the destination host.
The host according to claim 20, wherein the host further comprises:

An interface information distribution module is configured to send virtual network interface information allocated to the virtual machine to the management platform.
The host according to any one of claims 19 to 21, wherein the host further comprises:

a first policy receiving module, configured to receive an original security policy sent by the management platform, where the original security policy is a security policy of the virtual machine in a source host;

The security policy injection module is configured to inject the original security policy into the destination host.
A management platform, comprising:

The acquiring module is configured to acquire a network configuration corresponding to the virtual machine when the management platform detects that the virtual machine is created in the host;

a third configuration sending module, configured to send a network configuration corresponding to the virtual machine to the host, so that the host updates the forwarding table according to the network configuration;

And a second policy sending module, configured to send a security policy corresponding to the virtual machine to the host when the management platform detects that the virtual machine is created in the host, so that the host performs the security policy.
The management platform of claim 23, wherein the configuration obtaining module specifically comprises:

An information display unit, configured to display a network card information list corresponding to the virtual machine, and prompt the user to set a network configuration corresponding to the virtual machine according to the network card information list;

The receiving unit is configured to receive a network configuration corresponding to the virtual machine set by the user.
The management platform according to claim 23, wherein the configuration obtaining module is configured to generate a network configuration corresponding to the virtual machine according to a communication state of the virtual machine.
A host characterized by comprising:

a receiving module, configured to: when the host detects that the virtual machine is created in the host, receive a network configuration and a security policy corresponding to the virtual machine sent by the management platform;

And an execution execution module, configured to update the forwarding table according to the network configuration;

a policy execution module, configured to execute the security policy.
The host according to claim 26, wherein the host further comprises:

a creating module, configured to create a rule chain for each virtual network interface of the virtual machine when the host monitors that the virtual machine is created in the host;

When the security policy includes a filtering rule, the policy execution module is specifically configured to add the filtering rule to a corresponding rule chain.
The host according to claim 27, wherein when the security policy further includes a QoS policy, the policy execution module is specifically configured to add the filtering rule to a corresponding rule chain and follow the QoS policy. Set the classifier for the corresponding virtual network interface.