WO2016177207A1 - Method and system for isolating control plane and service plane, server and cloud computation platform - Google Patents

Abstract

Disclosed in the present invention are a method and system for isolating a control plane and a service plane, a server and a cloud computation platform. The method comprises: establishing, by a server, according to a user instruction, a virtual network bridge for a service plane and a virtual network bridge for a control plane; establishing, according to the user instruction, by a cloud computation platform, a logic network for the service plane and a logic port for the control plane; configuring a virtual network card of the service plane and a virtual network card of the control plane; establishing a first corresponding relationship between the virtual network card of the service plane, the logic network of the service plane, and the virtual network bridge of the service plane and a second corresponding relationship between the virtual network card of the control plane, the logic port of the control plane and the virtual network bridge of the control plane; and deploying, according to the first corresponding relationship and the second corresponding relationship, a virtual machine of the server. Also disclosed in the present invention are a system for isolating a control plane and a service plane, a server and a cloud computation platform. The method, system, server and cloud computation platform in the present invention enable a service plane packet and a control plane packet of the deployed virtual machine to be forwarded via respective forwarding paths thereof separately, thus achieving absolute isolation of the traffic of the control plane from that of the service plane.

Description

Control plane, business plane separation method and system, server, cloud computing platform Technical field

The present invention relates to the field of service chain technology under SDN (Software Defined Network), and particularly relates to a method and system for separating a control plane and a service plane, a server, and a cloud computing platform.

Background technique

With the continuous development of virtualization technology, various virtualization technologies emerge in an endless stream and are gradually applied in many important fields.

As an open source virtualized cloud computing platform, OpenStack stands out from many virtualization platforms because of its advantages of on-demand, self-help, resource pool and flexibility. It has won the support and favor of many manufacturers around the world.

SDN is a network defined by OpenFlow software. Users can define logical network topologies based on unified network interfaces according to different network resource requirements. You can realize network resource pooling and on-demand without needing to care about the physical topology of the underlying network. Flexible function.

The combination of OpenStack and SDN can largely meet the requirements of virtual resources for network resources in the current IT and CT fields, and fully pool the network resources, and can flexibly deploy according to the needs of users. All services of the user can be deployed on the virtual machine managed by OpenStack. At the same time, the service packet flows to receive SDN management. The SDN mainly completes the related functions of the network control plane.

When a service packet is transmitted in the network, it needs to pass through different service nodes (such as firewalls and LBs) in a certain logical order to meet the functional requirements of the service. Therefore, in the virtual machine deployed in the OpenStack, the SDN is required to divert the control plane message to the virtual machine that implements functions such as firewall and LB according to the business logic sequence to implement the service chain.

In a virtual machine that implements functions such as firewall and LB, each function module needs to analyze and process the service packets flowing through according to certain rules. The virtual machine needs to support both the control plane function delivered by the rule and the service plane function of the service packet forwarding. The control plane rule is a prerequisite for the virtual machine to process service packets. The control plane rules cannot be delivered or updated due to traffic on the service plane. Therefore, such a virtual machine is required to implement control plane and business plane separation, and ensure that the control plane rules are issued and updated successfully. However, the virtual machine under OpenStack does not have a virtual interface that is directly connected to the control plane network. The control plane needs to be connected to the same virtual bridge as the service plane. The control plane and the service plane traffic in the virtual machine cannot be absolutely separated.

Summary of the invention

The main purpose of the embodiments of the present invention is to solve the technical problem that the control plane and the service plane traffic are absolutely separated in the virtual machine in the prior art.

To achieve the above object, a method for separating a control plane and a service plane according to an embodiment of the present invention, the method for separating the control plane and the service plane includes the following steps:

The server creates a service plane virtual bridge and a control plane virtual bridge according to user instructions;

The cloud computing platform creates a business plane logical network and a control plane logical port according to user instructions; and configures a business plane virtual network card and a control plane virtual network card;

Establishing a first mapping relationship between the service plane virtual network card, the service plane logical network, the service plane virtual bridge, and the control plane virtual network card, the control plane logical port, and the control plane virtual bridge The second correspondence of the three;

The virtual machine of the server is deployed according to the first correspondence relationship and the second corresponding relationship, so that the separation of the control plane and the service plane traffic in the deployed virtual machine is implemented.

Preferably, the first corresponding relationship between the service plane virtual network card, the service plane logical network, the service plane virtual bridge, and the control plane virtual network card, the control plane logical port, and the The second correspondence between the control plane virtual bridges includes:

Establishing a third correspondence between the virtual network card of the service plane and the logical network of the service plane, and a fourth correspondence between the virtual network card of the control plane and the logical port of the control plane;

Establishing a fifth correspondence between the service plane logical network and the service plane virtual bridge, and a sixth correspondence between the control plane logical port and the control plane virtual bridge;

Establishing a first correspondence between the service plane virtual network card, the service plane logical network, and the service plane virtual bridge according to the third correspondence relationship and the fifth correspondence relationship;

And establishing, according to the fourth correspondence relationship and the sixth correspondence relationship, a second correspondence between the control plane virtual network card, the control plane logical port, and the control plane virtual bridge.

Preferably, the step of the cloud computing platform to create a control plane logical port comprises:

The cloud computing platform creates a control plane logical network, and creates the control plane logical port under the control plane logical network, and defines a virtual network card network port type corresponding to the control plane logical port as the first type.

Preferably, the step of the cloud computing platform establishing the fourth correspondence between the control plane virtual network card and the control plane logical port comprises:

The cloud computing platform generates a universally unique identifier of the control plane logical port, and adds the universal unique identifier to the control plane virtual network card;

And establishing, according to the universal unique identifier, a fourth correspondence between the control plane virtual network card and the control plane logical port, and marking, in the fourth correspondence, the control plane virtual network card network port as the first type.

Preferably, the cloud computing platform defines a virtual network card network port type corresponding to the control plane logical port as the first type. After the steps include:

The virtual computing network port type corresponding to the logical port of the control plane is a first type, and the virtual network port type corresponding to the logical port of the control plane is a first type;

After the step of establishing, by the cloud computing platform, the sixth corresponding relationship between the control plane logical port and the control plane virtual bridge, the method further includes: marking, in the sixth correspondence, the network port of the control plane virtual bridge For the first type.

Preferably, the network port of the control plane virtual network card and the network port of the control plane virtual bridge in the second correspondence are all marked as the first type;

The step of the cloud computing platform deploying the virtual machine of the server according to the first correspondence relationship and the second corresponding relationship, and implementing the separation of the control plane and the service plane traffic in the deployed virtual machine includes:

The network computing platform according to the first correspondence, and the network port of the control plane virtual network card corresponding to the control plane logical port and the network port of the control plane virtual bridge according to the second corresponding relationship All are the first type, generating a virtual machine deployment file;

According to the virtual machine deployment file, the virtual machine of the server is deployed to implement separation of control plane and service plane traffic in the deployed virtual machine.

Preferably, the step of the cloud computing platform establishing the third correspondence between the service plane virtual network card and the service plane logical network includes:

Generating, by the cloud computing platform, a first universal unique identifier of the business plane logical network, adding the first universal unique identifier to the business plane virtual network card, and establishing the according to the first universal unique identifier The third correspondence between the virtual NIC of the service plane and the logical network of the service plane.

Preferably, the server is multiple, and each server is configured with the virtual plane bridge of the service plane and a virtual bridge of the control plane;

When the number of the server is multiple, the cloud computing platform further includes: before the step of creating a service plane logical network and a control plane logical port according to user instructions:

The cloud computing platform creates a server set, and adds all servers that have a business plane virtual bridge and a control plane virtual bridge to the server set;

The step of the cloud computing platform deploying the virtual machine of the server according to the first correspondence relationship and the second corresponding relationship, and implementing the separation of the control plane and the service plane traffic in the deployed virtual machine includes:

The cloud computing platform selects a server from the server set according to the user's selection instruction, deploys a virtual machine of the selected server according to the first correspondence and the second correspondence, and implements the deployed virtual machine. Separation of traffic between the control plane and the business plane.

In addition, in order to achieve the above object, an embodiment of the present invention further provides a system for separating a control plane and a service plane, where the control plane and the service plane are separated: a server and a cloud computing platform;

The server is configured to create a service plane virtual bridge and a control plane virtual bridge according to the user instruction;

The cloud computing platform is configured to create a business plane logical network and a control plane logical port according to the user instruction; configure a service plane virtual network card and a control plane virtual network card; establish the service plane virtual network card, the service plane logical network, and the a first correspondence between the three virtual network bridges, and a second correspondence between the control plane virtual network card, the control plane logical port, and the control plane virtual bridge; according to the first correspondence And the second corresponding relationship, the virtual machine of the server is deployed, and the separation of the control plane and the service plane traffic in the deployed virtual machine is implemented.

Preferably, the cloud computing platform is configured to establish a third correspondence between the service plane virtual network card and the service plane logical network, and a fourth correspondence between the control plane virtual network card and the control plane logical port; Establishing a fifth correspondence between the service plane logical network and the service plane virtual bridge, and a sixth correspondence between the control plane logical port and the control plane virtual bridge; according to the third correspondence and Establishing, by the fifth correspondence, a first correspondence between the service plane virtual network card, the service plane logical network, and the service plane virtual bridge; according to the fourth correspondence and the sixth correspondence Relationship: establishing a second correspondence between the control plane virtual network card, the logical port, and the virtual bridge.

Preferably, the cloud computing platform is configured to create a control plane logical network, and the control plane logical port is created under the control plane logical network, and the virtual network card network port type corresponding to the control plane logical port is defined as One type.

Preferably, the cloud computing platform is further configured to generate a universally unique identifier of the control plane logical port, add the universal unique identifier to the control plane virtual network card; and establish according to the universal unique identifier The fourth corresponding relationship between the virtual network card of the control plane and the logical port of the control plane, and the virtual network card network port of the control plane is marked as the first type in the fourth correspondence.

Preferably, the cloud computing platform is further configured to: according to the virtual network card network port type corresponding to the control plane logical port, the first type, and the virtual bridge network port type corresponding to the control plane logical port is defined as the first type. After the sixth correspondence between the control plane logical port and the control plane virtual bridge is established, the network port of the control plane virtual bridge is marked as the first type in the sixth correspondence.

Preferably, the network port of the control plane virtual network card and the network port of the control plane virtual bridge in the second correspondence are all marked as the first type;

The cloud computing platform is further configured to: according to the first correspondence, and the network port of the control plane virtual network card corresponding to the control plane logical port in the second corresponding relationship, and the control plane virtual network The network ports of the bridge are all of the first type, and the virtual machine deployment file is generated; and the virtual machine of the server is deployed according to the virtual machine deployment file, so that the control plane and the service plane traffic are separated in the deployed virtual machine.

Preferably, the cloud computing platform is further configured to generate a first universal unique identifier of the business plane logical network, and add the first universal unique identifier to the business plane virtual network card, according to the first universal The unique identifier establishes a third correspondence between the virtual network card of the service plane and the logical network of the service plane.

Preferably, the server is multiple, and each server is configured with a service plane virtual bridge and a control plane virtual bridge;

The cloud computing platform is further configured to: when the server is multiple, create a server set, add all servers that create a service plane virtual bridge, a control plane virtual bridge to the server set; and according to the user Selecting a server, selecting a server from the set of servers, deploying a virtual machine of the selected server according to the first correspondence and the second correspondence, and implementing control plane and service plane traffic in the deployed virtual machine Separation.

In addition, in order to achieve the above object, an embodiment of the present invention further provides a server, where the server is the server described above.

In addition, in order to achieve the above object, an embodiment of the present invention further provides a cloud computing platform, where the cloud computing platform is the cloud computing platform described above.

In the embodiment of the present invention, a computer storage medium is further provided, and the computer storage medium may store an execution instruction for executing the method for separating the control plane and the service plane in the foregoing embodiment.

A method and system for separating a control plane and a service plane, a server, and a cloud computing platform are provided by the server according to a user instruction, and a virtual bridge of a service plane and a virtual bridge of a control plane are created by the server; the cloud computing platform is User instructions, creating a business plane logical network, a control plane logical port; configuring a service plane virtual network card and a control plane virtual network card; establishing the service plane virtual network card, the service plane logical network, and the service plane virtual bridge a first correspondence relationship; and a second correspondence between the control plane virtual network card, the control plane logical port, and the control plane virtual bridge; according to the first correspondence relationship and the second correspondence relationship, The manner of deploying the virtual machine of the server is such that the service plane packet and the control plane packet of the server virtual machine are respectively forwarded through corresponding forwarding paths, thereby implementing control plane and service plane traffic in the deployed virtual machine. Absolute separation.

DRAWINGS

1 is a schematic flowchart of a method for separating a control plane and a service plane according to an embodiment of the present invention;

2 is a schematic diagram of a specific refinement process of step S30 in FIG. 1;

3 is a schematic diagram of a specific refinement process of step S40 in FIG. 1;

4 is a schematic structural diagram of a system for separating a control plane and a service plane according to an embodiment of the present invention;

FIG. 5 is another schematic structural diagram of a system for separating a control plane and a service plane according to an embodiment of the present invention.

The implementation, functional features, and advantages of the present invention will be further described in conjunction with the embodiments.

detailed description

The preferred embodiments of the present invention are described in conjunction with the accompanying drawings, and the preferred embodiments described herein are intended to illustrate and explain the invention, and not to limit the invention, and The embodiments and the features in the embodiments can be combined with each other.

Embodiments of the present invention provide a method for separating a control plane and a service plane. Referring to FIG. 1, FIG. 1 is a schematic flowchart of a method for separating a control plane and a service plane according to an embodiment of the present invention. In an embodiment, the method for separating the control plane and the service plane includes:

Step S10: The server creates a service plane virtual bridge and a control plane virtual bridge according to the user instruction.

In this embodiment, in order to implement separation of control plane and service plane traffic in the server virtual machine, the server needs to create a service plane virtual bridge and a control plane virtual bridge.

Step S20: The cloud computing platform creates a business plane logical network, a control plane logical port, and configures a service plane virtual network card and a control plane virtual network card according to the user instruction.

The step of creating a control plane logical port by the cloud computing platform in the step S20 includes: creating, by the cloud computing platform, a control plane logical network, creating the control plane logical port under the control plane logic network, and defining the The type of the virtual NIC network port corresponding to the control plane logical port is the first type. In this embodiment, after the virtual network card network port type corresponding to the logical port of the control plane is defined as the first type, the legality of the first type of the virtual network network port corresponding to the logical port of the control plane is also required, and the The control plane logical port is stored in the database for subsequent deployment server virtual machine calls. For example, if the control plane logical port name is Port-ctrl, the virtual network card network port type vnic_type corresponding to the control plane logical port Port-ctrl is ctrl type; the vnic_type corresponding to the Port-ctrl is ctrl type legality, and Port-ctrl is stored in the database for subsequent deployment server virtual machine calls.

Step S30, establishing a first correspondence between the service plane virtual network card, the service plane logical network, and the service plane virtual bridge, and the control plane virtual network card, the control plane logical port, and the control plane The second correspondence of the virtual bridges.

Referring to FIG. 2, FIG. 2 is a schematic diagram of a specific refinement process of step S30 in FIG. The step S30 includes:

Step S31: Establish a third correspondence between the virtual network card of the service plane and the logical network of the service plane, and a fourth correspondence between the virtual network card of the control plane and the logical port of the control plane.

The step of establishing, by the cloud computing platform in the step S31, the third correspondence between the service plane virtual network card and the service plane logical network includes: processing, by the cloud computing platform, the first universal of the service plane logic network a unique identifier, the first universal unique identifier is added to the service plane virtual network card, and the third correspondence between the service plane virtual network card and the service plane logical network is established according to the first universal unique identifier . The step of establishing, by the cloud computing platform in the step S31, the fourth correspondence between the virtual network card of the control plane and the logical port of the control plane includes: processing, by the cloud computing platform, a universal unique identifier of the logical port of the control plane , for the control plane virtual network card add A universally unique identifier. And establishing, according to the universal unique identifier, a fourth correspondence between the control plane virtual network card and the control plane logical port, and marking, in the fourth correspondence, the control plane virtual network card network port as the first type. In this embodiment, after the control plane logical port is created in the control plane logical network, the virtual network card network port type corresponding to the control plane logical port is defined as the first type. Therefore, after establishing the fourth correspondence between the control plane virtual network card and the control plane logical port, the control plane virtual network card network port type should be marked as the first type. Therefore, the control plane virtual network card network port needs to be marked into the first type in the fourth correspondence, wherein the first type may be the ctrl type described above.

Step S32: Establish a fifth correspondence between the service plane logical network and the service plane virtual bridge, and establish a sixth correspondence between the control plane logical port and the control plane virtual bridge.

In this embodiment, after the step of defining the virtual network card network port type corresponding to the logical port of the control plane as the first type, the cloud computing platform further includes: processing, by the cloud computing platform, according to the logical port of the control plane The virtual network card network port type is the first type, and the virtual bridge network port type corresponding to the control plane logical port is defined as the first type. That is, the virtual network card network port type and the virtual bridge network port type corresponding to the logical port of the control plane are all defined as the first type. For example, vnic_type and vif_type corresponding to the control plane logical port whose name is Port-ctrl are ctrl type.

In this embodiment, after the step S32, the method further includes: processing, by the cloud computing platform, the network port of the control plane virtual bridge in the sixth correspondence relationship to be a first type; The network port that marks the virtual bridge of the control plane in the corresponding relationship is of the ctrl type. The foregoing step defines that the type of the virtual bridge network port corresponding to the logical port of the control plane is the first type. Therefore, after establishing the sixth correspondence between the control plane logical port and the control plane virtual bridge, the control plane virtual bridge network port type should be marked as the first type. Therefore, the control plane virtual bridge network port needs to be marked as the first type in the sixth correspondence, wherein the first type may be the ctrl type described above.

Step S33: Establish a first correspondence between the service plane virtual network card, the service plane logical network, and the service plane virtual bridge according to the third correspondence relationship and the fifth correspondence relationship; The fourth correspondence relationship and the sixth correspondence relationship establish a second correspondence between the control plane virtual network card, the control plane logical port, and the control plane virtual bridge.

In this embodiment, the network port of the control plane virtual network card and the network port of the virtual bridge in the second correspondence relationship are all marked as the first type.

Step S40: The virtual machine of the server is deployed according to the first correspondence relationship and the second corresponding relationship, so as to separate the control plane and the service plane traffic in the deployed virtual machine.

Referring to FIG. 3, FIG. 3 is a schematic diagram of a specific refinement process of step S40 in FIG. The step S40 includes:

Step S41: The cloud computing platform according to the first correspondence, and the network port of the control plane virtual network card corresponding to the control plane logical port in the second correspondence relationship, and the control plane virtual bridge The network ports are all of the first type, and the virtual machine deployment files are generated.

In step S42, the virtual machine of the server is deployed according to the virtual machine deployment file, so that the control plane and the service plane traffic are separated in the deployed virtual machine.

In the virtual machine deployment file generated in the step S41, a first correspondence of the one-to-one correspondence between the service plane virtual bridge and the service plane virtual network card and the service plane logical network in the server is recorded; And recording a second correspondence between the control plane virtual network card, the control plane logical port, and the control plane virtual bridge. The cloud computing platform may determine, according to the first correspondence, a forwarding path of the service plane packet, and determine, according to the second correspondence, a forwarding path of the control plane packet. Deploying the server virtual machine according to the service plane packet forwarding path and the control plane packet forwarding path, so as to forward the forwarding service plane packet according to the service plane packet, and forward the packet according to the control plane packet forwarding path. The control plane message is controlled, so that the separation of the control plane and the service plane traffic in the server virtual machine can be realized. The virtual machine deployment file is an xml format file.

In the embodiment of the present invention, the server may be multiple, and each server creates a service plane virtual bridge and a control plane virtual bridge. When the number of the server is multiple, in the method for separating the control plane and the service plane provided by the embodiment of the present invention, before the step of creating a business plane logical network and a control plane logical port according to the user instruction by the cloud computing platform The method further includes the following steps: the cloud computing platform creates a server set, and adds all servers that create a business plane virtual bridge and a control plane virtual bridge to the server set. In addition, the step S60 is: the cloud computing platform selects a server from the server set according to the user's selection instruction, and deploys the virtual machine of the selected server according to the first correspondence and the second correspondence. To achieve separation of control plane and service plane traffic in the deployed virtual machine.

The method for separating the control plane and the service plane provided by the foregoing embodiment creates a service plane virtual bridge and a control plane virtual bridge according to the user instruction by the server; the cloud computing platform creates a service plane logic network according to the user instruction, a control plane logical port; a service plane virtual network card and a control plane virtual network card; establishing a first corresponding relationship between the service plane virtual network card, the service plane logical network, the service plane virtual bridge, and the control plane virtual a second correspondence between the network card, the control plane logical port, and the control plane virtual bridge; and the manner in which the virtual machine of the server is deployed according to the first correspondence and the second correspondence The service plane packet and the control plane packet in the server virtual machine are respectively forwarded through the corresponding forwarding paths, so that the control plane and the service plane traffic in the deployed virtual machine are completely separated.

The embodiment of the invention further provides a system for separating the control plane and the service plane. Referring to FIG. 4, FIG. 4 is a schematic structural diagram of a system for separating a control plane and a service plane according to an embodiment of the present invention. In an embodiment, the control plane and the service plane separation system 100 include: a server 110 and a cloud computing platform 120. The server 110 is configured to create a service plane virtual bridge and a control plane virtual bridge according to user instructions. The cloud computing platform 120 is configured to create a service plane logical network and a control plane logical port according to a user instruction; configure a service plane virtual network card and a control plane virtual network card; and establish the service plane virtual network card, the service plane logic a first correspondence between the network and the virtual bridge of the service plane, and a second correspondence between the control plane virtual network card, the control plane logical port, and the control plane virtual bridge; The first corresponding relationship and the second corresponding relationship are used to deploy the virtual machine of the server to implement separation of control plane and service plane traffic in the deployed virtual machine.

The cloud computing platform 120 in the foregoing embodiment is configured to establish a third correspondence between the service plane virtual network card and the service plane logical network, and a fourth correspondence between the control plane virtual network card and the control plane logical port. a relationship; establishing a fifth correspondence between the business plane logical network and the business plane virtual bridge, and the control plane logical port and the control Establishing a sixth correspondence of the virtual bridge of the plane; establishing, according to the third correspondence and the fifth correspondence, the virtual network card of the service plane, the logical network of the service plane, and the virtual bridge of the service plane Establishing a first correspondence between the control plane virtual network card, the control plane logical port, and the control plane virtual bridge according to the fourth correspondence and the sixth correspondence .

In the above embodiment, the cloud computing platform 120 is configured to create a control plane logical network, create the control plane logical port under the control plane logical network, and define a virtual network card network port corresponding to the control plane logical port. The type is the first type. In this embodiment, after the virtual network card network port type corresponding to the logical port of the control plane is defined as the first type, the legality of the first type of the virtual network network port corresponding to the logical port of the control plane is also required, and the control is performed. The logical port is stored in the database for subsequent deployment server virtual machine calls. For example, if the control plane logical port name is Port-ctrl, the virtual network card network port type vnic_type corresponding to the control plane logical port Port-ctrl is ctrl type; the vnic_type corresponding to the Port-ctrl is ctrl type legality, and Port-ctrl is stored in the database for subsequent deployment server virtual machine calls.

The cloud computing platform 120 is further configured to generate a universally unique identifier of the control plane logical port, add the universally unique identifier to the control plane virtual network card; and establish the according to the universally unique identifier The fourth corresponding relationship between the virtual network card of the control plane and the logical port of the control plane, and the virtual network card network port of the control plane is marked as the first type in the fourth correspondence. In this embodiment, after the control plane logical port is created in the control plane logical network, the virtual network card network port type corresponding to the control plane logical port is defined as the first type. Therefore, after establishing the fourth correspondence between the control plane virtual network card and the control plane logical port, the control plane virtual network card network port type should be marked as the first type. Therefore, the control plane virtual network card network port needs to be marked into the first type in the fourth correspondence, wherein the first type may be the ctrl type described above.

The cloud computing platform 120 is further configured to: according to the virtual network card network port type corresponding to the control plane logical port, the first type, and the virtual bridge network port type corresponding to the control plane logical port is the first type. That is, the virtual network card network port type and the virtual bridge network port type corresponding to the logical port of the control plane are all defined as the first type. For example, vnic_type and vif_type corresponding to the control plane logical port whose name is Port-ctrl are ctrl type. After the cloud computing platform 120 establishes the sixth correspondence between the control plane logical port and the control plane virtual bridge, the network port of the control plane virtual bridge is marked in the sixth correspondence relationship. The first type. For example, the network port of the control plane virtual bridge is marked as ctrl in the sixth correspondence. The virtual bridge network port type corresponding to the control plane logical port is the first type. Therefore, after establishing the sixth correspondence between the control plane logical port and the control plane virtual bridge, the control plane virtual bridge network port type should be marked as the first type. Therefore, the control plane virtual bridge network port needs to be marked as the first type in the sixth correspondence, wherein the first type may be the ctrl type described above.

The cloud computing platform 120 is further configured to generate a first universal unique identifier of the service plane logical network, and add the first universal unique identifier to the service plane virtual network card, according to the first universal unique identifier And establishing a third correspondence between the virtual network card of the service plane and the logical network of the service plane.

The network port of the control plane virtual network card and the network port of the control plane virtual bridge in the second correspondence relationship in the embodiment are all marked as the first type. The cloud computing platform 120 is further configured to: according to the first correspondence, and the virtual network card of the control plane virtual network card corresponding to the control plane logical port in the second corresponding relationship, and the control plane virtual network The network ports of the bridge are all of the first type, and the virtual machine deployment file is generated; and the virtual machine of the server is deployed according to the virtual machine deployment file, so that the control plane and the service plane traffic are separated in the deployed virtual machine.

In the virtual machine deployment file generated in this embodiment, the first correspondence between the service plane virtual bridge and the service plane virtual network card and the logical network in the server is recorded; and the first correspondence is recorded. There is a second correspondence between the control plane virtual network card, the control plane logical port, and the control plane virtual bridge. The cloud computing platform 120 may determine, according to the first correspondence, a forwarding path of the service plane packet, and determine, according to the second correspondence, a forwarding path of the control plane packet. Deploying the server virtual machine according to the service plane packet forwarding path and the control plane packet forwarding path, so as to forward the forwarding service plane packet according to the service plane packet, and forward the packet according to the control plane packet forwarding path. The control plane message is controlled, so that the separation of the control plane and the service plane traffic in the server virtual machine can be realized. The virtual machine deployment file is an xml format file.

In the embodiment of the present invention, there may be multiple servers, and each server is configured with a service plane virtual bridge and a control plane virtual bridge. Referring to FIG. 5, FIG. 5 is another schematic structural diagram of a system for separating a control plane and a service plane according to an embodiment of the present invention. The control plane and business plane separation system 100 includes a plurality of servers 110 and a cloud computing platform 120. Each server 110 is configured to create a service plane virtual bridge and a control plane virtual bridge. The cloud computing platform 120 is further configured to create a server set, add all servers that create a service plane virtual bridge, a control plane virtual bridge to the server set; and according to the user's selection instruction, from the server A server is selected in the set, and the virtual machine of the selected server is deployed according to the first corresponding relationship and the second corresponding relationship, so that the control plane and the service plane traffic are separated in the deployed virtual machine.

The system for separating the control plane and the service plane provided by the foregoing embodiment creates a service plane virtual bridge and a control plane virtual bridge according to user instructions by the server; the cloud computing platform creates a service plane logic network according to user instructions. a control plane logical port; a service plane virtual network card and a control plane virtual network card; establishing a first corresponding relationship between the service plane virtual network card, the service plane logical network, and the service plane virtual bridge; and the control plane virtual a second correspondence between the network card, the control plane logical port, and the control plane virtual bridge; and the manner in which the virtual machine of the server is deployed according to the first correspondence and the second correspondence The service plane packet and the control plane packet in the server virtual machine are respectively forwarded through the corresponding forwarding paths, so that the control plane and the service plane traffic in the deployed virtual machine are completely separated.

The embodiment of the present invention further provides a server, wherein the server provided in this embodiment is the server 110 described in the system 100 with the control plane and the service plane separated, and details are not described herein again.

The embodiment of the present invention further provides a cloud computing platform, wherein the cloud computing platform provided by the embodiment is the cloud computing platform 120 in the system 100 of the control plane and the service plane separated, and details are not described herein.

The cloud computing platform involved in the above embodiments is an OpenStack cloud computing platform.

The above are only the preferred embodiments of the present invention, and are not intended to limit the scope of the invention, and the equivalent structure or equivalent process transformations made by the description of the present invention and the drawings are directly or indirectly applied to other related technical fields. The same is included in the scope of patent protection of the present invention.

Industrial applicability

The foregoing technical solution provided by the embodiment of the present invention can be applied to a control plane and a service plane separation process, and a server virtual gateway and a control plane virtual bridge are created by the server according to user instructions; the cloud computing platform is configured according to user instructions. Creating a business plane logical network, a control plane logical port, configuring a service plane virtual network card and a control plane virtual network card, and establishing a first correspondence of the service plane virtual network card, the service plane logical network, and the service plane virtual bridge And a second correspondence between the control plane virtual network card, the control plane logical port, and the control plane virtual bridge; and deploying the first correspondence and the second correspondence The mode of the virtual machine of the server is such that the service plane packet and the control plane packet in the server VM are respectively forwarded through the corresponding forwarding paths, thereby realizing the absolute separation of the control plane and the service plane traffic in the deployed virtual machine. .

Claims (18)

A method for separating a control plane and a service plane, the method for separating the control plane and the service plane includes the following steps: The server creates a service plane virtual bridge and a control plane virtual bridge according to user instructions; The cloud computing platform creates a business plane logical network and a control plane logical port according to user instructions; and configures a business plane virtual network card and a control plane virtual network card; Establishing a first mapping relationship between the service plane virtual network card, the service plane logical network, the service plane virtual bridge, and the control plane virtual network card, the control plane logical port, and the control plane virtual bridge The second correspondence of the three; The virtual machine of the server is deployed according to the first correspondence relationship and the second corresponding relationship, so that the separation of the control plane and the service plane traffic in the deployed virtual machine is implemented. The method for separating a control plane and a service plane according to claim 1, wherein a first correspondence between the service plane virtual network card, the service plane logical network, the service plane virtual bridge, and the control are established The second correspondence between the virtual network card, the control plane logical port, and the control plane virtual bridge includes: Establishing a third correspondence between the virtual network card of the service plane and the logical network of the service plane, and a fourth correspondence between the virtual network card of the control plane and the logical port of the control plane; Establishing a fifth correspondence between the service plane logical network and the service plane virtual bridge, and a sixth correspondence between the control plane logical port and the control plane virtual bridge; Establishing a first correspondence between the service plane virtual network card, the service plane logical network, and the service plane virtual bridge according to the third correspondence relationship and the fifth correspondence relationship; And establishing, according to the fourth correspondence relationship and the sixth correspondence relationship, a second correspondence between the control plane virtual network card, the control plane logical port, and the control plane virtual bridge. The method for separating a control plane and a service plane according to claim 1 or 2, wherein the step of creating a control plane logical port by the cloud computing platform comprises: The cloud computing platform creates a control plane logical network, and creates the control plane logical port under the control plane logical network, and defines a virtual network card network port type corresponding to the control plane logical port as the first type. The control plane and the service plane separation method according to claim 3, wherein the step of the cloud computing platform establishing the fourth correspondence between the control plane virtual network card and the control plane logical port comprises: The cloud computing platform generates a universally unique identifier of the control plane logical port, and adds the universal unique identifier to the control plane virtual network card; And establishing, according to the universal unique identifier, a fourth correspondence between the control plane virtual network card and the control plane logical port, and marking, in the fourth correspondence, the control plane virtual network card network port as the first type. The method of controlling plane and business plane separation according to claim 4, wherein said cloud computing platform defines said control After the step of the first type of the virtual network card network port corresponding to the logical port, the method further includes: The virtual computing network port type corresponding to the logical port of the control plane is a first type, and the virtual network port type corresponding to the logical port of the control plane is a first type; After the step of establishing, by the cloud computing platform, the sixth corresponding relationship between the control plane logical port and the control plane virtual bridge, the method further includes: marking, in the sixth correspondence, the network port of the control plane virtual bridge For the first type. The control plane and the service plane separation method according to claim 5, wherein the network port of the control plane virtual network card and the network port of the control plane virtual bridge in the second correspondence relationship are marked as the first Types of; The step of the cloud computing platform deploying the virtual machine of the server according to the first corresponding relationship and the second corresponding relationship to implement the separation of the control plane and the service plane traffic in the deployed virtual machine includes: The network computing platform according to the first correspondence, and the network port of the control plane virtual network card corresponding to the control plane logical port and the network port of the control plane virtual bridge according to the second corresponding relationship All are the first type, generating a virtual machine deployment file; According to the virtual machine deployment file, the virtual machine of the server is deployed to implement separation of control plane and service plane traffic in the deployed virtual machine. The method for controlling the control plane and the service plane separation according to claim 6, wherein the step of the cloud computing platform establishing the third correspondence between the service plane virtual network card and the service plane logical network comprises: Generating, by the cloud computing platform, a first universal unique identifier of the business plane logical network, adding the first universal unique identifier to the business plane virtual network card, and establishing the according to the first universal unique identifier The third correspondence between the virtual NIC of the service plane and the logical network of the service plane. The control plane and the service plane separation method according to claim 1, wherein the server is a plurality of servers, each of which is configured with the service plane virtual bridge and a control plane virtual bridge; When the number of the server is multiple, the cloud computing platform further includes: before the step of creating a service plane logical network and a control plane logical port according to user instructions: The cloud computing platform creates a server set, and adds all servers that have a business plane virtual bridge and a control plane virtual bridge to the server set; The step of the cloud computing platform deploying the virtual machine of the server according to the first corresponding relationship and the second corresponding relationship to implement the separation of the control plane and the service plane traffic in the deployed virtual machine includes: The cloud computing platform selects a server from the server set according to the user's selection instruction, deploys a virtual machine of the selected server according to the first correspondence and the second correspondence, and implements the deployed virtual machine. Separation of traffic between the control plane and the business plane. A control plane and a business plane separation system, wherein the control plane and the service plane separation system comprise: a server and a cloud computing platform; The server is configured to create a service plane virtual bridge and a control plane virtual bridge according to the user instruction; The cloud computing platform is configured to create a business plane logical network and a control plane logical port according to the user instruction; configure a service plane virtual network card and a control plane virtual network card; establish the service plane virtual network card, the service plane logical network, and the a first correspondence between the three virtual network bridges, and a second correspondence between the control plane virtual network card, the control plane logical port, and the control plane virtual bridge; according to the first correspondence And the second corresponding relationship, the virtual machine of the server is deployed, and the separation of the control plane and the service plane traffic in the deployed virtual machine is implemented. The control plane and the service plane separation system according to claim 9, wherein the cloud computing platform is configured to establish a third correspondence between the service plane virtual network card and the service plane logical network, and the control plane a fourth correspondence between the virtual network card and the logical port of the control plane; establishing a fifth correspondence between the logical network of the service plane and the virtual bridge of the service plane, and the logical port of the control plane and the virtual network of the control plane a sixth correspondence of the bridge; establishing, according to the third correspondence and the fifth correspondence, a first correspondence between the virtual network card of the service plane, the logical network of the service plane, and the virtual bridge of the service plane And establishing a second correspondence between the control plane virtual network card, the logical port, and the virtual bridge according to the fourth correspondence relationship and the sixth correspondence relationship. A control plane and business plane separation system according to claim 10, wherein The cloud computing platform is configured to create a control plane logical network, and the control plane logical port is created in the control plane logical network, and the virtual network card network port type corresponding to the control plane logical port is defined as the first type. A control plane and business plane separation system according to claim 11, wherein The cloud computing platform is further configured to generate a universally unique identifier of the control plane logical port, add the universally unique identifier to the control plane virtual network card; and establish the control according to the universally unique identifier The fourth corresponding relationship between the virtual network card and the logical port of the control plane, and the virtual network card network port of the control plane is marked as the first type in the fourth correspondence. A control plane and business plane separation system according to claim 12, wherein The cloud computing platform is further configured to: according to the virtual network card network port type corresponding to the control plane logical port, the first type, and the virtual bridge network port type corresponding to the control plane logical port is the first type; After the sixth corresponding relationship between the control plane logical port and the control plane virtual bridge is established, the network port of the control plane virtual bridge is marked as the first type in the sixth correspondence. A control plane and business plane separation system according to claim 13, wherein The network port of the control plane virtual network card and the network port of the control plane virtual bridge in the second correspondence are all marked as the first type; The cloud computing platform is further configured to: according to the first correspondence, and the network port of the control plane virtual network card corresponding to the control plane logical port in the second corresponding relationship, and the control plane virtual network The network ports of the bridge are all of a first type, and a virtual machine deployment file is generated; and the server is deployed according to the virtual machine deployment file. The virtual machine implements the separation of control plane and service plane traffic in the deployed virtual machine. The control plane and the service plane separation system according to claim 14, wherein the cloud computing platform is further configured to generate a first universal unique identifier of the service plane logical network, and add the service plane virtual network card And establishing, by the first universal unique identifier, a third correspondence between the service plane virtual network card and the service plane logical network according to the first universal unique identifier. The control plane and the service plane separation system according to claim 9, wherein the server is a plurality of servers, and each server is configured with a service plane virtual bridge and a control plane virtual bridge; The cloud computing platform is further configured to: when the server is multiple, create a server set, add all servers that create a service plane virtual bridge, a control plane virtual bridge to the server set; and according to the user Selecting a server, selecting a server from the set of servers, deploying a virtual machine of the selected server according to the first correspondence and the second correspondence, and implementing control plane and service plane traffic in the deployed virtual machine Separation. A server, the server of any one of claims 8-14. A cloud computing platform, the cloud computing platform of any one of claims 8-14.

Images