WO2020063528A1

WO2020063528A1 - Method, apparatus and system for communication between virtual machines in data center

Info

Publication number: WO2020063528A1
Application number: PCT/CN2019/107266
Authority: WO
Inventors: 孙应孔; 胡红山
Original assignee: 华为技术有限公司
Priority date: 2018-09-30
Filing date: 2019-09-23
Publication date: 2020-04-02
Also published as: CN109525477A

Abstract

Disclosed are a method, apparatus and system for communication between virtual machines in a data center. In the present application, an IPsec security protocol is used to encapsulate data packages, and security measures such as encryption or authentication are taken for communication packets between virtual machines in the same tenant or the same VxLAN, thereby ensuring the security of the communication packets. Moreover, in order to prevent the problem of encapsulated IPsec packets being unable to be routed or associated with a correct security association, indexes of the IPsec packets and an IPsec security association are extended.

Description

Communication method, device and system between virtual machines in data center

Technical field

The present invention relates generally to communication technologies, and in particular, to a communication method and system for a virtual machine in a data center.

Background technique

Virtual Extensible Local Area Network (VxLAN) technology is a technology used to extend network virtualization to obtain a sufficient number of virtual networks to satisfy users. According to the provisions of the VxLAN protocol, VxLAN packets usually include a payload and a packet header. The packet header usually includes a 24-bit virtual extensible LAN network identifier (VxLAN, Network Identifier, VNI), and the IP of the source data packet. Information such as the address and the IP address of the destination data packet is used to forward VxLAN packets. The payload usually includes communication packets used for communication between virtual machines (VMs), such as data packets and the MAC address of the source VM. And the MAC address of the destination VM.

In the prior art, if VxLAN data packets are used for communication between virtual machines, there is a security risk of data being stolen, tampered, and replayed during data forwarding, especially across data center scenarios.

Summary of the Invention

The embodiments of the present application provide a method, an apparatus, and a system for communication between virtual machines in a data center, so as to use IPsec protocol for security protection for communication between virtual machines belonging to the same tenant or VxLAN.

In a first aspect, the present application provides a method for communication between virtual machines, where a first virtual machine and a second virtual machine run on a first host machine and a second host machine, respectively, and the first virtual machine and the second virtual machine Machines belong to the same extensible virtual local area network VxLAN, and a method for communication between the first virtual machine and the second virtual machine includes: obtaining a source data packet to be sent by the first virtual machine, and comparing the source data packet A VxLAN data packet is obtained by encapsulating in a VxLAN format, and a VxLAN header of the VxLAN data packet includes an identifier VNI of a VxLAN to which the first virtual machine and the second virtual machine belong, and then Internet security is performed on the VxLAN data packet. Encapsulation of the protocol security IPsec format to obtain an IPsec data packet. The IPsec data packet includes a first part, a second part, and a third part. The first part is used to carry the VxLAN data packet, and the second part includes IPsec. A header, the third part is used to carry the VNI; and finally, the IPsec data packet is sent.

In the first aspect, for communication between virtual machines of the same tenant or the same VxLAN, IPsec encapsulation is performed on the VxLAN data packets to be sent by the sender. The encapsulated IPsec data packets can avoid various security risks during the communication forwarding process. In addition, to address the problem that the existing IPsec protocol is not applicable to the multi-tenant scenario, the encapsulated data packet of the first aspect of the present invention, in addition to carrying the original VxLAN data packet and encapsulating the IPsec header, includes a third part. The third part It is used to carry tenant information or routing instructions. For example, VNI information is used as tenant information or routing instructions. The added third part can solve the problem that the receiver cannot match the correct IPsec security association SA after receiving the IPsec data packet, so that the IPsec data packet cannot be decapsulated. At the same time, the third part can also make the IPsec data During the intermediate routing process, a packet can be identified by an intermediate routing device, such as a gateway, and routed correctly.

According to a first possible implementation manner of the first aspect, the encapsulation in the IPsec format uses a secure payload ESP protocol, the VNI carried in the VxLAN data packet in the first part is in an encrypted state, and the VNI is unencrypted.

According to a second possible implementation manner of the first aspect, the IPsec format encapsulation uses a security payload ESP protocol and an authentication header AH protocol, the VNI carried in the VxLAN data packet in the first part is in an encrypted state, and the third The VNI carried in the section is unencrypted.

According to a third possible implementation manner of the first aspect, the IPsec format encapsulation uses an authentication header AH protocol, the VNI carried in the VxLAN data packet in the first part is in an unencrypted state, and the VNI in the third part Not encrypted.

According to the first aspect and the foregoing three possible implementation manners of the first aspect, in a fourth possible implementation manner, the VxLAN data packet includes an outer IP field, and the third part is set at the outer IP Between the field and the IPsec header, and encapsulated in the user datagram protocol UDP format.

According to the second or third possible implementation manner of the first aspect, in a fifth possible implementation manner, the IPsec header includes an ESP header, and the third part is set in the ESP header.

According to the third or fourth possible implementation manner of the first aspect, in a sixth possible implementation manner, the IPsec header includes an AH header, and the third part is set in the AH header.

The above six possible implementations include specific implementation details of IPsec implementation.

According to the foregoing six possible implementation manners of the first aspect, in a seventh implementation manner, before the performing IPsec encapsulation, the method further includes: exchanging IKE between the first host and the second host through an Internet key. A protocol negotiation determines an IPsec security association SA between the first virtual machine and the second virtual machine, wherein the IPsec SA includes a quadruple index and a security element, and the quadruple index includes a security protocol type , A security parameter index, a peer IP address, and a home VNI of the first virtual machine and the second virtual machine, and the IKE data packet sent by the first host machine to the second host machine includes the VNI.

Further, the performing IPsec encapsulation includes: querying the IPsec and SA to obtain a security element according to the quadruple index, and performing IPsec format encapsulation according to the security element to obtain the IPsec data packet.

In a second aspect, the present application provides a method for communication between virtual machines. A first virtual machine and a second virtual machine run on a first host machine and a second host machine, respectively. The first virtual machine and the second virtual machine Machines belong to the same extensible virtual local area network VxLAN, and a method for communication between the first virtual machine and the second virtual machine includes: receiving an IPsec data packet from the first host machine, wherein the IPsec data packet It includes a first part, a second part, and a third part. The first part is used to carry VxLAN data packets, the second part includes an IPsec header, and the third part is used to carry the first virtual machine and the third part. The identification VNI of the VxLAN to which the two virtual machines belong, the VxLAN data packet is obtained by encapsulating the source data packet of the first virtual machine, and the VxLAN header of the VxLAN data packet includes the VNI; according to the IPsec data packet, Carrying the VNI and the IPsec header, decapsulating the IPsec data packet to obtain a VxLAN data packet; decapsulating the VxLAN data packet to obtain the source data packet, and forwarding the source data to the second virtual machine package.

The second aspect or any implementation manner of the second aspect is a device implementation corresponding to the first aspect or any implementation manner of the first aspect, and the description in the first aspect or any implementation manner of the first aspect is applicable to the second aspect Or any implementation manner of the second aspect, which is not described again here.

In a third aspect, the present application provides a method for forwarding a data packet of a virtual machine. A first virtual machine and a second virtual machine run on a first host machine and a second host machine, respectively. The first virtual machine and the first virtual machine Two virtual machines belong to the same extensible virtual local area network VxLAN. The method is applied to a gateway between the first host and the second host, and includes: receiving an IPsec data packet from the first host; The IPsec data packet includes a first part, a second part, and a third part. The first part is used to carry a VxLAN data packet, the second part includes an IPsec header, and the third part is used to carry the first part. A virtual machine and a VxLAN identifier VNI to which the second virtual machine belongs, the VxLAN data packet is obtained by encapsulating a source data packet of the first virtual machine, and a VxLAN header of the VxLAN data packet includes the VNI; Obtaining the VNI carried in the IPsec data packet, and determining the destination receiver of the IPsec data packet as the second host according to the VNI; and sending the IPsec data according to the information of the second host Packet sending To the second host.

Since the gateway is connected to more than one host, the gateway should obtain the VNI information to identify the destination host. However, if the sender obtains the IPsec packet through the ESP protocol encapsulation, the VNI information is in an encrypted state. In this case, The gateway cannot obtain VNI information. The third aspect is that the sender expands the IPsec encapsulation, and the newly added third part is used to carry the non-encrypted VNI, which can solve the problem that the gateway cannot route.

According to a fourth aspect, the present application provides a communication device for communication between a first virtual machine and a second virtual machine that belong to the same extensible virtual local area network VxLAN, and the device includes a transceiver unit for acquiring the A source data packet to be sent of the first virtual machine; a first encapsulating unit, configured to encapsulate the source data packet in a VxLAN format to obtain a VxLAN data packet, and a VxLAN header of the VxLAN data packet includes the first virtual machine and An identifier VNI of a VxLAN to which the second virtual machine belongs; a second encapsulating unit, configured to encapsulate the VxLAN data packet with an Internet security protocol security IPsec format to obtain an IPsec data packet, where the IPsec data packet includes a first A first part, a second part, and a third part, the first part is used to carry the VxLAN data packet, the second part includes an IPsec header, and the third part is used to carry the VNI; the transceiver unit, and For sending the IPsec data packet.

The fourth aspect or any implementation manner of the fourth aspect is a device implementation corresponding to the first aspect or any implementation manner of the first aspect, and the description in the first aspect or any implementation manner of the first aspect is applicable to the fourth aspect Or any implementation manner of the fourth aspect, which is not described again here.

In a fifth aspect, the present application provides a communication device for communication between a first virtual machine and a second virtual machine that belong to the same extensible virtual local area network VxLAN. The device includes: a transceiver unit for receiving data from all The IPsec data packet of the first host machine, wherein the IPsec data packet includes a first part, a second part, and a third part, the first part is used to carry a VxLAN data packet, and the second part includes an IPsec header. The third part is used to carry the identification VNI of the VxLAN to which the first virtual machine and the second virtual machine belong, the VxLAN data packet is obtained by encapsulating the source data packet of the first virtual machine, and the VxLAN A VxLAN header of a data packet includes the VNI; a first decapsulating unit is configured to decapsulate the IPsec data packet to obtain a VxLAN data packet according to the VNI and the IPsec header carried in the IPsec data packet; the second The decapsulating unit is configured to decapsulate the VxLAN data packet to obtain the source data packet; the transceiver unit is further configured to forward the source data packet to the second virtual machine.

The fifth aspect or any implementation manner of the fifth aspect is a device implementation corresponding to the second aspect or any implementation manner of the second aspect, and the description in the second aspect or any implementation manner of the second aspect is applicable to the fifth aspect Or any implementation manner of the fifth aspect, details are not described herein again.

According to a sixth aspect, the present application provides a communication gateway for communication between a first virtual machine and a second virtual machine that belong to the same extensible virtual local area network VxLAN, and includes a receiving unit configured to receive data from the first virtual machine. The host's IPsec data packet, wherein the IPsec data packet includes a first part, a second part, and a third part, the first part is used to carry a VxLAN data packet, the second part includes an IPsec header, and the third part Partly used to carry the identification VNI of the VxLAN to which the first virtual machine and the second virtual machine belong. The VxLAN data packet is obtained by encapsulating the source data packet of the first virtual machine. A VxLAN header includes the VNI; a routing unit configured to obtain the VNI carried in the IPsec data packet, determine the destination of the IPsec data packet as the second host according to the VNI, and Said the information of the second host, and sending the IPsec data packet to the second host.

In a seventh aspect, the present application provides a communication device, including: a processor, a memory, and a bus;

The memory is used to store execution instructions, the processor is connected to the memory through the bus, and when the communication device is running, the processor executes the execution instructions stored in the memory, so that the processor The computing device executes the method described in the first aspect or the second aspect or the third aspect.

In an eighth aspect, the present application provides a communication system including a first host machine and a second host machine. The first host machine runs a first virtual machine, and the second host machine runs a second virtual machine. The first virtual machine and the second virtual machine belong to the same extensible virtual local area network VxLAN; the first host machine is configured to obtain a source data packet to be sent by the first virtual machine, and perform a process on the source data packet. Encapsulation in the VxLAN format obtains a VxLAN data packet, and the VxLAN header of the VxLAN data packet includes the identification VNI of the VxLAN to which the first virtual machine and the second virtual machine belong, and performs Internet security protocol security on the VxLAN data packet Encapsulation in a static IPsec format to obtain an IPsec data packet, the IPsec data packet includes a first part, a second part, and a third part, the first part is used to carry the VxLAN data packet, and the second part includes an IPsec header, The third part is used to carry the VNI and send the IPsec data packet; the second host is used to receive an IPsec data packet from the first host, and according to the IPsec data packet Carrying the VNI and the IPsec header, decapsulating the IPsec data packet to obtain a VxLAN data packet, decapsulating the VxLAN data packet to obtain the source data packet, and forwarding the source data to the second virtual machine package.

Optionally, the communication system further includes: a communication gateway, configured to receive an IPsec data packet from the first host, obtain the VNI carried in the IPsec data packet, and determine the IPsec data according to the VNI The destination of the packet is the second host, and the IPsec data packet is sent to the second host according to the information of the second host.

In a ninth aspect, the present application provides a computer-readable storage medium or computer program product. The computer-readable storage medium stores instructions. When the instructions are executed by a processor, the first or second aspect or the third aspect is implemented. A method for configuring a virtual machine provided in any implementation aspect of the aspect. The computer-readable storage medium includes, but is not limited to, read-only memory, random access memory, flash memory, HDD or SSD.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly explain the technical solutions in the embodiments of the present application or the background art, the drawings that are needed in the embodiments of the present application or the background art will be described below.

FIG. 1A is a system architecture diagram provided by an embodiment of the present invention; FIG.

FIG. 1B is another system architecture diagram provided by an embodiment of the present invention; FIG.

2 is a flowchart of a method according to an embodiment of the present invention;

3 is a schematic diagram of a VxLAN data packet structure according to an embodiment of the present invention;

4 is a schematic structural diagram of an IPsec data packet according to an embodiment of the present invention;

5 is a schematic structural diagram of an IPsec data packet according to an embodiment of the present invention;

6 is a schematic structural diagram of an IPsec data packet according to an embodiment of the present invention;

7 is a schematic diagram of a composition of a communication system according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of a device according to an embodiment of the present invention.

detailed description

The following describes the embodiments of the present application with reference to the drawings in the embodiments of the present application.

FIG. 1A and FIG. 1B are schematic diagrams of a system architecture of virtual machine communication of the present application, respectively. As shown in FIG. 1A, in the same data center, there are at least two host machines (two host machines shown), and each host machine runs multiple virtual machines (two virtual machines shown). Host machine 10 runs first virtual machine VM1 and third virtual machine VM3, second host machine 20 runs first virtual machine VM2 and fourth virtual machine VM4, and VM1 and VM2 belong to the same VxLAN (the dotted lines shown in the figure) VxLAN1), VM3 and VM4 belong to the same VxLAN (VxLAN2 indicated by the dotted line in the figure). The same tenant generally means the same VxLAN. In the same tenant network, each virtual machine is assigned a different ID or address, but in different tenants, different virtual machines may be assigned the same ID or address. For example, VM1 and VM4 may have the same address. In the data center shown in FIG. 1A, virtual machines can communicate with each other. The virtual machines use VxLAN packets for communication. The VxLAN packets encapsulate the VxLAN network identifier VNI to which the virtual machine belongs. The VNI is used for data packets. Forwarding route. The system shown in FIG. 1B is different from FIG. 1A in that FIG. 1B is a communication between virtual machines belonging to the same VxLAN in different data centers. Each data center is also referred to as an availability zone (AZ). Host machine 10 and host machine 20 are located in different data centers. Each data center includes its own gateway. Data center 2 includes at least two host machines (two are shown in the figure). Both host machine 20 and host machine 30 belong to the data. The host machine in the center 2 and VM5 and VM6 on the host machine 30 belong to VxLAN2. The data packet sent by the host machine 10 is forwarded to the gateway 202 through the network through the gateway 102, and is forwarded by the gateway 202 to the host machine 20. During the forwarding process, the gateway relies on the VNI in the VxLAN data packet for routing.

The existing communication process between the same tenant virtual machines is as follows: In FIG. 1A, the traffic of the sender VM1 passes through the virtual switch 101, and the virtual switch 101 encapsulates the source data packet with VxLAN and then leaves the host machine 10, and the receiver host machine 20 After receiving the packet, the physical interface sends the packet to the local virtual switch 201, the virtual machine 201 performs Vxlan decapsulation, and finally forwards the packet to the destination virtual machine vm2. In FIG. 1B, the traffic of the sender VM1 passes through the virtual switch 101. The virtual switch 101 encapsulates the source data packet with VxLAN and then leaves the host machine 10. The packets are forwarded by the gateways 102 and 202 respectively, and the physical interface of the receiver host machine 20 is received. After the message is received, the message is sent to the local virtual switch 201. The virtual switch 201 performs Vxlan decapsulation, and finally forwards the message to the destination virtual machine vm2.

In the prior art, communication data packets between virtual machines of the same tenant have not been processed securely. Therefore, there is a security risk that data may be stolen, tampered with, and replayed during the forwarding process, especially across data center scenarios.

Internet Protocol Security (Internet Protocol Security, IPSec) is a security protocol widely used in network communications. The two communication parties can provide the following security services at the IP layer through encryption and data source authentication: Data confidentiality (Confidentiality): The IPsec sender encrypts the packet before transmitting it through the network; Data integrity (Data Integrity) Integrity): The IPsec receiver authenticates the packets sent by the sender to ensure that the data has not been tampered with during the transmission process. Data Source Authentication: IPsec at the receiver can authenticate whether the sender sending the IPsec message is legitimate ; Anti-Replay: IPsec receiver can detect and refuse to receive outdated or duplicate messages.

IPsec provides two security mechanisms: authentication and encryption. The authentication mechanism enables the data receiver of IP communication to confirm the true identity of the data sender and whether the data has been tampered with during transmission. The encryption mechanism guarantees the confidentiality of the data by encrypting the data to prevent the data from being intercepted during transmission. The Authentication Header (AH) protocol in the IPsec protocol defines the application method of authentication, providing data source authentication and integrity guarantee; the Encapsulating Security Payload (ESP) protocol defines the application method of encryption and optional authentication Provides data reliability guarantee; Internet Key Exchange (IKE) is used for key exchange.

In the application of the IPSec protocol, information transmission between two communication endpoints requires the establishment of an IPSec Security Association (SA) for the encryption and decryption of information to ensure the secure transmission of information. IPsec SA provides secure communication between two endpoints, which are called IPsec peers. IPSec SA is the agreement on the security elements between communication peers, for example, which protocol is used (AH or ESP or a combination of the two), the protocol's encapsulation mode, the encryption algorithm, the shared key to protect data in a specific stream, and Key lifetime, etc. According to the definition of the existing IPSec protocol, an IPSec SA is uniquely identified by a triplet including a security parameter index (SPI), a peer / remote IP address (also called destination address), Security protocol type (AH or ESP).

Based on the IPsec protocol, IPsec encapsulation of VxLAN data packets for communication between virtual machines of the same tenant can provide data security protection, but the existing IPsec protocol is not targeted at multi-tenant scenarios. The established SA cannot be mapped to the only SA according to the existing triplet. For example, the SA established by VM1 and VM2, the SA established by VM3 and VM4, if the addresses of VM1 and VM3 are the same (virtual machines in different VxLANs) It is allowed to have the same address). After the IPsec packet sent by VM1 reaches the host 20, the host may find two or more based on the triplet as the index (SPI, address of VM1, ESP or AH protocol type). The reason is that the other two index values (SPI and protocol type) have the same probability, and the address of VM1 and the address of VM3 are the same. Then the triplet index may correspond to two SAs. Therefore, the host 20 may not be able to index to the correct SA, and thus cannot take security measures such as decryption or authentication on the received IPsec data packet, which will eventually lead to the inability to forward the data packet to the corresponding recipient virtual machine. In addition, if the VxLAN data packet is encrypted using the ESP protocol, the VNI in the original VxLAN data packet is in an encrypted state, and the recipient host cannot obtain the VNI, so the recipient virtual machine of the packet cannot be determined. In addition, in the scenario of FIG. 1B, if the VxLAN data packet is encrypted by using the ESP protocol to obtain an IPsec data packet, the VxLAN identifier VNI carried in the VxLAN packet header is encrypted, and the gateway cannot receive the IPsec data packet received by the gateway. VNI information, the gateway cannot determine subsequent routing information based on the VNI information. In this case, the data packet sent by VM1 cannot be routed to the host where VM2 is located.

This application provides a method for communication between virtual machines of the same tenant. This method not only guarantees the security of data packets between the two communicating parties, but also solves the problem that the IPsec protocol cannot be used to uniquely determine the SA in a virtualized multi-tenant scenario. The problem that the VNI cannot be routed makes the virtual machines in the multi-tenant scenario communicate securely through IPsec.

This application extends the IPsec SA index information from the existing triples to quads and adds an index item VNI to distinguish the SAs of virtual machines in different tenants. The quad tuple index includes: Security protocol type (ESP or AH or both), security parameter index SPI, destination IP address, and tenant information (the home VNI of the virtual machines on both sides of the communication).

FIG. 2 is a flowchart of a method embodiment provided in the present application. FIG. 2 combines the scenario in FIG. 1B. In step 201, when VM1 wants to send a data packet to VM2, VM1 sends a source data packet to the virtual machine on host 10. After receiving the source data packet, the switch 101 and the virtual switch 101 encapsulate the source data packet in a VxLAN format to obtain a VxLAN data packet. The VxLAN header of the VxLAN data packet includes the identifiers of the VxLAN to which the VM1 and VM2 belong. VNI, as shown in FIG. 3, is an exemplary format of a VxLAN packet. The VxLAN packet encapsulates the outer media access control address MAC and IP address in the outer layer of the source packet. The outer MAC and IP address generally correspond to VM1. VxLAN Tunnel Endpoint (VTEP) or MAC or IP address of the host, the destination port number (VXLAN Port) in the outer UDP header is fixed to 4789, and the source port number (UDP, Source Port) is the original Ethernet frame passing The value calculated by the hash algorithm. The VxLAN header carries VNI.

In step 202, the virtual switch 101 further securely encapsulates the VxLAN data. The secure encapsulation may use the IPsec protocol to obtain an IPsec data packet. The IPsec data packet includes a first part, a second part, and a third part. The first part is used for The VxLAN data packet is carried, the second part includes an IPsec header, and the third part is used to carry the VNI. In this embodiment, the format of the IPsec data packet is extended. The third part is a newly added part, which is used to add VNI information again in the message. That is, the VxLAN header carries the VNI in addition to the VNI. Add VNI information. The added VNI information can directly indicate the identity of the VxLAN network to which the virtual machines of both parties belong, so that the receiver receiving the IPsec data packet can perform related identification or security operations according to the VNI.

Specifically, step 202A may be performed before step 202. In step 202A, the host 10 and the host 20 may first determine the IPsec security association SA between VM1 and VM2 through IKE negotiation. After the negotiation is successful, the host The host 10 and the host 20 respectively record the negotiated SA, and the recorded SA includes a quad index and a security element, and the quad index includes a security protocol type, a security parameter index, a destination IP address (destination IP), and the VM1 and VM2 belong to the VNI. The quadruple index corresponds to the security elements. The security elements include the encapsulation mode of the protocol, the encryption algorithm, the shared key to protect the data in a specific stream, and the key's lifetime. In this step, the establishment of the SA can be determined through negotiation, or the SA can be manually configured. If the SA is determined through negotiation, the IKE protocol can be used for related negotiation. In the prior art, the IKE protocol does not support carrying VNI. In this embodiment, The data packet of the IKE protocol can be extended, so that the IKE data packet can carry VNI, for example, VNI information can be inserted between the UDP and the initiator cookie of the IKE data packet.

Specifically, in step 202, the virtual switch 101 may obtain the SA determined in step 202A, and perform IPsec encapsulation according to the security elements in the SA. The IPsec encapsulation may use the ESP protocol, the AH protocol, or the ESP. The protocol also uses the AH protocol.

The IPsec data packet encapsulated by the ESP protocol is shown in Figure 4. The IPsec data packet includes at least three parts. The first part is used to carry the original VxLAN data packet, and the second part includes the ESP header to carry the encapsulation information. The encapsulation information It can include the SPI and protocol type (ESP) in the quadruple index. Since ESP needs to be used to encrypt the data packet, in general, the part from the ESP header to the source packet is the encrypted part, that is, the VNI in the VxLAN packet. This is an encrypted state. Since the VNI in the VxLAN data packet is encrypted, in order to ensure that each receiver in the routing process can obtain VNI information, the newly added VNI in the third part is in an unencrypted state. It should be noted that not all contents of the ESP header need to be encrypted, and the SPI and protocol type information are generally not encrypted.

The IPsec data packet encapsulated by the ESP protocol and the AH protocol is shown in Figure 5. The IPsec data packet is to be encrypted and authenticated by the peer. The IPsec data packet needs to further carry the authentication information part. The second part in Figure 5 In addition to the ESP header, the AH header is also included.

The format of the IPsec data packet encapsulated by using the AH protocol is similar to that in FIG. 4 except that the ESP header is replaced with an AH header. In addition, the IPsec data packet has no encrypted part.

The specific implementation of the newly added third part in the IPsec data packet can be shown in FIG. 4 or FIG. 5, and the third part is set between the outer IP field and the ESP header. The specific setting of the third part in the IPsec data packet. Another embodiment may also add the third part directly to the ESP header or the AH header, for example, the sequence number and load data (playload) in the ESP header. data).

The third part can be encapsulated in the format of User Datagram Protocol (UDP), as shown in Figure 6. The third part is encapsulated in UDP format, including the new UDP field, VNI field, and reserved field. The purpose of the new UDP The value of the port can be set to 6001, which indicates that the third part encapsulates the tenant information or VNI information.

It should be noted that in step 202, IPsec encapsulation is performed by the virtual switch. In actual operation, encapsulation may also be performed by other components in the host machine 10.

Step 203: The first host machine 10 sends an encapsulated IPsec data packet. After the IPsec data packet is sent from the host machine 10, it reaches the gateway 202 connected to the host machine 20 through the network.

Step 204: After receiving the IPsec data packet, the gateway 202 obtains the VNI information in the IPsec data packet, determines that the host 20 is the receiver receiving the IPsec data packet according to the VNI information, and forwards the IPsec data packet to the IPsec data packet. The virtual switch 201 of the host 20.

Since the gateway 202 is connected to more than one host, the gateway 202 should obtain the VNI information to identify the destination host. However, if the sender obtains the IPsec data packet through the ESP protocol encapsulation, the VNI information is in an encrypted state. In this case, Next, the gateway 202 may not be able to obtain VNI information. In the embodiment of the present application, because the sender extends the IPsec encapsulation, the newly added third part is used to carry the VNI in the non-encrypted state, which can solve the problem that the gateway cannot route.

Step 205: The virtual switch 201 obtains a quad index based on the VNI and the IPsec header carried in the IPsec data packet, queries the IPsec SA to obtain a security element according to the quad index, and obtains a security element according to the security. The elements decapsulate the IPsec data packet to obtain a VxLAN data packet; the virtual switch 201 decapsulates the VxLAN data packet to obtain a source data packet.

Step 206: The virtual switch 201 forwards the source data packet to the second virtual machine according to the VNI information.

The foregoing embodiment is described with reference to the scenario of FIG. 1B. In actual production, there is also the scenario of FIG. 1A. The difference from the foregoing process embodiment is that data packets are not forwarded through the gateway.

In the above embodiment, by expanding the message format of the IPsec data packet, a third part is added to the IPsec data packet. The third part is used to carry the tenant information. Specifically, the third part is used to carry the VxLAN network to which the two communication parties belong. The VNI can be used for the routing of IPsec data packets, and can also be used as index information to associate with the SA of the correct communicating parties, so that the IPsec data packets can be decapsulated at the receiver and perform other security operations. For example, authentication makes communication between virtual machines of the same tenant more secure and avoids possible security risks of theft, tampering, and replay.

As shown in FIG. 7, this is an embodiment of a communication system provided by an embodiment of the present invention. The communication system includes a first communication device 71, a second communication device 72, and a communication gateway 73. For the communication system, the communication gateway 73 is Choose equipment. The first communication device in this embodiment may be used to implement the method implemented by the first host shown in FIG. 2. Specifically, the method implemented by the virtual switch 101 may be implemented. The second communication device in this embodiment is available. For implementing the method implemented by the second host shown in FIG. 2, specifically, the method implemented by the virtual switch 201 may be implemented; the communication gateway in this embodiment may be used to implement the method implemented by the gateway shown in FIG. 2. method.

As shown in FIG. 7, the first communication device 71 includes a transceiver unit 711, configured to obtain a source data packet to be sent of the first virtual machine, and a first encapsulation unit 712, configured to perform a VxLAN format on the source data packet. A VxLAN data packet is obtained by encapsulation, and a VxLAN header of the VxLAN data packet includes an identifier VNI of a VxLAN to which the first virtual machine and the second virtual machine belong; and a second encapsulation unit 713 is configured to process the VxLAN data packet. Encapsulating the IPsec format of the Internet security protocol to obtain an IPsec data packet. The IPsec data packet includes a first part, a second part, and a third part. The first part is used to carry the VxLAN data packet, and the second A part includes an IPsec header, and the third part is used to carry the VNI; the transceiver unit 711 is further configured to send the IPsec data packet. Further, the first communication device 71 further includes a negotiation unit 715, configured to determine an IPsec security association SA between the first virtual machine and the second virtual machine through an Internet key exchange IKE protocol negotiation, where the IPsec SA includes a quadruple index and a security element. The quadruple index includes a security protocol type, a security parameter index, a peer IP address, and home VNIs of the first virtual machine and the second virtual machine. The IKE data packet sent by the first host to the second host includes the VNI.

The second communication device 72 includes a transceiver unit 721 for receiving an IPsec data packet from the first host machine, wherein the IPsec data packet includes a first part, a second part, and a third part, and the first part is used for Carrying a VxLAN data packet, the second part includes an IPsec header, and the third part is used to carry a VxLAN identifier VNI to which the first virtual machine and the second virtual machine belong, and the VxLAN data packet is The source data packet of the first virtual machine is obtained by encapsulation, and a VxLAN header of the VxLAN packet includes the VNI; and a first decapsulating unit 722 is configured according to the VNI and the IPsec carried in the IPsec packet. A header, which decapsulates the IPsec data packet to obtain a VxLAN data packet; a second decapsulation unit 723 is configured to decapsulate the VxLAN data packet to obtain the source data packet; and the transceiver unit 721 is further configured to send the second data packet to the second The virtual machine forwards the source data packet. Further, the second communication device 72 further includes a negotiation unit 725, configured to determine an IPsec security association SA between the first virtual machine and the second virtual machine through an Internet key exchange IKE protocol negotiation, where the IPsec SA includes a quadruple index and a security element. The quadruple index includes a security protocol type, a security parameter index, a peer IP address, and home VNIs of the first virtual machine and the second virtual machine. The IKE data packet sent by the first host to the second host includes the VNI.

The communication gateway 73 includes a receiving unit 731 for receiving an IPsec data packet from the first host machine, wherein the IPsec data packet includes a first part, a second part, and a third part, and the first part is used to carry VxLAN. A data packet, the second part includes an IPsec header, and the third part is used to carry an identifier VNI of a VxLAN to which the first virtual machine and the second virtual machine belong, and the VxLAN data packet is sent by the first A source data packet of a virtual machine is obtained by encapsulation, a VxLAN header of the VxLAN packet includes the VNI; and a routing unit 732 is configured to obtain the VNI carried in the IPsec data packet, and determine the IPsec according to the VNI The destination of the data packet is the second host, and the IPsec data packet is sent to the second host according to the information of the second host.

FIG. 8 is a schematic diagram of a device 800 according to an embodiment of the present invention. As shown in the figure, the device 800 includes a processor 801, a memory 802, a communication interface 803, and a bus 804. Among them, the processor 801, the memory 802, and the communication interface 803 communicate through a bus 804, and communication may also be implemented through other means such as wireless transmission. The memory 802 is configured to store the program code 8021, and the processor 801 is configured to call the program code 8021 stored in the memory 802 to perform operations of the methods of the present application.

The processor 801 may perform the following operations: obtaining a source data packet to be sent of the first virtual machine; and encapsulating the source data packet in a VxLAN format to obtain a VxLAN data packet, wherein a VxLAN header of the VxLAN data packet includes the first A virtual machine and an identification VNI of a VxLAN to which the second virtual machine belongs; and encapsulating the VxLAN data packet with an Internet security protocol security IPsec format to obtain an IPsec data packet, where the IPsec data packet includes a first part, a first Two parts and a third part, the first part is used to carry the VxLAN data packet, the second part includes an IPsec header, the third part is used to carry the VNI, and the IPsec data packet is sent.

The processor 801 may also perform the following operation: receiving an IPsec data packet from the first host machine, wherein the IPsec data packet includes a first part, a second part, and a third part, and the first part is used to carry VxLAN data Packet, the second part includes an IPsec header, the third part is used to carry the identifier VNI of the VxLAN to which the first virtual machine and the second virtual machine belong, and the VxLAN data packet is sent by the first The source data packet of the virtual machine is encapsulated, and the VxLAN header of the VxLAN packet includes the VNI; according to the VNI and the IPsec header carried in the IPsec packet, decapsulating the IPsec packet to obtain VxLAN data Packet; decapsulating the VxLAN data packet to obtain the source data packet, and forwarding the source data packet to the second virtual machine

The processor 801 may further perform the following operations: receiving an IPsec data packet from the first host machine, wherein the IPsec data packet includes a first part, a second part, and a third part, and the first part is used to carry VxLAN data Packet, the second part includes an IPsec header, the third part is used to carry the identifier VNI of the VxLAN to which the first virtual machine and the second virtual machine belong, and the VxLAN data packet is sent by the first The source data packet of the virtual machine is obtained by encapsulation, and the VxLAN header of the VxLAN packet includes the VNI; the VNI carried in the IPsec packet is obtained, and the destination of the IPsec packet is determined according to the VNI as The second host machine; and sending the IPsec data packet to the second host machine according to the information of the second host machine.

It should be understood that the device 800 may be the host machine 10 or the host machine 20 or the gateway 202 in FIG. 1A described above, or may be any part of the host machine 10 or the host machine 20 or the gateway 202. The processor 801 in the device 800 may execute The method executed by the host machine 10 or the host machine 20 or the gateway 202.

It should be understood that, in the embodiment of the present invention, the processor 801 may be a CPU, and the processor 801 may also be another general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array ( FPGA), GPU or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

The memory 802 may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memory. Among them, the non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrical memory Erase programmable read-only memory (EPROM, EEPROM) or flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), Double data rate synchronous dynamic random access memory (double SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM, ESDRAM), synchronous connection dynamic random access memory (synchlink DRAM, SLDRAM) and direct Memory bus random access memory (direct RAMbus RAM, DR RAM).

In addition to the data bus, the bus 804 may also include a power bus, a control bus, and a status signal bus. However, for the sake of clarity, various buses are marked as the bus 804 in the figure.

Finally, it should be understood that the above embodiments are only used for explanation, and the technical solution of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned preferred embodiments, it should be understood that those skilled in the art can make various modifications, changes, or substitutions without departing from the scope of the claims appended to this application.

Claims

A method for communication between virtual machines, characterized in that a first virtual machine and a second virtual machine run on a first host machine and a second host machine, respectively, and the first virtual machine and the second virtual machine belong to the same A scalable virtual local area network VxLAN, a method for communication between the first virtual machine and the second virtual machine includes:

Acquiring a source data packet to be sent of the first virtual machine;

Encapsulating the source data packet in a VxLAN format to obtain a VxLAN data packet, and a VxLAN header of the VxLAN data packet includes an identifier VNI of a VxLAN to which the first virtual machine and the second virtual machine belong;

Encapsulating the VxLAN data packet with Internet security protocol security IPsec format to obtain an IPsec data packet. The IPsec data packet includes a first part, a second part, and a third part. The first part is used to carry the VxLAN data. Packet, the second part includes an IPsec header, and the third part is used to carry the VNI;

Sending the IPsec data packet.
The method according to claim 1, wherein the encapsulation in the IPsec format uses a secure payload ESP protocol, the VNI carried in the VxLAN data packet in the first part is encrypted, and the VNI carried in the third part is encrypted VNI is unencrypted.
The method according to claim 1, wherein the encapsulation in the IPsec format uses a security payload ESP protocol and an authentication header AH protocol, and the VNI carried in the VxLAN data packet in the first part is in an encrypted state, and the third The VNI carried in the section is unencrypted.
The method according to claim 1, wherein the IPsec format encapsulation uses an authentication header AH protocol, the VNI carried in the VxLAN data packet in the first part is in an unencrypted state, and the VNI in the third part Not encrypted.
The method according to any one of claims 1 to 4, wherein the VxLAN data packet includes an outer IP field, and the third part is set between the outer IP field and the IPsec header, It is encapsulated in the user datagram protocol UDP format.
The method according to claim 2 or 3, wherein the IPsec header includes an ESP header, and the third part is disposed in the ESP header.
The method according to claim 3 or 4, wherein the IPsec header includes an AH header, and the third part is disposed in the AH header.
The method according to any one of claims 1-7, wherein before the performing IPsec encapsulation, further comprising:

The first host and the second host negotiate and determine an IPsec security association SA between the first virtual machine and the second virtual machine through an Internet key exchange IKE protocol negotiation, wherein the IPsec SA Including a quadruple index and a security element, the quadruple index includes a security protocol type, a security parameter index, a peer IP address, and a home VNI of the first virtual machine and the second virtual machine. The IKE data packet sent by the host to the second host includes the VNI.
The method according to claim 8, wherein the performing IPsec encapsulation comprises:

Query the IPsec SA according to the quadruple index to obtain a security element, and perform an IPsec format encapsulation according to the security element to obtain the IPsec data packet.
A method for communication between virtual machines, characterized in that a first virtual machine and a second virtual machine run on a first host machine and a second host machine, respectively, and the first virtual machine and the second virtual machine belong to the same A scalable virtual local area network VxLAN, a method for communication between the first virtual machine and the second virtual machine includes:

Receiving an IPsec data packet from the first host, wherein the IPsec data packet includes a first part, a second part, and a third part, the first part is used to carry a VxLAN data packet, and the second part includes IPsec A header, the third part is used to carry an identifier VNI of a VxLAN to which the first virtual machine and the second virtual machine belong, and the VxLAN data packet is obtained by encapsulating a source data packet of the first virtual machine, A VxLAN header of the VxLAN data packet includes the VNI;

Decapsulating the IPsec data packet to obtain a VxLAN data packet according to the VNI and the IPsec header carried in the IPsec data packet;

Decapsulate the VxLAN data packet to obtain the source data packet, and forward the source data packet to the second virtual machine.
The method according to claim 10, wherein the encapsulation in the IPsec format uses a secure payload ESP protocol, the VNI carried in the VxLAN data packet in the first part is encrypted, and the VNI carried in the third part Not encrypted.
The method according to claim 10, wherein the encapsulation in the IPsec format uses a security payload ESP protocol and an authentication header AH protocol, and the VNI carried in the VxLAN data packet in the first part is in an encrypted state, and the third The VNI in the section is unencrypted.
The method according to claim 10, wherein the encapsulation in the IPsec format uses an authentication header AH protocol, the VNI carried in the VxLAN data packet in the first part is in an unencrypted state, and the VNI in the third part Not encrypted.
The method according to any one of claims 10-13, wherein the VxLAN data packet includes an outer IP field, and the third part is set between the outer IP field and the IPsec header, It is encapsulated in the user datagram protocol UDP format.
The method according to claim 11 or 12, wherein the IPsec header includes an ESP header, and the third part is disposed in the ESP header.
The method according to claim 12 or 13, wherein the IPsec header includes an AH header, and the third part is disposed in the AH header.
The method according to any one of claims 10-16, wherein the method further comprises:

The second host and the first host negotiate and determine an IPsec security association SA between the first virtual machine and the second virtual machine through an Internet key exchange IKE protocol negotiation, wherein the IPsec SA Including a quadruple index and a security element, the quadruple index includes an encapsulation protocol type, a security parameter index, a peer IP address, and a home VNI of the first virtual machine and the second virtual machine. The IKE data packet sent by the host to the second host includes the VNI.
The method according to claim 17, wherein the second host machine decapsulates the IPsec data packet to obtain a VxLAN data packet according to the VNI and the IPsec header carried in the IPsec data packet, comprising: :

Obtaining, by the second host, a quadruple index based on the VNI and the IPsec header carried in the IPsec data packet, querying the IPsec SA based on the quadruple index to obtain a security element, and according to the security The elements decapsulate the IPsec data packet to obtain a VxLAN data packet.
A data packet forwarding method for a virtual machine, characterized in that a first virtual machine and a second virtual machine run on a first host machine and a second host machine, respectively, and the first virtual machine and the second virtual machine The method belongs to the same scalable virtual local area network VxLAN, and the method is applied to a gateway between the first host and the second host, including:

Receiving an IPsec data packet from the first host, wherein the IPsec data packet includes a first part, a second part, and a third part, the first part is used to carry a VxLAN data packet, and the second part includes IPsec A header, the third part is used to carry an identifier VNI of a VxLAN to which the first virtual machine and the second virtual machine belong, and the VxLAN data packet is obtained by encapsulating a source data packet of the first virtual machine, A VxLAN header of the VxLAN data packet includes the VNI;

Obtaining the VNI carried in the IPsec data packet, and determining a destination receiver of the IPsec data packet as the second host according to the VNI;

Sending the IPsec data packet to the second host machine according to the information of the second host machine.
A communication device, which is used for communication between a first virtual machine and a second virtual machine belonging to the same extensible virtual local area network VxLAN, and the device includes:

A transceiver unit, configured to obtain a source data packet to be sent of the first virtual machine;

A first encapsulating unit is configured to perform a VxLAN format encapsulation on the source data packet to obtain a VxLAN data packet, and a VxLAN header of the VxLAN data packet includes a VxLAN to which the first virtual machine and the second virtual machine belong. Identify VNI;

A second encapsulating unit, configured to encapsulate the VxLAN data packet with an Internet security protocol security IPsec format to obtain an IPsec data packet, where the IPsec data packet includes a first part, a second part, and a third part; the first part Configured to carry the VxLAN data packet, the second part includes an IPsec header, and the third part is used to carry the VNI;

The transceiver unit is further configured to send the IPsec data packet.
The device according to claim 20, wherein the VNI carried in the VxLAN data packet in the first part is in an encrypted state, and the VNI carried in the third part is in an unencrypted state; or, the first part The VNI carried in the VxLAN data packet is in an unencrypted state, and the VNI carried in the third part is in an unencrypted state.
The device according to claim 20 or 21, further comprising:

A negotiation unit, configured to determine an IPsec security association SA between the first virtual machine and the second virtual machine through an Internet key exchange IKE protocol negotiation, wherein the IPsec SA includes a quadruple index and a security element The quadruple index includes a security protocol type, a security parameter index, a peer IP address, and a home VNI of the first virtual machine and the second virtual machine, and the first host machine sends the second host machine to the second virtual machine The host's IKE data packet includes the VNI.
A communication device, which is used for communication between a first virtual machine and a second virtual machine belonging to the same extensible virtual local area network VxLAN, and the device includes:

The transceiver unit is configured to receive an IPsec data packet from the first host, wherein the IPsec data packet includes a first part, a second part, and a third part, and the first part is used to carry a VxLAN data packet. The second part includes an IPsec header, and the third part is used to carry an identifier VNI of a VxLAN to which the first virtual machine and the second virtual machine belong, and the VxLAN data packet is sent from a source of the first virtual machine. A data packet is obtained, and a VxLAN header of the VxLAN data packet includes the VNI;

A first decapsulating unit, configured to decapsulate the IPsec data packet to obtain a VxLAN data packet according to the VNI and the IPsec header carried in the IPsec data packet;

A second decapsulating unit, configured to decapsulate the VxLAN data packet to obtain the source data packet;

The transceiver unit is further configured to forward the source data packet to the second virtual machine.
The device according to claim 23, wherein the VNI carried in the VxLAN data packet in the first part is in an encrypted state, and the VNI carried in the third part is in an unencrypted state; or, the first part The VNI carried in the VxLAN data packet is in an unencrypted state, and the VNI carried in the third part is in an unencrypted state.
The device according to claim 23 or 24, further comprising:

A negotiation unit, configured to determine an IPsec security association SA between the first virtual machine and the second virtual machine through an Internet key exchange IKE protocol negotiation, wherein the IPsec SA includes a quadruple index and a security element The quadruple index includes a security protocol type, a security parameter index, a peer IP address, and a home VNI of the first virtual machine and the second virtual machine, and the first host machine sends the second host machine to the second virtual machine The host's IKE data packet includes the VNI.
A communication gateway, characterized in that it is used for communication between a first virtual machine and a second virtual machine that belong to the same extensible virtual local area network VxLAN, and includes:

A receiving unit, configured to receive an IPsec data packet from the first host machine, wherein the IPsec data packet includes a first part, a second part, and a third part, and the first part is used to carry a VxLAN data packet; The second part includes an IPsec header, and the third part is used to carry an identifier VNI of a VxLAN to which the first virtual machine and the second virtual machine belong, and the VxLAN data packet is sent from a source of the first virtual machine. A data packet is obtained, and a VxLAN header of the VxLAN data packet includes the VNI;

A routing unit, configured to obtain the VNI carried in the IPsec data packet, determine the destination receiver of the IPsec data packet as the second host according to the VNI, and according to the information of the second host Sending the IPsec data packet to the second host.
A communication device, comprising: a processor, a memory, and a bus;

The memory is used to store execution instructions, the processor is connected to the memory through the bus, and when the communication device is running, the processor executes the execution instructions stored in the memory, so that the processor A computing device executes the method of any of claims 1-19.
A communication system includes a first host machine and a second host machine, the first host machine runs a first virtual machine, the second host machine runs a second virtual machine, and the first host machine The virtual machine and the second virtual machine belong to the same scalable virtual local area network VxLAN;

The first host is configured to obtain a source data packet to be sent by the first virtual machine, and encapsulate the source data packet in a VxLAN format to obtain a VxLAN data packet. A VxLAN header of the VxLAN data packet includes the first A virtual machine and a VxLAN identifier VNI to which the second virtual machine belongs, encapsulate the VxLAN data packet in an Internet security protocol security IPsec format to obtain an IPsec data packet. The IPsec data packet includes a first part, Two parts and a third part, the first part is used to carry the VxLAN data packet, the second part includes an IPsec header, the third part is used to carry the VNI, and send the IPsec data packet;

The second host is configured to receive an IPsec data packet from the first host, and decapsulate the IPsec data packet to obtain a VxLAN data packet according to the VNI and the IPsec header carried in the IPsec data packet. , Decapsulating the VxLAN data packet to obtain the source data packet, and forwarding the source data packet to the second virtual machine.
The communication system according to claim 28, further comprising:

A communication gateway, configured to receive an IPsec data packet from the first host, obtain the VNI carried in the IPsec data packet, and determine, according to the VNI, that the destination of the IPsec data packet is the second recipient The host computer sends the IPsec data packet to the second host computer according to the information of the second host computer.