WO2019071464A1 - 数据中心系统中域名解析的方法、装置和系统 - Google Patents

数据中心系统中域名解析的方法、装置和系统 Download PDF

Info

Publication number
WO2019071464A1
WO2019071464A1 PCT/CN2017/105686 CN2017105686W WO2019071464A1 WO 2019071464 A1 WO2019071464 A1 WO 2019071464A1 CN 2017105686 W CN2017105686 W CN 2017105686W WO 2019071464 A1 WO2019071464 A1 WO 2019071464A1
Authority
WO
WIPO (PCT)
Prior art keywords
vpc
address
domain name
server
dns
Prior art date
Application number
PCT/CN2017/105686
Other languages
English (en)
French (fr)
Inventor
刘晓贺
雷智鹏
苏建康
张亚军
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to PCT/CN2017/105686 priority Critical patent/WO2019071464A1/zh
Priority to CN202110824843.3A priority patent/CN113726918B/zh
Priority to CN201780095877.5A priority patent/CN111213348B/zh
Publication of WO2019071464A1 publication Critical patent/WO2019071464A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/45—Network directories; Name-to-address mapping
    • H04L61/4505—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols
    • H04L61/4511—Network directories; Name-to-address mapping using standardised directories; using standardised directory access protocols using domain name system [DNS]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/901—Indexing; Data structures therefor; Storage structures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/09—Mapping addresses
    • H04L61/25—Mapping addresses of the same type
    • H04L61/2503—Translation of Internet protocol [IP] addresses
    • H04L61/2521—Translation architectures other than single NAT servers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5061—Pools of addresses

Definitions

  • the present invention relates to the field of IT technologies, and in particular, to a method, apparatus and system for domain name resolution in a data center system.
  • the domain name system is a system for mapping domain names and IP addresses on the Internet.
  • DNS domain name system
  • VPC virtual private cloud
  • a virtual private cloud is a custom private network created by users in a data center network. Different virtual private clouds are separated by two layers of logic. Users can manage their own virtual private cloud networks. Create and manage cloud product instances in the cloud, such as dividing network segments, configuring routing tables, and gateways.
  • the IP address corresponding to the domain name www.abc.com in the VPC1 network is 2.2.2.2
  • the IP address corresponding to the domain name www.abc.com in the VPC2 network is 3.3.3.3.
  • the DNS server in the data center cannot perform the domain name resolution on the DNS server.
  • the different IP addresses corresponding to the same domain name cannot be returned to different users.
  • the embodiment of the invention describes a method, a device and a system for domain name resolution in a data center system, which avoids the problem that the DNS server cannot correctly perform domain name resolution in the case where the domain name is duplicated in different VPCs in the data center system.
  • an embodiment of the present invention provides a method for performing domain name resolution in a data center system, where the data center system includes at least one physical server, a DNS server, and a distributed routing device, and each physical server runs at least one virtual machine.
  • the virtual machines in the data center system are respectively located in at least two virtual private cloud VPCs, wherein the at least two VPCs are hosted with the same domain name, and the same domain name points to different in the at least two VPCs.
  • Service includes:
  • the DNS server receives the modified DNS query message sent by the distributed routing device, and the source IP address of the modified DNS query message is the first in the first VPC that sends the DNS query message. a NAT address corresponding to the virtual machine, where the modified DNS query message carries the domain name to be accessed by the first virtual machine;
  • the DNS server obtains an IP address corresponding to the domain name managed by the VPC according to the determined identifier of the VPC, and returns the obtained IP address to the first physical server.
  • the embodiment of the present invention establishes a correspondence between a NAT address and a VPC identifier in a DNS server, and distinguishes a VPC in which a different user is located by using a VPC identifier, so that the DNS server supports user isolation between different VPCs, and implements different VPCs for the data center. Correct resolution of the same domain name in the network.
  • the DNS server reads the NAT address in the NAT address pool allocated to the VPC from the storage device, and records the correspondence between the NAT address and the VPC identifier, where the storage device records The identifier of the VPC and the correspondence between the NAT address pools belonging to the VPC.
  • the corresponding relationship may be recorded in the form of an array.
  • the array includes an index and a VPC identifier.
  • the index is used to uniquely identify a NAT address.
  • the value of the index is the result of the AND operation of the NAT address and 100.64.0.0.
  • the DNS server When the DNS server does not query the IP address corresponding to the domain name, the DNS server sends a DNS query request to the Internet domain name server outside the data center system to obtain the public network IP address corresponding to the domain name, and Returning the public network IP address to the first virtual machine in the first physical server.
  • an embodiment of the present invention provides a data center system, where the system includes at least one physical server, a DNS server, and a distributed routing device, where each physical server runs at least one virtual machine, where the data center system
  • the virtual machines are respectively located in at least two virtual private cloud VPCs, wherein the at least two VPCs are hosted with the same domain name, and the same domain name points to different services in the at least two VPCs.
  • the first physical server in the data center system is configured to send a domain name system DNS query message sent by the first virtual machine running on the first physical server to the distributed routing device, where the DNS query report is sent.
  • the source IP address of the text is the local area network address of the first virtual machine in the first VPC, and the DNS query message carries the domain name to be accessed by the first virtual machine;
  • the distributed routing device is configured to receive the DNS query message, modify the source IP address of the DNS query message to a NAT address corresponding to the source IP address, and send the modified DNS query message to the The DNS server;
  • the DNS server is configured to receive the modified DNS query message, and determine, according to the correspondence between the NAT address and the VPC identifier, the identifier of the VPC where the first virtual machine is located, according to the determined identifier of the VPC, Obtaining an IP address corresponding to the domain name managed in the VPC, and returning the obtained IP address to the first physical server;
  • the first physical server is configured to send an access request that is sent by the first virtual machine according to the IP address, where the access request is used to access a service that the domain name points in the first VPC.
  • the system further includes a storage device, which is used to record a NAT address pool and a VPC identity belonging to the VPC when the VPC is created.
  • the embodiment of the present invention further provides a DNS server, where the DNS server includes a receiving unit, a receiving unit, and a sending unit, where each unit is used to execute a domain name. Analyze the method steps to implement domain name resolution.
  • the DNS server is implemented by a general purpose or dedicated physical server, and the physical server includes a processor, a memory, a system bus, and an input and output interface, and the processor is configured to support the system.
  • the input and output interface is for communicating with other components in the data center system, and the processor executes instructions stored in the memory.
  • an embodiment of the present invention provides a computer storage medium for storing computer software instructions used by the DNS server, including a program designed to perform the above aspects.
  • FIG. 1 is a schematic structural diagram of a data center system according to an embodiment of the present invention.
  • FIG. 2 is a schematic flowchart of a method for domain name resolution of a data center system according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of a logical structure of a DNS server according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a hardware structure of a DNS server according to an embodiment of the present invention.
  • the domain name is unique in the Internet, and the Internet domain name server (public network DNS server) provides Internet users with For domain name resolution services.
  • the Internet domain name server public network DNS server
  • users can establish a VPC and customize the domain name in the PVC.
  • the VPC is a logically isolated network space that is customized by the user in the data center system. It has the same capabilities as the traditional network. Users can fully master their own VPCs and perform various operations on the VPC, including custom network segmentation and IP address allocation. And routing strategy formulation, etc. Therefore, the same domain name can be applied to represent different services in different VPC networks, that is, the possibility that domain names are duplicated in the data center system.
  • User A establishes VPC1 in the data center system, and defines the domain name www.abc.com in VPC1 for website A with IP address 2.2.2.2;
  • User B establishes VPC2 in the data center system.
  • the domain name www.abc.com is defined in VPC2 and is used to point to website B with an IP address of 3.3.3.3.
  • the first virtual machine in VPC1 enters the domain name www.abc.com in the browser, and initiates a DNS query to the DNS server in the data center system, and the DNS server receives the domain name input by the first virtual machine in VPC1 www.abc.com
  • the VPC corresponding to the domain name www.abc.com cannot be determined, and the IP address corresponding to the domain name cannot be resolved, and the first virtual machine in VPC1 cannot access the website A.
  • the embodiment of the present invention provides a method for a domain name resolution service provided by a DNS server to a user virtual machine in a data center system, which can implement correct resolution of the same domain name in different VPC networks.
  • the correspondence between the network address translation (NAT) address of the user virtual machine and the VPC identifier is established, and the VPC is used to distinguish the VPCs of different users, thereby determining the IP address corresponding to the domain name managed in the VPC.
  • the address enables the DNS server to support user isolation between different VPCs, enabling correct resolution of the same domain name in different VPC networks.
  • FIG. 1 is a schematic structural diagram of a data center system according to an embodiment of the present invention.
  • the data center network includes a DNS server 101, a distributed routing device 102, and multiple physical servers 103.
  • the physical server 103 runs on the physical server 103.
  • VM virtual machine
  • the data center system includes at least two VPCs, and each VPC includes at least one virtual machine.
  • the virtual machine is connected to the DNS server 101 through the distributed routing device 102, and the DNS server 101 provides a domain name resolution service for the virtual machine.
  • VPCs are separated by two layers.
  • the MAC addresses of multiple VMs in the same VPC are different.
  • Multiple VMs in different VPCs can be configured as the same LAN address.
  • the LAN address of VM1 is 192.168.10.10
  • the LAN address of VM2 is 192.168.10.11
  • the LAN address of VM3 is 192.168.10.10
  • the LAN address of VM4 is 192.168.10.11.
  • the VMs in the VPC are connected to a distributed routing device 102, each VM being connected to a port of a distributed routing device whose IP address is the NAT address of the VM connected to the port.
  • the IP address of the port of the distributed routing device 102 to which VM1 is connected is 100.64.10.10
  • the IP address of the port of the distributed routing device 102 to which VM2 is connected is 100.64.10.11
  • the distributed routing device to which VM3 is connected
  • the IP address of the port of 102 is 100.64.10.10
  • the IP address of the port of the distributed routing device 102 to which VM4 is connected is 100.64.10.11.
  • the data center system further includes a storage device 104.
  • the storage device 104 records the correspondence between the NAT address pool allocated to the VPC and the VPC identifier.
  • the DNS server 101 can read and record the correspondence between the NAT address pool and the VPC identifier from the storage device 104.
  • the data center system is connected to the public domain name server 105 through the internet network.
  • the DNS server 101 in the data center system cannot query the IP address corresponding to the domain name
  • the DNS server forwards the DNS query message to the public domain name server.
  • the domain name resolution service is provided by the public domain name server.
  • the VM in the VPC initiates a DNS query message, where the DNS query message carries the domain name to be accessed by the VM, and the source IP address of the DNS query message is the LAN address of the VM.
  • the distributed routing device 102 receives the DNS query message and will The source IP address of the DNS query packet is modified to the IP address of the port connected to the VM.
  • the DNS server can only process DNS query messages.
  • the DNS query message cannot carry the VPC ID of the user.
  • the DNS server cannot distinguish which VPC the DNS query message is sent from.
  • the translated IP address belongs to a fixed IP address pool (exemplary, and the converted IP addresses are all in the range of 100.64.0.0 to 100.127. Within the range of 255.255), each IP address uniquely belongs to a VPC.
  • the LAN address of VM1 in VPC1 is 192.168.10.10
  • the LAN address of VM2 in VPC1 is 192.168.10.11.
  • the IP address corresponding to VM1 is 10.64.10.10
  • the address is 10.64.10.11.
  • the source IP address of the queried packet received by the DNS is the translated NAT address.
  • the DNS server can find the VPC to which the source virtual machine that sends the query message belongs by using the mapping between the source IP address and the VPC. The identification so that the DNS server can identify the VPC where the virtual machine is located.
  • mapping between the source IP address and the VPC identifier can be established in advance by the DNS server.
  • the corresponding relationship is as shown in Table 1:
  • the index is specifically a value obtained by performing an AND operation between a NAT address and 10.64.0.0.
  • the user notifies the DNS server to update the corresponding relationship.
  • the cloud computing management system allocates a corresponding NAT address pool to the created VPC, and records the correspondence between the VPC identifier and the NAT address pool in the database.
  • the DNS server can actively read the database and update the above correspondence recorded in the updated DNS server.
  • the DNS server may store the foregoing correspondence. Specifically, when the DNS service is started, the DNS server allocates a memory for the corresponding relationship, and stores the correspondence between the source IP address and the VPC identifier, and may be stored in an array manner. In a possible implementation manner, the upper limit of the capacity of the array can be set to 4 million, that is, the 4 million IPs included in the 100.64.0.0/10 network segment can be stored.
  • the DNS server may further allocate a namespace to each VPC, and use the VPC identifier as an identifier of the namespace, where the domain name corresponding to each domain name in the VPC corresponding to the namespace is recorded. IP address.
  • the DNS server receives the query packet, the identifier of the VPC where the virtual machine that sends the query message is located is determined according to the source IP address of the query packet, and the corresponding namespace is found by the determined VPC identifier, and the found namespace is found. Perform domain name resolution to determine the IP address corresponding to the domain name to be resolved.
  • the DNS server may provide a domain name resolution server for the data center system in the form of a server cluster.
  • Each virtual machine in the data center system accesses the DNS server cluster through the virtual IP address of the DNS server cluster, and after load balancing, selects A DNS server in the cluster performs the method for domain name resolution described in the embodiment of the present invention.
  • an embodiment of the present invention provides a method for domain name resolution in a data center system, where the method includes:
  • Step 201 The user logs in to the VM1, and the VM1 belongs to the VPC1.
  • the user opens the browser on the VM1 and enters the domain name to be accessed.
  • the VM1 initiates a domain name query operation, and sends a DNS query message to the DNS server, where the DNS query message is used.
  • the DNS server is instructed to parse the domain name to be accessed.
  • the domain name to be accessed is www.abc.com
  • the LAN address of VM1 is 192.168.10.11.
  • Step 202 The distributed routing device receives the DNS query packet through the port connected to the VM1, performs NAT translation on the DNS query packet, and modifies the source IP address of the DNS query packet to a corresponding NAT address.
  • the NAT address is the IP address of the port connected to the VM1
  • the destination address of the DNS query message is the virtual IP address of the DNS server.
  • the NAT address corresponding to VM1 is 100.64.10.11.
  • Step 203 The distributed routing device sends the DNS query message to the DNS server.
  • Step 204 The DNS server receives the DNS query message, and the DNS server determines the identifier of the VPC where the VM1 is located according to the correspondence between the NAT address and the VPC identifier.
  • the DNS server records the correspondence between the NAT address and the VPC identifier, that is, the DNS server can determine the VPC of the VM that sends the DNS query message according to the NAT address carried in the source address of the DNS query message.
  • the system allocates a NAT address pool to the VPC, and each VM in the VPC is assigned a NAT address in the NAT address pool.
  • the DNS server obtains the NAT address pool corresponding to each VPC and records the mapping between the NAT address and the VPC ID.
  • Step 205 The DNS server obtains an IP address corresponding to the domain name to be accessed carried in the DNS query message according to the determined identifier of the VPC where the VM1 is located.
  • the DNS server separately establishes a domain name resolution table for each VPC, where the domain name resolution table includes a domain name and an IP address corresponding to the domain name.
  • the DNS server searches for the domain name resolution table of the VPC according to the identifier of the VPC in which the VM1 is located, and obtains an IP address corresponding to the domain name to be accessed.
  • the DNS server may further allocate a namespace to each VPC, and record, in the namespace, a correspondence between a domain name hosted in the VPC and an IP address of a service to which the domain name is directed;
  • the step 205 is specifically: the DNS server queries the IP address corresponding to the domain name carried in the DNS query message in the namespace corresponding to the identifier of the VPC.
  • Step 206 The DNS server returns the IP address corresponding to the domain name to be accessed in VPC1 to VM1.
  • the IP address corresponding to the domain to be accessed in VPC1 is 2.2.2.2.
  • the VM1 obtains an IP address corresponding to the domain name to be accessed, and sends an access request, where the destination address of the access request is an IP address corresponding to the domain name to be accessed, and the access request is used to access the domain name in the first A service pointed to by a VPC.
  • step 207 is performed.
  • Step 207 The DNS server initiates a domain name query request to the Internet domain name server.
  • Step 208 The DNS server receives the IP address corresponding to the domain name to be accessed returned by the Internet domain name server, and returns the received IP address to VM1.
  • Step 209 The VM1 receives the IP address, and initiates a service request to a server corresponding to the IP address.
  • the DNS server determines the VPC ID of the VM2 to which the DNS query message belongs according to the source address carried in the DSN query message. The IP address corresponding to the domain name in the VPC.
  • the correspondence between the NAT address of the user virtual machine and the VPC identifier is established, and the VPC is used to distinguish the VPCs of different users, and then the IP address corresponding to the domain name managed in the VPC is determined, thereby implementing the DNS server support user. Isolation between different VPCs enables correct resolution of the same domain name in different VPC networks.
  • the DNS server may allocate different namespaces for different VPCs, and after determining the VPC of the virtual machine that sends the DNS query message, query the IP address corresponding to the domain name in the namespace corresponding to the VPC, thereby implementing User isolation.
  • FIG. 3 is a schematic structural diagram of a DNS server according to an embodiment of the present invention.
  • the DNS server includes a receiving unit 301, a processing unit 302, and a sending unit 303.
  • the function modules 301-33 implement the implementation corresponding to FIG. 2.
  • the functions of the DNS server are implemented to provide domain name resolution services for VMs in the VPC. Specifically,
  • the receiving unit 301 is configured to receive the modified DNS query message sent by the distributed routing device, where the source IP address of the modified DNS query message is the first in the first VPC that sends the DNS query message. a NAT address corresponding to the virtual machine, where the modified DNS query message carries the domain name to be accessed by the first virtual machine;
  • the processing unit 302 is configured to determine, according to the correspondence between the NAT address and the VPC identifier, the identifier of the VPC where the first virtual machine is located, and obtain the domain name corresponding to the domain name managed by the VPC according to the determined identifier of the VPC. IP address;
  • the sending unit 303 is configured to return the obtained IP address to the first virtual machine.
  • the processing unit 302 is configured to read the NAT address pool of each VPC and the identifier of the VPC corresponding to the NAT address pool from the storage device, and record the correspondence between the NAT address and the VPC identifier.
  • the processing unit 302 is specifically configured to create an array, where the array includes an index and a VPC identifier, and the index is used to uniquely identify a NAT address.
  • the processing unit 302 is specifically configured to allocate a namespace to each VPC, and record, in the namespace, a correspondence between a domain name managed in the VPC and an IP address of a service that provides the domain name.
  • the processing unit 302 is configured to: after the receiving unit receives the modified DNS query message, query the carried in the DNS query message in a namespace corresponding to the identifier of the VPC.
  • the IP address corresponding to the domain name is configured to: after the receiving unit receives the modified DNS query message, query the carried in the DNS query message in a namespace corresponding to the identifier of the VPC. The IP address corresponding to the domain name.
  • the sending unit 303 is further configured to: when the processing unit does not query the IP address corresponding to the domain name, send a DNS query request to an Internet domain name server outside the data center system;
  • the receiving unit 301 is further configured to obtain a public network IP address corresponding to the domain name returned by the Internet domain name server;
  • the sending unit 303 is further configured to return the public network IP address to the first virtual machine.
  • the DNS server may be a dedicated or general-purpose physical server.
  • FIG. 4 is a schematic block diagram of the DNS server 400 according to an embodiment of the present invention.
  • the DNS server 400 includes a processor and a transceiver coupled to the transceiver.
  • the server 400 further includes a memory coupled to the processor.
  • the server 400 includes a bus system.
  • the processor, the memory and the transceiver can be connected by a bus system, the memory can be used to store instructions for executing the instructions stored by the memory to control the transceiver to receive information or signals, so that the server 400 executes the data center
  • the processor in the embodiment of the present invention may be an integrated circuit chip with signal processing capability.
  • each step of the foregoing method embodiments may be completed by an integrated logic circuit of hardware in a processor or an instruction in a form of software.
  • the processor may be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a Field Programmable Gate Array (FPGA), or the like. Programming logic device.
  • DSP digital signal processor
  • ASIC application specific integrated circuit
  • FPGA Field Programmable Gate Array
  • Programming logic device Programming logic device.
  • the methods, steps, and logical block diagrams disclosed in the embodiments of the present invention may be implemented or carried out.
  • the general purpose processor may be a microprocessor or the processor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present invention may be directly implemented by the hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a random access memory, a flash memory, a read only memory, a programmable read only memory or an electrically erasable programmable memory, a register, etc.
  • the storage medium is located in the memory, and the processor reads the information in the memory and combines the hardware to complete the steps of the above method.
  • the memory or storage device in an embodiment of the invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory.
  • the non-volatile memory may be a read-only memory (ROM), a programmable read only memory (PROM), an erasable programmable read only memory (Erasable PROM, EPROM), or an electric Erase programmable read only memory (EEPROM) or flash memory.
  • the volatile memory can be a Random Access Memory (RAM) that acts as an external cache.
  • RAM Random Access Memory
  • many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (Synchronous DRAM).
  • SDRAM Double Data Rate SDRAM
  • DDR SDRAM Double Data Rate SDRAM
  • ESDRAM Enhanced Synchronous Dynamic Random Access Memory
  • SLDRAM Synchronous Connection Dynamic Random Access Memory
  • DR RAM direct memory bus random access memory
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.
  • each functional unit in the embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种数据中心系统中域名解析的方法、装置和系统，所述系统包括至少一个物理服务器、DNS服务器以及分布式路由设备，各物理服务器上运行有至少一个虚拟机，所述数据中心系统中的虚拟机分别位于至少两个虚拟私有云VPC中，所述至少两个VPC中托管有相同的域名，所述相同的域名在所述至少两个VPC中指向不同的服务，DNS服务器建立用户虚拟机的NAT地址与VPC标识的对应关系，通过VPC标识来区分不同用户所在的VPC，进而确定VPC中托管的域名对应的IP地址。

Description

数据中心系统中域名解析的方法、装置和系统 技术领域
本发明涉及IT技术领域，尤其涉及数据中心系统中域名解析的方法、装置和系统。
背景技术
域名系统(domain name system，DNS)是因特网上实现域名和IP地址相互映射的系统。当用户访问互联网时，用户不需要直接使用能够被机器读取的IP地址进行访问，用户只需要输入主机域名，由DNS系统进行域名解析操作获得该主机域名对应的IP地址，用户即可访问该IP地址。
虚拟私有云(virtual private cloud，VPC)是用户在数据中心网络中创建的自定义私有网络,不同的虚拟私有云之间二层逻辑隔离，用户可以管理自己的虚拟私有云的网络，在虚拟私有云中创建和管理云产品实例，例如划分网段、配置路由表和网关等等。
由于用户可以自主对VPC网络进行配置和管理，因此，在不同的VPC网络中，不同的用户配置的域名可能会重复。示例性的，用户A配置VPC1网络中域名www.abc.com对应的IP地址为2.2.2.2，用户B配置VPC2网络中域名www.abc.com对应的IP地址为3.3.3.3。此时，由于存在域名重复的情况，数据中心内的DNS服务器进行域名解析时，无法将相同域名对应的不同IP地址返回给不同的用户。
发明内容
本发明实施例描述了一种数据中心系统中域名解析的方法、装置和系统，避免数据中心系统中不同VPC存在域名重复的情况下DNS服务器无法正确进行域名解析的问题。
一方面，本发明实施例提供了一种数据中心系统中进行域名解析的方法，所述数据中心系统包括至少一个物理服务器、DNS服务器以及分布式路由设备，各物理服务器上运行有至少一个虚拟机，所述数据中心系统中的虚拟机分别位于至少两个虚拟私有云VPC中，所述至少两个VPC中托管有相同的域名，所述相同的域名在所述至少两个VPC中指向不同的服务，所述方法包括：
所述DNS服务器接收所述分布式路由设备发送的修改后的DNS查询报文，所述修改后的DNS查询报文的源IP地址为发出所述DNS查询报文的第一VPC中的第一虚拟机对应的NAT地址，所述修改后的DNS查询报文携带所述第一虚拟机待访问的域名；
所述DNS服务器根据NAT地址与VPC标识的对应关系，确定所述第一虚拟机所在的VPC的标识；
所述DNS服务器根据确定的所述VPC的标识，获取所述VPC中托管的所述域名对应的IP地址，并将获取的IP地址返回给所述第一物理服务器。
本发明实施例通过在DNS服务器建立NAT地址与VPC标识的对应关系，通过VPC标识来区分不同用户所在的VPC，从而实现DNS服务器支持用户在不同VPC之间的隔离，实现针对数据中心内部不同VPC网络中相同域名的正确解析。
在一种可能的实施方式中，所述DNS服务器从存储设备中读取分配给VPC的NAT地址池中的NAT地址，记录所述NAT地址与VPC标识的对应关系，所述存储设备中记录有VPC的标识以及归属在所述VPC的NAT地址池的对应关系。
所述对应关系可以采用数组的形式进行记录，具体的，所述数组包括索引和VPC标识， 所述索引用于唯一标识一个NAT地址。所述索引的取值为NAT地址跟100.64.0.0做与运算得到的结果。通过上述索引，可以提高查询的效率。
当DNS服务器在本地未查询到所述域名对应的IP地址时，进一步的，所述DNS服务器向数据中心系统外的互联网域名服务器发送DNS查询请求，获取所述域名对应的公网IP地址，并将所述公网IP地址返回给所述第一物理服务器中的第一虚拟机。
第二方面，本发明实施例提供了一种数据中心系统，所述系统包括至少一个物理服务器、DNS服务器以及分布式路由设备，各物理服务器上运行有至少一个虚拟机，所述数据中心系统中的虚拟机分别位于至少两个虚拟私有云VPC中，所述至少两个VPC中托管有相同的域名，所述相同的域名在所述至少两个VPC中指向不同的服务，
所述数据中心系统中的第一物理服务器，用于将所述第一物理服务器上运行的第一虚拟机发出的域名系统DNS查询报文发送到所述分布式路由设备，所述DNS查询报文的源IP地址为所述第一虚拟机在第一VPC中的局域网地址，所述DNS查询报文携带所述第一虚拟机待访问的域名；
所述分布式路由设备，用于接收所述DNS查询报文，将所述DNS查询报文的源IP地址修改为所述源IP地址对应的NAT地址，将修改后的DNS查询报文发送给所述DNS服务器；
所述DNS服务器，用于接收所述修改后的DNS查询报文，根据NAT地址与VPC标识的对应关系，确定所述第一虚拟机所在的VPC的标识，根据确定的所述VPC的标识，获取所述VPC中托管的所述域名对应的IP地址，并将获取的IP地址返回给所述第一物理服务器；
所述第一物理服务器，用于发送所述第一虚拟机根据所述IP地址发出的访问请求，所述访问请求用于访问所述域名在所述第一VPC中指向的服务。
所述系统还包括存储设备，所述存储设备，在VPC被创建时，用于记录归属所述VPC的NAT地址池以及VPC标识。
第三方面，与前述第一方面的域名解析的方法相对应，本发明实施例还提供了一种DNS服务器，所述DNS服务器包括接收单元、接收单元以及发送单元，上述各单元用于执行域名解析中的方法步骤，实现域名解析。
在一个可能的设计中，所述DNS服务器由通用或专用的物理服务器实现，物理服务器的结构中包括处理器、存储器、系统总线以及输入输出接口，所述处理器被配置为支持所述系统中DNS服务器的相应的功能。所述输入输出接口用于与所述数据中心系统中的其他部件进行通信，处理器执行所述存储器中存储的指令。
再一方面，本发明实施例提供了一种计算机存储介质，用于储存为上述DNS服务器所用的计算机软件指令，其包含用于执行上述方面所设计的程序。
附图说明
图1是本发明实施例提供的数据中心系统的结构示意图；
图2是本发明实施例提供的数据中心系统的域名解析的方法流程示意图；
图3是本发明实施例提供的一种DNS服务器的逻辑结构示意图；
图4是本发明实施例提供的一种DNS服务器的硬件结构示意图。
具体实施方式
Internet网络中域名唯一，互联网域名服务器(公网DNS服务器)向Internet用户提 供域名解析服务。数据中心网络中，用户可以建立VPC，在PVC中自定义域名。VPC为用户在数据中心系统中自定义的逻辑隔离网络空间，具备与传统网络相似的能力，用户可以完全掌握归属自己的VPC，对VPC执行各种操作，包括自定义网段划分、IP地址分配和路由策略制定等。因此，同一域名可以应用在不同的VPC网络中代表不同的服务，即域名在数据中心系统中存在重复的可能性。
示例性的，用户A在数据中心系统中建立VPC1，在VPC1中定义了域名www.abc.com，用于指向IP地址为2.2.2.2的网站A；用户B在数据中心系统中建立VPC2，在VPC2中定义了域名www.abc.com，用于指向IP地址为3.3.3.3的网站B。VPC1中的第一虚拟机在浏览器中输入域名www.abc.com，向数据中心系统中的DNS服务器发起DNS查询，DNS服务器接收到VPC1中的第一虚拟机输入的域名www.abc.com，无法确定域名www.abc.com对应的VPC，进而无法解析出域名对应的IP地址，导致VPC1中的第一虚拟机无法访问网站A。
为解决上述问题，本发明实施例提供了一种数据中心系统中DNS服务器向用户虚拟机提供域名解析服务的方法，可以实现针对不同VPC网络中相同域名的正确解析。本发明实施例中，建立用户虚拟机的网络地址转换(network address translation，NAT)地址与VPC标识的对应关系，通过VPC标识来区分不同用户所在的VPC，进而确定VPC中托管的域名对应的IP地址，从而实现DNS服务器支持用户在不同VPC之间的隔离，实现针对不同VPC网络中相同域名的正确解析。
下面将结合附图，对本发明实施例中的技术方案进行描述。
如图1所示，为本发明实施例提供的一种数据中心系统的结构示意图，所述数据中心网络包括DNS服务器101、分布式路由设备102以及多个物理服务器103，物理服务器103上运行有VM(virtual machine,虚拟机)，数据中心系统中包含至少两个VPC，每个VPC中包含至少一个虚拟机。虚拟机通过分布式路由设备102连接到DNS服务器101，由DNS服务器101为虚拟机提供域名解析服务。
不同的VPC之间为二层隔离，同一VPC中的多个VM的局域网地址不同，不同VPC中的多个VM可以配置为相同的局域网地址。示例性的，在VPC1中,VM1的局域网地址为192.168.10.10，VM2的局域网地址为192.168.10.11；在VPC2中，VM3的局域网地址为192.168.10.10，VM4的局域网地址为192.168.10.11。
VPC中的VM与分布式路由设备102相连，每个VM连接到分布式路由设备的一个端口，该端口的IP地址为与该端口相连的VM的NAT地址。示例性的，VM1连接到的分布式路由设备102的端口的IP地址为100.64.10.10，VM2连接到的分布式路由设备102的端口的IP地址为100.64.10.11，VM3连接到的分布式路由设备102的端口的IP地址为100.64.10.10，VM4连接到的分布式路由设备102的端口的IP地址为100.64.10.11。
所述数据中心系统还包括存储设备104，用户在数据中心系统中创建VPC时，在所述存储设备104中记录分配给该VPC的NAT地址池与该VPC标识的对应关系。所述DNS服务器101可以从所述存储设备104中读取并记录NAT地址池与VPC标识的对应关系。
所述数据中心系统通过internet网络与公网域名服务器105相连，当数据中心系统中的所述DNS服务器101无法查询到域名对应的IP地址时，DNS服务器将DNS查询报文转发给公网域名服务器，由公网域名服务器提供域名解析服务。
VPC中的VM发起DNS查询报文，所述DNS查询报文携带所述VM待访问的域名，所述DNS查询报文的源IP地址为VM的局域网地址。分布式路由设备102接收所述DNS查询报文，将 DNS查询报文的源IP地址修改为与所述VM相连的端口的IP地址
DNS服务器只能处理DNS查询报文，DNS查询报文无法携带用户所在的VPC标识，DNS服务器即无法区分DNS查询报文是从哪个VPC发出的。在云计算网络中，VPC中的虚拟机发出的报文在进行NAT转换时，转换为的IP地址属于固定的IP地址池(示例性的，转换得到的IP地址均在100.64.0.0至100.127.255.255范围内)，每个IP地址唯一属于某个VPC。如图1中所示，VPC1中的VM1的局域网地址为192.168.10.10，VPC1中的VM2的局域网地址为192.168.10.11，经NAT转换后，VM1对应的IP地址为10.64.10.10，VM2对应的IP地址为10.64.10.11。DNS接收到的查询报文的源IP地址为转换后的NAT地址，在本发明实施例中，DNS服务器可以通过源IP地址与VPC的对应关系，查找发出查询报文的源虚拟机所属的VPC的标识，从而使得DNS服务器可以识别虚拟机所在的VPC。
DNS服务器可以预先建立了源IP地址与VPC标识的对应关系，示例性的，所述对应关系如表1所示：
Index 源IP地址 VPC ID
0 10.64.0.0 078bd1cd-870d-4b3f-81d9-23652634a1cb
1 10.64.0.1 078bd1cd-870d-4b3f-81d9-23652634a1cb
2 10.64.0.2 0904a117-c9f9-4193-82bc-2e92064c6127
3 10.64.0.3 091d1c82-2a6b-49e6-8083-0644cc2c94b2
…..   …..
表1
所述索引具体为NAT地址与10.64.0.0做与运算得到的数值。
进一步的，用户在创建VPC时，通知DNS服务器更新上述对应关系。具体的，用户在创建VPC时，云计算管理系统为创建的VPC分配对应的NAT地址池，在数据库中记录VPC标识和NAT地址池的对应关系。DNS服务器可以主动读取数据库，并更新更新DNS服务器中记录的上述对应关系。
DNS服务器可以存储上述对应关系，具体的，在DNS服务启动时，DNS服务器为上述对应关系分配内存，用于存储上述源IP地址与VPC标识的对应关系，具体可以采用数组的方式进行存储。在一种可能的实施方式中，数组的容量上限可以设置为400万，即可存储100.64.0.0/10网段所包含的400万个IP。
在一种可能的实施方式中，DNS服务器还可以为每个VPC分配一个命名空间，将VPC标识作为命名空间的标识，该命名空间中记录有与该命名空间对应的VPC中的每个域名对应的IP地址。当DNS服务器收到查询报文时，根据查询报文的源IP地址确定发出所述查询报文的虚拟机所在的VPC的标识，通过确定的VPC标识找到对应的命名空间，在找到的命名空间中进行域名解析，从而确定待解析域名对应的IP地址。
在一种实施方式中，DNS服务器可能采用服务器集群的形式为数据中心系统提供域名解析服务器，数据中心系统中的各虚拟机通过DNS服务器集群的虚拟IP访问DNS服务器集群，经过负载均衡后，选择集群中的某个DNS服务器执行本发明实施例描述的域名解析的方法。
如图2所述，基于图1所示的系统结构，本发明实施例提供了一种数据中心系统中域名解析的方法，所述方法包括：
步骤201：用户登录VM1，所述VM1归属于VPC1，用户打开VM1上的浏览器，输入待访问的域名,VM1发起域名查询操作，向DNS服务器发送DNS查询报文，所述DNS查询报文用于指示所述DNS服务器对待访问域名进行解析。
示例性的，该待访问的域名为www.abc.com,VM1的局域网地址为192.168.10.11。
步骤202：分布式路由设备通过与VM1相连的端口接收所述DNS查询报文，对所述DNS查询报文进行NAT转换，将所述DNS查询报文的源IP地址修改为对应的NAT地址，所述NAT地址即为与所述VM1相连的所述端口的IP地址，所述DNS查询报文的目的地址为所述DNS服务器的虚拟IP地址。示例性的，VM1对应的NAT地址为100.64.10.11。
步骤203：分布式路由设备向所述DNS服务器发送所述DNS查询报文。
步骤204：所述DNS服务器接收所述DNS查询报文，所述DNS服务器根据NAT地址与VPC标识的对应关系，确定所述VM1所在的VPC的标识；
所述DNS服务器记录有NAT地址与VPC标识的对应关系，即所述DNS服务器可以根据DNS查询报文的源地址中携带的NAT地址，确定发出所述DNS查询报文的VM所述的VPC。
在一种实施方式中，用户在创建VPC时，系统会为VPC分配NAT地址池，VPC中的每个VM都会分配有NAT地址池中的NAT地址。DNS服务器在VPC创建完成后，获取每个VPC对应的NAT地址池，并记录NAT地址与VPC标识的对应关系。
步骤205：所述DNS服务器根据确定的所述VM1所在的VPC的标识，获取所述DNS查询报文携带的待访问域名对应的IP地址。
在一种实施方式中，所述DNS服务器为每个VPC分别建立域名解析表，所述域名解析表包括域名以及域名对应的IP地址。所述DNS服务器根据确定所述VM1所在的VPC的标识查找所述VPC的域名解析表，获取待访问域名对应的IP地址。
更进一步的，所述DNS服务器，还可以为每一个VPC分配一个命名空间，在所述命名空间中记录所述VPC中托管的域名与提供该域名指向的服务的IP地址的对应关系；
所述步骤205具体为：所述DNS服务器在确定的所述VPC的标识对应的命名空间中，查询所述DNS查询报文中携带的域名对应的IP地址。
步骤206：DNS服务器向VM1返回VPC1中待访问域名对应的IP地址，示例性的，VPC1中待访问域名对应的IP地址为2.2.2.2。
所述VM1获取所述待访问域名对应的IP地址，发送访问请求，所述访问请求的目的地址为所述待访问域名对应的IP地址，所述访问请求用于访问所述域名在所述第一VPC中指向的服务。
需要说明的是，当待访问域名不是数据中心网络中的DNS服务器上托管的域名，而是internet网络中的公网域名时，则DNS服务器无法查询到VPC1中待访问域名对应的IP地址，此时，执行步骤207。
步骤207：DNS服务器向互联网域名服务器发起域名查询请求。
步骤208：DNS服务器接收到互联网域名服务器返回的待访问域名对应的IP地址，将接收到的所述IP地址返回给VM1。
步骤209：VM1接收所述IP地址，向所述IP地址对应的服务器发起服务请求。
与前述域名解析的过程类似，当VPC2中的VM2向DNS服务器发起DNS查询时，DNS服务器根据DSN查询报文中携带的源地址确定发出所述DNS查询报文的VM2所属的VPC的标识，获取该VPC中的域名对应的IP地址。
本发明实施例中，建立用户虚拟机的NAT地址与VPC标识的对应关系，通过VPC标识来区分不同用户所在的VPC，进而确定VPC中托管的域名对应的IP地址，从而实现DNS服务器支持用户在不同VPC之间的隔离，实现针对不同VPC网络中相同域名的正确解析。
更进一步的，DNS服务器可以为不同的VPC分配不同的命名空间，在确定发出DNS查询报文的虚拟机所述的VPC后，在该VPC对应的命名空间中查询域名对应的IP地址，从而实现了用户隔离。
如图3所示，为本发明实施例提供的一种DNS服务器的结构示意图，所述DNS服务器包括接收单元301、处理单元302以及发送单元303，上述功能模块301-303执行图2对应的实施例中DNS服务器的各项功能，实现为VPC中的VM提供域名解析服务，具体的，
接收单元301，用于接收分布式路由设备发送的修改后的DNS查询报文，所述修改后的DNS查询报文的源IP地址为发出所述DNS查询报文的第一VPC中的第一虚拟机对应的NAT地址，所述修改后的DNS查询报文携带所述第一虚拟机待访问的域名；
处理单元302，用于根据NAT地址与VPC标识的对应关系，确定所述第一虚拟机所在的VPC的标识，根据确定的所述VPC的标识，获取所述VPC中托管的所述域名对应的IP地址；
发送单元303，用于将获取的IP地址返回给所述第一虚拟机。
所述处理单元302，具体用于从存储设备中读取各VPC的NAT地址池以及NAT地址池对应的VPC的标识，记录NAT地址与VPC标识的对应关系。
所述处理单元302，具体用于建立数组，所述数组包括索引和VPC标识，所述索引用于唯一标识一个NAT地址。
所述处理单元302，具体用于为每一个VPC分配一个命名空间，在所述命名空间中记录所述VPC中托管的域名与提供该域名指向的服务的IP地址的对应关系；
所述处理单元302，具体用于所述接收单元接收到所述修改后的DNS查询报文后，在确定的所述VPC的标识对应的命名空间中，查询所述DNS查询报文中携带的域名对应的IP地址。
所述发送单元303，还用于在处理单元未查询到所述域名对应的IP地址时，向数据中心系统外的互联网域名服务器发送DNS查询请求；
所述接收单元301，还用于获取互联网域名服务器返回的所述域名对应的公网IP地址；
所述发送单元303，还用于将所述公网IP地址返回给所述第一虚拟机。
所述DNS服务器具体可以为专用或者通用的物理服务器，图4是本发明实施例的DNS服务器400的示意性框图。该DNS服务器400包括：处理器和收发器，处理器和收发器相连，可选地，该服务器400还包括存储器，存储器与处理器相连，进一步可选地，该服务器400包括总线系统。其中，处理器、存储器和收发器可以通过总线系统相连，该存储器可以用于存储指令，该处理器用于执行该存储器存储的指令，以控制收发器接收信息或信号，使得服务器400执行上述数据中心系统中DNS服务器的功能、所执行的各动作或处理过程。
本发明实施例中的处理器可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(Digital Signal Processor，DSP)、专用集成电路(Application Specific Integrated Circuit，ASIC)、现成可编程门阵列(Field Programmable Gate Array，FPGA)或者其他可编程逻辑器件。可以实现或者执行本发明实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本发明实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本 领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
本发明实施例中的存储器或存储设备可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(Read-Only Memory，ROM)、可编程只读存储器(Programmable ROM，PROM)、可擦除可编程只读存储器(Erasable PROM，EPROM)、电可擦除可编程只读存储器(Electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(Random Access Memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(Static RAM，SRAM)、动态随机存取存储器(Dynamic RAM，DRAM)、同步动态随机存取存储器(Synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(Double Data Rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(Enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(Synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(Direct Rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本发明实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
以上所述，仅为本发明实施例的具体实施方式，但本发明实施例的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明实施例揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明实施例的保护范围之内。因此，本发明实施例的保护范围应以所述权利要求的保护范围为准。

Claims (18)

  1. 一种数据中心系统，其特征在于，所述系统包括至少一个物理服务器、DNS服务器以及分布式路由设备，各物理服务器上运行有至少一个虚拟机，所述数据中心系统中的虚拟机分别位于至少两个虚拟私有云VPC中，所述至少两个VPC中托管有相同的域名，所述相同的域名在所述至少两个VPC中指向不同的服务，
    所述数据中心系统中的第一物理服务器，用于将所述第一物理服务器上运行的第一虚拟机发出的域名系统DNS查询报文发送到所述分布式路由设备，所述DNS查询报文的源IP地址为所述第一虚拟机在第一VPC中的局域网地址，所述DNS查询报文携带所述第一虚拟机待访问的域名；
    所述分布式路由设备，用于接收所述DNS查询报文，将所述DNS查询报文的源IP地址修改为所述源IP地址对应的NAT地址，将修改后的DNS查询报文发送给所述DNS服务器；
    所述DNS服务器，用于接收所述修改后的DNS查询报文，根据NAT地址与VPC标识的对应关系，确定所述第一虚拟机所在的VPC的标识，根据确定的所述VPC的标识，获取所述VPC中托管的所述域名对应的IP地址，并将获取的IP地址返回给所述第一物理服务器；
    所述第一物理服务器，用于发送所述第一虚拟机根据所述IP地址发出的访问请求，所述访问请求用于访问所述域名在所述第一VPC中指向的服务。
  2. 如权利要求1所述的系统，其特征在于，还包括存储设备，
    所述存储设备，在VPC被创建时，用于记录归属所述VPC的NAT地址池以及VPC标识。
  3. 如权利要求2所述的系统，其特征在于，
    所述DNS服务器，还用于从所述存储设备中读取各VPC的NAT地址池以及NAT地址池对应的VPC的标识，记录NAT地址与VPC标识的对应关系。
  4. 如权利要求3所述的系统，其特征在于，
    所述DNS服务器，还用于建立数组，所述数组包括索引和VPC标识，所述索引用于唯一标识一个NAT地址。
  5. 如权利要求1-4任一所述的系统，其特征在于，
    所述DNS服务器，还用于为每一个VPC分配一个命名空间，在所述命名空间中记录所述VPC中托管的域名与提供该域名指向的服务的IP地址的对应关系；
    所述DNS服务器，具体用于在确定的所述VPC的标识对应的命名空间中，查询所述DNS查询报文中携带的域名对应的IP地址。
  6. 如权利要求1-5任一所述的系统，其特征在于，
    所述DNS服务器，还用于在本地未查询到所述域名对应的IP地址时，向数据中心系统外的互联网域名服务器发送DNS查询请求，获取所述域名对应的公网IP地址，并将所述公网IP地址返回给所述第一物理服务器中的第一虚拟机。
  7. 一种数据中心系统中进行域名解析的方法，其特征在于，所述系统包括至少一个物理服务器、DNS服务器以及分布式路由设备，各物理服务器上运行有至少一个虚拟机，所述数据中心系统中的虚拟机分别位于至少两个虚拟私有云VPC中，所述至少两个VPC中托管有相同的域名，所述相同的域名在所述至少两个VPC中指向不同的服务，所述方法包括：
    所述DNS服务器接收所述分布式路由设备发送的修改后的DNS查询报文，所述修改后的 DNS查询报文的源IP地址为发出所述DNS查询报文的第一VPC中的第一虚拟机对应的NAT地址，所述修改后的DNS查询报文携带所述第一虚拟机待访问的域名；
    所述DNS服务器根据NAT地址与VPC标识的对应关系，确定所述第一虚拟机所在的VPC的标识；
    所述DNS服务器根据确定的所述VPC的标识，获取所述VPC中托管的所述域名对应的IP地址，并将获取的IP地址返回给所述第一物理服务器。
  8. 如权利要求7所述的方法，其特征在于，所述方法还包括：
    所述DNS服务器从存储设备中读取各VPC的NAT地址池以及NAT地址池对应的VPC的标识，记录NAT地址与VPC标识的对应关系，所述存储设备中记录有VPC的标识以及归属在所述VPC的NAT地址池的对应关系。
  9. 如权利要求8所述的方法，其特征在于，所述方法还包括：
    所述DNS服务器建立数组，所述数组包括索引和VPC标识，所述索引用于唯一标识一个NAT地址。
  10. 如权利要求7-9任一所述的方法，其特征在于，
    所述方法还包括：所述DNS服务器为每一个VPC分配一个命名空间，在所述命名空间中记录所述VPC中托管的域名与提供该域名指向的服务的IP地址的对应关系；
    所述DNS服务器获取所述VPC中托管的所述域名对应的IP地址包括：所述DNS服务器在确定的所述VPC的标识对应的命名空间中，查询所述DNS查询报文中携带的域名对应的IP地址。
  11. 如权利要求7-10任一所述的方法，其特征在于，还包括：
    所述DNS服务器在本地未查询到所述域名对应的IP地址时，向数据中心系统外的互联网域名服务器发送DNS查询请求，获取所述域名对应的公网IP地址，并将所述公网IP地址返回给所述第一物理服务器中的第一虚拟机。
  12. 一种DNS服务器，其特征在于，包括：
    接收单元，用于接收分布式路由设备发送的修改后的DNS查询报文，所述修改后的DNS查询报文的源IP地址为发出所述DNS查询报文的第一VPC中的第一虚拟机对应的NAT地址，所述修改后的DNS查询报文携带所述第一虚拟机待访问的域名；
    处理单元，用于根据NAT地址与VPC标识的对应关系，确定所述第一虚拟机所在的VPC的标识，根据确定的所述VPC的标识，获取所述VPC中托管的所述域名对应的IP地址；
    发送单元，用于将获取的IP地址返回给所述第一虚拟机。
  13. 如权利要求12所述的服务器，其特征在于，
    所述处理单元，具体用于从存储设备中读取各VPC的NAT地址池以及NAT地址池对应的VPC的标识，记录NAT地址与VPC标识的对应关系。
  14. 如权利要求13所述的服务器，其特征在于，
    所述处理单元，具体用于建立数组，所述数组包括索引和VPC标识，所述索引用于唯一标识一个NAT地址。
  15. 如权利要求12-14任一所述的服务器，其特征在于，
    所述处理单元，具体用于为每一个VPC分配一个命名空间，在所述命名空间中记录所述VPC中托管的域名与提供该域名指向的服务的IP地址的对应关系；
    所述处理单元，具体用于所述接收单元接收到所述修改后的DNS查询报文后，在确定的 所述VPC的标识对应的命名空间中，查询所述DNS查询报文中携带的域名对应的IP地址。
  16. 如权利要求12-15任一所述的服务器，其特征在于，
    所述发送单元，还用于在处理单元未查询到所述域名对应的IP地址时，向数据中心系统外的互联网域名服务器发送DNS查询请求；
    所述接收单元，还用于获取互联网域名服务器返回的所述域名对应的公网IP地址；
    所述发送单元，还用于将所述公网IP地址返回给所述第一虚拟机。
  17. 一种NDS服务器，其特征在于，包括处理器和存储器，所述存储器中存储有指令，所述处理器执行所述存储器中的指令以使得所述DNS服务器执行权利要求7-11任一所述的方法。
  18. 一种计算机存储介质，其特征在于，所述存储介质内存储有计算机程序，所述计算机程序被处理器执行时实现权利要求7-11任一所述的方法中的步骤。
PCT/CN2017/105686 2017-10-11 2017-10-11 数据中心系统中域名解析的方法、装置和系统 WO2019071464A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
PCT/CN2017/105686 WO2019071464A1 (zh) 2017-10-11 2017-10-11 数据中心系统中域名解析的方法、装置和系统
CN202110824843.3A CN113726918B (zh) 2017-10-11 2017-10-11 基于云计算网络的域名解析方法及相关系统和装置
CN201780095877.5A CN111213348B (zh) 2017-10-11 2017-10-11 数据中心系统中域名解析的方法、装置和系统

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/105686 WO2019071464A1 (zh) 2017-10-11 2017-10-11 数据中心系统中域名解析的方法、装置和系统

Publications (1)

Publication Number Publication Date
WO2019071464A1 true WO2019071464A1 (zh) 2019-04-18

Family

ID=66100305

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/105686 WO2019071464A1 (zh) 2017-10-11 2017-10-11 数据中心系统中域名解析的方法、装置和系统

Country Status (2)

Country Link
CN (2) CN111213348B (zh)
WO (1) WO2019071464A1 (zh)

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112165532A (zh) * 2020-10-14 2021-01-01 腾讯科技（深圳）有限公司 节点访问方法、装置、设备及计算机可读存储介质
CN112333135A (zh) * 2020-07-16 2021-02-05 北京京东尚科信息技术有限公司 网关确定方法、装置、服务器、分发器、系统及存储介质
CN112804366A (zh) * 2019-11-13 2021-05-14 北京百度网讯科技有限公司 用于解析域名的方法和装置
CN113067803A (zh) * 2021-03-12 2021-07-02 北京金山云网络技术有限公司 一种资源隔离系统、请求处理方法及请求处理装置
WO2021135344A1 (zh) * 2019-05-10 2021-07-08 华为技术有限公司 虚拟私有云与云下数据中心通信、配置方法及相关装置
CN113194076A (zh) * 2021-04-16 2021-07-30 中盈优创资讯科技有限公司 一种安全控制器及其实现方法
CN114025010A (zh) * 2021-10-20 2022-02-08 北京奥星贝斯科技有限公司 建立连接的方法和网络设备
CN114448667A (zh) * 2021-12-23 2022-05-06 天翼云科技有限公司 一种数据传输方法、装置及设备
CN114785733A (zh) * 2022-06-20 2022-07-22 中电云数智科技有限公司 一种实现跨vpc网络流量转发中会话溯源的方法
CN116938877A (zh) * 2023-09-15 2023-10-24 阿里云计算有限公司 一种域名解析数据的配置方法、域名解析方法及相关装置

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113923253A (zh) * 2021-10-12 2022-01-11 西安万像电子科技有限公司 一种虚拟机图像传输方法、电子设备及存储介质
CN114125025B (zh) * 2021-11-23 2024-02-13 北京奥星贝斯科技有限公司 一种多目标网络下的数据传输方法及装置
CN116155890B (zh) * 2023-04-20 2023-08-15 杭州优云科技有限公司 分布式文件系统的实现方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102684969A (zh) * 2011-03-18 2012-09-19 日电（中国）有限公司 Vpn节点及其标识解析代理及方法、和vpn服务器
CN103634314A (zh) * 2013-11-28 2014-03-12 杭州华三通信技术有限公司 一种基于虚拟路由器vsr的服务访问控制方法及设备
CN104583955A (zh) * 2012-06-20 2015-04-29 熔合层公司 用于编配计算环境中的ip授权与解除授权的方法和设备
US20150188802A1 (en) * 2013-12-26 2015-07-02 Electronics And Telecommunications Research Institute System for supporting multi-tenant based on private ip address in virtual private cloud networks and operating method thereof
CN104852846A (zh) * 2014-02-14 2015-08-19 华为技术有限公司 一种数据转发控制方法及系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100111105A1 (en) * 2008-10-30 2010-05-06 Ken Hamilton Data center and data center design
US9419940B2 (en) * 2012-03-02 2016-08-16 Futurewei Technologies, Inc. IPv4 data center support for IPv4 and IPv6 visitors
CN103973827A (zh) * 2013-02-05 2014-08-06 中国移动通信集团公司 一种域名解析方法及装置
US9705965B2 (en) * 2013-08-14 2017-07-11 Vmware, Inc. Systems and methods for PaaS level app motion
CN106331206B (zh) * 2015-06-30 2019-08-23 新华三技术有限公司 域名管理方法及装置
CN106797410A (zh) * 2016-12-23 2017-05-31 深圳前海达闼云端智能科技有限公司 域名解析方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102684969A (zh) * 2011-03-18 2012-09-19 日电（中国）有限公司 Vpn节点及其标识解析代理及方法、和vpn服务器
CN104583955A (zh) * 2012-06-20 2015-04-29 熔合层公司 用于编配计算环境中的ip授权与解除授权的方法和设备
CN103634314A (zh) * 2013-11-28 2014-03-12 杭州华三通信技术有限公司 一种基于虚拟路由器vsr的服务访问控制方法及设备
US20150188802A1 (en) * 2013-12-26 2015-07-02 Electronics And Telecommunications Research Institute System for supporting multi-tenant based on private ip address in virtual private cloud networks and operating method thereof
CN104852846A (zh) * 2014-02-14 2015-08-19 华为技术有限公司 一种数据转发控制方法及系统

Cited By (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115699699A (zh) * 2019-05-10 2023-02-03 华为云计算技术有限公司 虚拟私有云与云下数据中心通信、配置方法及相关装置
WO2021135344A1 (zh) * 2019-05-10 2021-07-08 华为技术有限公司 虚拟私有云与云下数据中心通信、配置方法及相关装置
CN115699699B (zh) * 2019-05-10 2023-05-12 华为云计算技术有限公司 虚拟私有云与云下数据中心通信、配置方法及相关装置
CN112804366A (zh) * 2019-11-13 2021-05-14 北京百度网讯科技有限公司 用于解析域名的方法和装置
CN112804366B (zh) * 2019-11-13 2023-05-12 北京百度网讯科技有限公司 用于解析域名的方法和装置
CN112333135A (zh) * 2020-07-16 2021-02-05 北京京东尚科信息技术有限公司 网关确定方法、装置、服务器、分发器、系统及存储介质
CN112165532A (zh) * 2020-10-14 2021-01-01 腾讯科技（深圳）有限公司 节点访问方法、装置、设备及计算机可读存储介质
CN112165532B (zh) * 2020-10-14 2024-04-09 腾讯科技（深圳）有限公司 节点访问方法、装置、设备及计算机可读存储介质
CN113067803A (zh) * 2021-03-12 2021-07-02 北京金山云网络技术有限公司 一种资源隔离系统、请求处理方法及请求处理装置
CN113067803B (zh) * 2021-03-12 2023-05-05 北京金山云网络技术有限公司 一种资源隔离系统、请求处理方法及请求处理装置
CN113194076A (zh) * 2021-04-16 2021-07-30 中盈优创资讯科技有限公司 一种安全控制器及其实现方法
CN113194076B (zh) * 2021-04-16 2023-04-21 中盈优创资讯科技有限公司 一种安全控制器及其实现方法
CN114025010A (zh) * 2021-10-20 2022-02-08 北京奥星贝斯科技有限公司 建立连接的方法和网络设备
CN114025010B (zh) * 2021-10-20 2024-04-16 北京奥星贝斯科技有限公司 建立连接的方法和网络设备
CN114448667A (zh) * 2021-12-23 2022-05-06 天翼云科技有限公司 一种数据传输方法、装置及设备
CN114448667B (zh) * 2021-12-23 2023-08-08 天翼云科技有限公司 一种数据传输方法、装置及设备
CN114785733B (zh) * 2022-06-20 2022-08-26 中电云数智科技有限公司 一种实现跨vpc网络流量转发中会话溯源的方法
CN114785733A (zh) * 2022-06-20 2022-07-22 中电云数智科技有限公司 一种实现跨vpc网络流量转发中会话溯源的方法
CN116938877A (zh) * 2023-09-15 2023-10-24 阿里云计算有限公司 一种域名解析数据的配置方法、域名解析方法及相关装置
CN116938877B (zh) * 2023-09-15 2024-01-05 阿里云计算有限公司 一种域名解析数据的配置方法、域名解析方法及相关装置

Also Published As

Publication number Publication date
CN111213348A (zh) 2020-05-29
CN113726918A (zh) 2021-11-30
CN111213348B (zh) 2021-07-16
CN113726918B (zh) 2024-01-05

Similar Documents

Publication Publication Date Title
WO2019071464A1 (zh) 数据中心系统中域名解析的方法、装置和系统
CN110727499B (zh) 资源数据获取的方法、装置、计算机设备和存储介质
EP3401783B1 (en) Method and apparatus for determining virtual machine migration
CN103095546B (zh) 一种处理报文的方法、装置及数据中心网络
CN108347493B (zh) 混合云管理方法、装置和计算设备
US9274825B2 (en) Virtualization gateway between virtualized and non-virtualized networks
TWI752939B (zh) 用戶請求的處理方法和裝置
CN107317832B (zh) 报文转发方法及装置
JP6574304B2 (ja) 仮想ネットワーク管理
EP3391627A1 (en) Shared multi-tenant domain name system (dns) server for virtual networks
US11036535B2 (en) Data storage method and apparatus
TW201331763A (zh) 設置隔離虛擬空間的方法與裝置
CN107135242B (zh) Mongodb集群访问方法、装置及系统
WO2016127911A1 (en) Preventing flow interruption caused by migration of vm
US20220129296A1 (en) Service network approach for dynamic container network management
JP2019185744A (ja) 暗号ドメイン間における動的リソース割り振りのための技法
CN106886429A (zh) 一种加载驱动程序的方法和服务器
JP2021504804A5 (zh)
EP2629492A1 (en) Method, switch, and system for processing a message
WO2016141749A1 (zh) 虚拟机端口映射的实现方法、服务器、系统及存储介质
US20120311115A1 (en) Assignment of agent identifier to cloned device
WO2017107485A1 (zh) 一种云桌面多节点连接的方法和装置
US20160062888A1 (en) Least disruptive cache assignment
US20180145922A1 (en) Outbound request management
CN116319354B (zh) 基于云实例迁移的网络拓扑更新方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17928250

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17928250

Country of ref document: EP

Kind code of ref document: A1