CN104506614A - Design method for distributed multi-activity data center based on cloud computing - Google Patents

Abstract

The invention discloses a design method of a distributed multi-active data center based on cloud computing, which includes the following steps: (1) The data center network adopts a large-scale two-layer architecture design, and implements a virtual machine through a large-scale two-layer network and VLAN extension. Large-scale transfer within the data center; (2) Virtual switch technology is used to implement fault isolation in the data center network; (3) The data center network uses board extension technology to access the switch, and the board extension technology can also allow data The central network is aware of the virtual machine; (4) Design and build a physically separated but logically integrated cross-data center network to realize the interconnection of data centers, and build a distributed virtualized data center based on the cross-data center network; (5) ) The security protection of the data center adopts multi-level security protection, including equipment-level security protection, network-level security protection, and system-level active security protection.

Description

A Design Method of Distributed Multi-Active Data Center Based on Cloud Computing

technical field

The invention relates to a design method of a distributed multi-active data center based on cloud computing, and belongs to the technical field of power system information construction.

Background technique

After the data is concentrated, the business activities of enterprises are increasingly dependent on IT infrastructure such as data centers and networks. The continuous operation of IT business throughout the day has become the goal pursued by large-scale enterprise IT construction operations and business operations. The data center is the core place of computer equipment and the key carrier of massive data. With the advent of the era of cloud computing and big data, the construction of data centers has set off a new upsurge. Data centers are developing towards large-scale intensification. The solution also raises higher demands. Green energy saving, intelligence, and automated management are the development trends of data centers.

For the purpose of disaster recovery, enterprises generally build two or more data centers. The main data center undertakes the user's core business, and other data centers mainly undertake some non-critical business and back up the data, configuration, business, etc. of the main center at the same time. Under normal circumstances, the main center and the backup center perform their respective duties. When a disaster occurs, the main data center goes down, and the backup data center can quickly restore data and applications, thereby reducing losses to users caused by the disaster.

Since disasters are rare events, with the method of one master and one backup, the backup data center can only play a role when a disaster occurs, and with the improvement of enterprise disaster recovery construction standards, more and more backup IT resources and funds will be invested. The larger it is, the more it is direct to each other and cannot be reused, resulting in waste. In addition, for the application of the master-standby mode, it takes a long time for the backup center to take over from the master center, and the relationship is complicated, which often seriously affects the user's business handling. In order to overcome the above shortcomings, users in many industries such as energy and electric power have begun to focus on the construction of "distributed multi-active data centers". The distributed multi-active data center distributes business to multiple data centers and provides customers with Service, distributed multi-active includes two key features—distributed and multi-active, reflecting new ideas for resource scheduling utilization and business deployment flexibility for enterprise-level users when building and using data centers.

Contents of the invention

The purpose of the present invention is to provide a cloud computing-based multi-distributed multi-active data center design method to solve the problem of network expansion within the data center and to meet the convenience of concurrent access to large data files after application programs drift on different servers , high speed and reliability.

In order to overcome the deficiencies in the prior art and solve the above-mentioned technical problems, the present invention adopts the following technical solution: a design method of a distributed multi-active data center based on cloud computing, which is characterized in that it includes the following steps:

(1) The data center network adopts a large-scale two-layer architecture design, and realizes the large-scale transfer of virtual machines in the data center through large-scale two-layer network and VLAN extension;

(2) Adopt virtual switch technology to realize fault isolation of data center network;

(3) The data center network uses the board extension technology to access the switch, and the board extension technology can also allow the data center network to perceive the virtual machine;

(4) Design and build a physically separated but logically integrated cross-data center network to realize the interconnection of data centers, and establish a distributed virtualized data center based on the cross-data center network, and the computing power can be distributed among different data centers free movement between

(5) The security protection of the data center adopts multi-level security protection, including equipment-level security protection, network-level security protection, and system-level active security protection.

Preferably, the step (2) includes: logically dividing a switch into multiple virtual switches, the virtual switches are completely separated, and each virtual switch has its own independent layer-2 and layer-3 protocols The stack and software process have their own independent administrators; since the software process of each virtual switch is completely independent, when a problem occurs in a certain virtual switch, it will not affect other virtual switches, realizing a perfect fault isolation.

Preferably, the step (3) includes: the board extension technology is implemented through the IEEE802.1qbh protocol, and the control plane and the forwarding plane of a plurality of TOR (Top of Rack, cabinet switch) switching units interconnected together are originally integrated Together, multiple switches are combined into one switch, and the original TOR access switches distributed in each rack become the remote board of the new switch; under the above architecture, the TOR switching unit is not a separate network element The management point does not use the two-layer spanning tree or the three-layer routing protocol to maintain the network topology.

Preferably, the step (3) includes: adopting IEEE801.1qbh-based card extension technology, installing a network card supporting the IEEE802.1qbh protocol in the server, the network card can be divided into multiple virtual network cards to correspond to the virtual machine, and at the same time The network card is also a remote board of the external switch, and can implement management and policy distribution on the external switch; the above method does not need to consume CPU resources of the server, so it has higher switching performance.

Preferably, the step (4) includes: the cross-data center network implements the connection of the data center network across the IP backbone network through OTV technology; the OTV technology uses a part of Eo-MPLS-OGRE data frame encapsulation, using A completely different control plane is established, the Adjacency relationship is established through ISIS, and the MAC address tables between data centers are exchanged; OTV technology only requires IP reachability for the IP backbone network, and does not require MPLS support, which greatly simplifies network maintenance. ; At the same time, due to the separation of the control plane and the forwarding plane, it effectively prevents the flooding of the Layer 2 network to the IP backbone network, and also does not need to span the spanning tree across the IP backbone network between data centers, which greatly improves the stability of the entire network .

Preferably, the step (5) includes: the network-level security includes user access authentication, authorization and auditing to prevent illegal access, transmission encryption to prevent information leakage and snooping, security division and isolation To prevent unauthorized access; the system-level active security protection includes allowing "healthy" machines to access the network through access control, preventing large-scale DDoS attacks through pre-detection instant distribution, and performing global security management; As a platform for information transmission, the network has the ability and opportunity to protect information resources in the first place. An intelligent defense network must be able to realize the so-called "foresight" and protect potential threats before they evolve into security attacks.

Preferably, the step (5) includes: the network-level security protection adopts ACL control, and an ACL is configured on the interface that allows network traffic to access the network, otherwise the data center network will reject the network traffic on the interface.

Preferably, the step (5) includes: the ACL includes a plurality of entries consisting of a series of statements, and each entry includes an entry allowing or denying network traffic (incoming and outgoing) to each part of the network specified in the entry Each entry further includes a filter unit based on source address, destination address, protocol, and protocol-specific parameters, and each ACL has an implicit rejection of all entries at the end.

The beneficial effects achieved by the present invention: through the VPC virtual machine technology and the board extension technology, the problem of network expansion inside the data center is realized, and the convenience and high speed of concurrent access to large data files after the application program drifts on different servers are satisfied. performance and reliability.

The meaning of the English marks in the manual:

TOR: Top of Rack, cabinet switch;

OTV: Overlay Transport Virtualization, overlay transmission virtualization;

ISIS: Intermediate system to intermediate system, a hierarchical link state routing protocol;

Adjacency: adjacency, the association between selected adjacent routers and end nodes;

MPLS: Multi-Protocol Label Switching, a system for fast data packet switching and routing, which provides destination, routing address, forwarding and switching capabilities for network data traffic;

DDoS: Distributed Denial of Service, distributed denial of service attack, refers to the use of client/server technology to combine multiple computers as an attack platform to launch DDoS attacks on one or more targets, thereby doubling the probability of denial of service attacks power;

ACL: Access Control List, access control list, is a list of instructions for router and switch interfaces, used to control the data packets entering and leaving the port;

OGRE: Object-Oriented Graphics Rendering Engine, the object-oriented graphics rendering engine is a scene-oriented and very flexible 3D engine developed in C++.

Description of drawings

FIG. 1 is a flowchart of a design method of a distributed multi-active data center based on cloud computing in the present invention.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings. The following examples are only used to illustrate the technical solution of the present invention more clearly, but not to limit the protection scope of the present invention.

As shown in Figure 1 is a flow chart of the design method of a distributed multi-active data center based on cloud computing according to the present invention. The present invention provides a design method of a distributed multi-active data center based on cloud computing to solve data The network expansion problem inside the center satisfies the convenience, high speed and reliability of concurrent access to large data files after the application program drifts on different servers. The present invention includes the following steps:

(1) The data center network adopts a large-scale two-layer architecture design, and realizes the large-scale transfer of virtual machines in the data center through large-scale two-layer network and VLAN extension;

(2) Adopt virtual switch technology to realize fault isolation of data center network;

(3) The data center network uses the board extension technology to access the switch, and the board extension technology can also allow the data center network to perceive the virtual machine;

(4) Design and build a physically separated but logically integrated cross-data center network to realize the interconnection of data centers, and establish a distributed virtualized data center based on the cross-data center network, and the computing power can be distributed among different data centers free movement between

(5) The security protection of the data center adopts multi-level security protection, including equipment-level security protection, network-level security protection, and system-level active security protection.

Preferably, the step (2) includes: logically dividing a switch into multiple virtual switches, the virtual switches are completely separated, and each virtual switch has its own independent layer-2 and layer-3 protocols The stack and software process have their own independent administrators; since the software process of each virtual switch is completely independent, when a problem occurs in a certain virtual switch, it will not affect other virtual switches, realizing a perfect fault isolation.

Preferably, the step (3) includes: the board extension technology is implemented through the IEEE802.1qbh protocol, and the control plane and the forwarding plane of a plurality of TOR (Top of Rack, cabinet switch) switching units interconnected together are originally integrated Together, multiple switches are combined into one switch, and the original TOR access switches distributed in each rack become the remote board of the new switch; under the above architecture, the TOR switching unit is not a separate network element The management point does not use the two-layer spanning tree or the three-layer routing protocol to maintain the network topology.

Preferably, the step (3) includes: adopting IEEE801.1qbh-based card extension technology, installing a network card supporting the IEEE802.1qbh protocol in the server, the network card can be divided into multiple virtual network cards to correspond to the virtual machine, and at the same time The network card is also a remote board of the external switch, and can implement management and policy distribution on the external switch; the above method does not need to consume CPU resources of the server, so it has higher switching performance.

Preferably, the step (4) includes: the cross-data center network implements the connection of the data center network across the IP backbone network through OTV technology; the OTV technology uses a part of Eo-MPLS-OGRE data frame encapsulation, using A completely different control plane is established, the Adjacency relationship is established through ISIS, and the MAC address tables between data centers are exchanged; OTV technology only requires IP reachability for the IP backbone network, and does not require MPLS support, which greatly simplifies network maintenance. ; At the same time, due to the separation of the control plane and the forwarding plane, it effectively prevents the flooding of the Layer 2 network to the IP backbone network, and at the same time does not need to span the IP backbone network between the data centers, which greatly improves the stability of the entire network. .

Preferably, the step (5) includes: the network-level security includes user access authentication, authorization and auditing to prevent illegal access, transmission encryption to prevent information leakage and snooping, security division and isolation To prevent unauthorized access; the system-level active security protection includes allowing "healthy" machines to access the network through access control, preventing large-scale DDoS attacks through pre-detection instant distribution, and performing global security management; As a platform for information transmission, the network has the ability and opportunity to protect information resources in the first place. An intelligent defense network must be able to realize the so-called "foresight" and protect potential threats before they evolve into security attacks.

Preferably, the step (5) includes: the network-level security protection adopts ACL control, and an ACL is configured on the interface that allows network traffic to access the network, otherwise the data center network will reject the network traffic on the interface.

Preferably, the step (5) includes: the ACL includes a plurality of entries consisting of a series of statements, and each entry includes an entry allowing or denying network traffic (incoming and outgoing) to each part of the network specified in the entry Each entry further includes a filter unit based on source address, destination address, protocol, and protocol-specific parameters, and each ACL has an implicit rejection of all entries at the end.

The above is only a preferred embodiment of the present invention, it should be pointed out that for those of ordinary skill in the art, without departing from the technical principle of the present invention, some improvements and modifications can also be made. It should also be regarded as the protection scope of the present invention.

Claims (8)

1., based on the method for designing at distributed many live datas center of cloud computing, it is characterized in that, comprise the following steps:

(1) data center network adopts large two-tiered structure to design, and is extended by extensive double layer network and VLAN, realizes the transfer on a large scale of virtual machine interior portion in the data;

(2) virtual switch technology is adopted to realize the Fault Isolation of data center network;

(3) data center network adopts board elongation technology to carry out access switch, and described board elongation technology can allow data center network perceive virtual machine simultaneously;

(4) design construction be physically separated but in logic one realize the interconnected of data center across data center network, and based on the described data center setting up distributed virtualization across data center network, computing capability can flow freely between different data centers;

(5) security protection of data center adopts multi-level security protection, comprises the security protection of device level, the security protection of network level, the protection of system-level active safety.

2. the method for designing at a kind of distributed many live datas center based on cloud computing according to claim 1, it is characterized in that, described step (2) comprising: a switch is logically divided into multiple virtual switch, thoroughly be separated between described virtual switch, each virtual switch has separately protocol stack and the software process of independently two layers and three layers, has respective independently keeper.

3. the method for designing at a kind of distributed many live datas center based on cloud computing according to claim 1, it is characterized in that, described step (3) comprising: described board elongation technology is by IEEE802.1qbh protocol realization, originally the control plane and Forwarding plane that are interconnected at multiple TOR crosspoints are together merged, form the state that multiple group of switches synthesizes a switch, original TOR access switch being distributed in each frame just becomes the long-range board of new switch.

4. the method for designing at a kind of distributed many live datas center based on cloud computing according to claim 3, it is characterized in that, described step (3) comprising: adopt the board elongation technology based on IEEE801.1qbh, at the network interface card of the in-built one piece of support IEEE802.1qbh agreement of server, described network interface card can be divided into multiple empty network interface card to be come and virtual machine correspondence, described network interface card is also the long-range board of external switch simultaneously, can realize managing and tactful issuing on external switch.

5. the method for designing at a kind of distributed many live datas center based on cloud computing according to claim 1, it is characterized in that, described step (4) comprising: the described network across data center realizes passing through getting through of the data center network of IP backbone by OTV technology; Described OTV technology uses the Frame encapsulation of a part of Eo-MPLS-OGRE, have employed diverse control plane, sets up Adjacency relation by ISIS, and the mac address table between swap data center.

6. the method for designing at a kind of distributed many live datas center based on cloud computing according to claim 1, it is characterized in that, described step (5) comprising: the safety of described network level comprises carries out access authentication of user, mandate and audit to prevent illegal access, carry out Transmission Encryption to prevent the leakage of information and to spy out, carry out safety and divide and isolate with the access prevented as authorizing; Described system-level active safety protection comprises the machine ability access network being made " health " by access control, prevents Large Scale DDoS Attack, carry out the safety management of the overall situation by detecting instant shunting in advance.

7. the method for designing at a kind of distributed many live datas center based on cloud computing according to claim 6, it is characterized in that, described step (5) comprising: described network level security protection adopts ACL to control, a configuration ACL on the interface allowing network traffics access network, otherwise data center network is by the network traffics on the described interface of refusal.

8. the method for designing at a kind of distributed many live datas center based on cloud computing according to claim 7, it is characterized in that, described step (5) comprising: described ACL comprises multiple entry be made up of a series of statement, described each entry comprises the performance element of the network parts that allows or specify in refusal network traffics arrival entry, described each entry also comprises a filter unit based on source address, destination address, agreement, agreement special parameter, the last entry having the refusal of an implicit expression whole of described each ACL.