CN115442367A - Data transmission method, virtual private cloud, device, medium and product - Google Patents

Abstract

The application discloses a data transmission method, a virtual private cloud, a device, a medium and a product. The data transmission method is applied to a first virtual private cloud, wherein a first exclusive gateway is arranged in the first virtual private cloud, and the method comprises the following steps: under the condition that a first virtual machine in a first virtual private cloud needs to transmit first data to a second virtual machine in a second virtual private cloud, the first virtual machine sends the first data to a first exclusive gateway; the first exclusive gateway forwards the first data to a second exclusive gateway arranged in a second virtual private cloud, so that the second exclusive gateway forwards the first data to the second virtual machine. According to the embodiment of the application, the safety and the expandability can be improved, and the fault isolation control can be realized.

Description

Data transmission method, virtual private cloud, equipment, medium and product

technical field

The present application belongs to cloud technology, and in particular relates to a data transmission method, a virtual private cloud, equipment, media and products.

Background technique

With the continuous development of cloud technology, more and more data is stored in cloud servers, and tenants on the cloud usually deploy different services in different VPCs (Virtual Private Clouds) based on business data. In order to achieve network isolation between different services. Among them, VPC is a private cloud that exists in a shared or public cloud, and is a basic network isolation domain.

In the existing cloud computing network architecture, the way to realize data intercommunication between different VPCs is mainly by exposing the business interface in the VPC on the public network, and communicating with other VPCs through the service interface exposed on the public network, or using peer-to-peer Products such as connectivity or cloud networking rely on centralized gateway nodes for communication.

In this way, the way of data transmission between different VPCs in the prior art at least has the problems of poor security, poor scalability, and failure to implement fault isolation control.

Contents of the invention

Embodiments of the present application provide a data transmission method, virtual private cloud, equipment, media, and products, which can improve security, scalability, and implement fault isolation control.

In the first aspect, the embodiment of the present application provides a data transmission method applied to a first virtual private cloud, where a first dedicated gateway is set in the first virtual private cloud, and the method includes:

When the first virtual machine in the first virtual private cloud needs to transmit the first data to the second virtual machine in the second virtual private cloud, the first virtual machine sends the first data to the The first dedicated gateway;

The first dedicated gateway forwards the first data to a second dedicated gateway set in the second virtual private cloud, so that the second dedicated gateway forwards the first data to the second virtual machine .

In the second aspect, the embodiment of the present application provides a virtual private cloud, the virtual private cloud is provided with a first dedicated gateway, the virtual private cloud includes a plurality of virtual machines, and the plurality of virtual machines include at least first virtual machine;

The first virtual machine is configured to send the first data to the first dedicated gateway when the first data needs to be transmitted to the second virtual machine in the second virtual private cloud;

The first dedicated gateway is configured to forward the first data to a second dedicated gateway set in the second virtual private cloud, so that the second dedicated gateway forwards the first data to the second dedicated gateway. Two virtual machines.

In a third aspect, an embodiment of the present application provides an electronic device, and the electronic device includes: a processor and a memory storing computer program instructions;

When the processor executes the computer program instructions, the steps of the data transmission method described in any one embodiment of the first aspect are implemented.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which computer program instructions are stored, and when the computer program instructions are executed by a processor, the implementation as in any one of the embodiments of the first aspect The steps of the data transmission method.

In the fifth aspect, the embodiment of the present application provides a computer program product. When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device executes the computer program described in any one of the embodiments of the first aspect. The steps of the data transfer method.

In the data transmission method, virtual private cloud, equipment, medium and product in the embodiment of the present application, by setting a dedicated gateway in each virtual private cloud, the first virtual machine in the first virtual private cloud needs to transfer to the second virtual private cloud. When the second virtual machine in the cloud transmits the first data, the first virtual machine sends the first data to the first dedicated gateway set in the first virtual private cloud, and the first dedicated gateway sends the first The data is forwarded to the second dedicated gateway set in the second virtual private cloud, so that the second dedicated gateway forwards the first data to the second virtual machine. In this way, since the embodiment of the present application does not need to expose the service interfaces of the virtual machines in each virtual private cloud to the public network, the security of data transmission can be improved. In addition, since each virtual private cloud has its own dedicated gateway, and the dedicated gateway only bears the business traffic related to the VPC, it can improve the scalability of business data services. At the same time, different virtual private clouds do not share gateway nodes. Compared with the existing communication methods that rely on centralized gateway nodes, the embodiment of this application only affects the data services of this VPC when the dedicated gateway node fails. Therefore, The impact range of the fault can be controlled within the VPC to realize fault isolation control.

Description of drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the accompanying drawings that need to be used in the embodiments of the present application. Additional figures can be derived from these figures.

FIG. 1 is a schematic structural diagram of a network architecture to which a data transmission method provided in an embodiment of the present application is applicable;

FIG. 2 is a schematic flow diagram of a data transmission method provided by an embodiment of the present application;

FIG. 3 is a schematic structural diagram of a data transmission device provided by an embodiment of the present application;

Fig. 4 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.

detailed description

The characteristics and exemplary embodiments of various aspects of the application will be described in detail below. In order to make the purpose, technical solution and advantages of the application clearer, the application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described here are only intended to explain the present application rather than limit the present application. It will be apparent to one skilled in the art that the present application may be practiced without some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by showing examples of the present application.

It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is a relationship between these entities or operations. any such actual relationship or order exists between them. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or apparatus. Without further limitations, an element defined by the statement "comprising..." does not exclude the presence of additional same elements in the process, method, article or device comprising said element.

At present, in the existing cloud computing IAAS (Infrastructure as a Service, Infrastructure as a Service) network architecture, such as OpenStack and other cloud architectures, the intercommunication between different VPCs is mainly realized through the following two methods.

One is to use the public network to achieve communication. The VPC will expose the service interface through the public network IP, and other VPCs will communicate through the service interface exposed on the public network.

The second is to use products such as peer-to-peer connections or cloud networking to achieve communication. Peer-to-peer connections or cloud networking products will rely on centralized gateway nodes. The intercommunication between different VPCs needs to establish peer-to-peer connections or join cloud networking instances. The data to be transmitted is forwarded to the gateway node through the routing table, and then further forwarded to other VPCs by the gateway node.

In the above two implementation methods, for the communication method using the public network, the public network IP resources need to be consumed, and the business will be exposed to the public network, which makes the security poor, and the resource cost of the public network is high, and the resource Limited, there is a problem of poor scalability; in addition, for the way of relying on centralized gateway nodes for forwarding, different data flows will affect each other, and if one of the gateway nodes fails, it will affect the communication between all VPCs , unable to achieve fault isolation control, low reliability and stability.

In order to solve the problems in the prior art, the embodiments of the present application provide a data transmission method, a virtual private cloud, equipment, media and products. The data transmission method can be applied to a scenario where data is transmitted between different VPCs. The network architecture to which the data transmission method provided by the embodiment of the present application is first introduced below.

FIG. 1 is a schematic structural diagram of a network architecture to which a data transmission method provided in an embodiment of the present application is applicable.

As shown in FIG. 1 , the network architecture may include multiple virtual private clouds, such as a first virtual private cloud 11 , a second virtual private cloud 12 and a third virtual private cloud 13 . Wherein, each virtual private cloud may include multiple virtual machines, and each virtual private cloud is provided with a dedicated gateway. For example, the first virtual private cloud 11 may include multiple virtual machines including the first virtual machine 111 , and the first dedicated gateway 112 is set. As another example, the second virtual private cloud 12 may include multiple virtual machines including the second virtual machine 121 , and is provided with a second dedicated gateway 122 .

An information transmission tunnel can be established between any two dedicated gateways. Based on this, any two virtual private clouds can communicate through their respective dedicated gateways and the information transmission tunnel established between the dedicated gateways.

In addition, the dedicated gateway of each virtual private cloud may include a main gateway and a backup gateway, for example, the first dedicated gateway 112 may include a main gateway 1121 and a backup gateway 1122 . Wherein, the main gateway and the standby gateway have the same function, so that when the main gateway fails, the standby gateway can be activated in time to improve the stability and reliability of data transmission.

Exemplarily, the creation process of the dedicated gateway can be to create two virtual machines in the VPC that need to communicate with each other, and at least two network cards can be set in each virtual machine, and one network card is used to configure the virtual IP facing the inside of the VPC address to realize communication with other virtual machines inside the current VPC, and a network card is used to configure a virtual IP address facing outside the VPC to realize communication with dedicated gateways in other VPCs. These two virtual machines can form A dedicated gateway. Among them, keepalived software can be configured between the two virtual machines to maintain heartbeat monitoring and ensure that when one of the virtual machines fails, the other virtual machine can be started in time.

Based on the foregoing network architecture, the data transmission method provided by the embodiment of the present application is introduced in detail below.

Fig. 2 is a schematic flowchart of a data transmission method provided by an embodiment of the present application. The data transmission method may be executed by any virtual private cloud in FIG. 1 , for example, by the first virtual private cloud 11 .

As shown in Figure 2, the data transmission method may specifically include the following steps:

S210. When the first virtual machine in the first virtual private cloud needs to transmit the first data to the second virtual machine in the second virtual private cloud, the first virtual machine sends the first data to the first dedicated gateway;

S220. The first dedicated gateway forwards the first data to the second dedicated gateway set in the second virtual private cloud, so that the second dedicated gateway forwards the first data to the second virtual machine.

Thus, by setting a dedicated gateway in each virtual private cloud, when the first virtual machine in the first virtual private cloud needs to transmit the first data to the second virtual machine in the second virtual private cloud, the second A virtual machine sends the first data to the first dedicated gateway set in the first virtual private cloud, and the first dedicated gateway forwards the first data to the second dedicated gateway set in the second virtual private cloud, so that Make the second dedicated gateway forward the first data to the second virtual machine. In this way, since the embodiment of the present application does not need to expose the service interfaces of the virtual machines in each virtual private cloud to the public network, the security of data transmission can be improved. In addition, since each virtual private cloud has its own dedicated gateway, and the dedicated gateway only bears the business traffic related to the VPC, it can improve the scalability of business data services. At the same time, different virtual private clouds do not share gateway nodes. Compared with the existing communication methods that rely on centralized gateway nodes, the embodiment of this application only affects the data services of this VPC when the dedicated gateway node fails. Therefore, The impact range of the fault can be controlled within the VPC to realize fault isolation control.

The specific implementation of each of the above steps is introduced below.

In some implementations, in S110, referring to the network architecture shown in FIG. 1, if the first virtual machine 111 in the first virtual private cloud 11 needs to transmit the second First, the first virtual machine 111 sends the first data to be transmitted to the first dedicated gateway 112 .

Here, the first dedicated gateway 112 may be pre-configured with a first virtual address when created, and the first virtual address may be a virtual IP address of the first dedicated gateway 112 facing inside the first virtual private cloud 11 .

Based on this, in some implementation manners, the above S210 may specifically include:

The first virtual machine uses the first virtual address as a next-hop address, and sends the first data to the first dedicated gateway.

Here, since the first virtual address is the internal IP address of the first dedicated gateway in the first virtual private cloud, when the first virtual machine needs to send When sending data, the first virtual address configured by the first dedicated gateway can be used as the next hop address to send data, so as to send the data to the first dedicated gateway.

In this way, by using the first virtual address as the next hop address to send the first data, it is possible to send the first data from the first virtual machine to the first dedicated gateway, and then send the first virtual private gateway to the first virtual private gateway based on the first dedicated gateway. Other virtual private clouds other than the cloud send the first data.

In some implementations, in S120, referring to the network architecture shown in FIG. 1 , after the first virtual machine 111 in the first virtual private cloud 11 sends the first data to be transmitted to the first dedicated gateway 112, the second A dedicated gateway 112 can find the second dedicated gateway 122 in the second virtual private cloud 12 where the second virtual machine 121 is located by querying the routing table, and then the first dedicated gateway 112 can forward the received first data to the second dedicated gateway 122, so that the second dedicated gateway 122 finally forwards the first data to the corresponding virtual machine in the second virtual private cloud 12, that is, the second virtual machine 121.

In addition, the second dedicated gateway 122 may be pre-configured with a second virtual address when it is created, and the second virtual address may be a virtual IP address of the second dedicated gateway 122 facing outside the second virtual private cloud 12 .

Based on this, in some implementation manners, the above S220 may specifically include:

The first dedicated gateway uses the second virtual address as a next-hop address, and sends the first data to the second dedicated gateway.

Here, since the second virtual address is the IP address of the second dedicated gateway between the dedicated gateways, when the first dedicated gateway needs to send data to the virtual machine in the second virtual private cloud, the second dedicated The second virtual address configured by the gateway is used as the next hop address to send data, so as to send the data to the second dedicated gateway.

In this way, by using the second virtual address as the next hop address to send the first data, the first data can be sent from the first dedicated gateway to the second dedicated gateway, so that the second dedicated gateway can forward the first data For corresponding virtual machines in the second virtual private cloud, communication between the first virtual private cloud and the second virtual private cloud is realized.

It should be noted that, in the above embodiment, the virtual machine in the second virtual private cloud can also send data to the virtual machine in the first virtual private cloud according to a process similar to the above process. Similarly, the first virtual private cloud And the virtual machine in the second virtual private cloud can also send data to the virtual machine in other virtual private clouds according to the process similar to the above process, so as to realize the intercommunication between any two virtual private clouds in the multiple virtual private clouds.

In addition, in some implementation manners, a third virtual address may also be configured in the first dedicated gateway, and the third virtual address may be a virtual IP address of the first dedicated gateway facing outside the first virtual private cloud.

Based on this, before the first dedicated gateway uses the second virtual address as the destination address and sends the first data to the second dedicated gateway, the data transmission method provided by the embodiment of the present application may further include:

An information transmission tunnel is constructed between the first dedicated gateway and the second dedicated gateway based on the third virtual address and the second virtual address.

Correspondingly, the above-mentioned first dedicated gateway uses the second virtual address as the next hop address, and the step of sending the first data to the second dedicated gateway may specifically include:

The first dedicated gateway uses the second virtual address as the next-hop address, and sends the first data to the second dedicated gateway based on the information transmission tunnel.

Here, before using the dedicated gateways to transmit data, it is necessary to build information transmission tunnels between the dedicated gateways. Wherein, the information transmission tunnel may be, for example, a VXLAN (Virtual Extensible Local Area Network, virtual extended local area network) tunnel.

Exemplarily, the virtual IP addresses configured in the dedicated gateway facing outside the virtual private cloud to which it belongs can be used to construct VXLAN tunnels two by two, and assign VNI (VXLAN Network Identifier, VXLAN network identifier), so that any two dedicated gateways Data can be transmitted between the VXLAN tunnels, and the allocated VNI can be used to perform corresponding data encapsulation before transmission, so as to ensure the isolation between data in different tunnels during data transmission. In this way, the fully interconnected network structure of FullMesh between different virtual private clouds can be completed by building tunnels.

Specifically, taking the first dedicated gateway and the second dedicated gateway as an example, the third virtual address configured in the first dedicated gateway and the second virtual address configured in the second dedicated gateway can be used to connect the first dedicated gateway and the second dedicated gateway. Build a VXLAN tunnel between the dedicated gateways, and allocate the VNI corresponding to the VXLAN tunnel. In this way, the first dedicated gateway can send the first data to the second dedicated gateway through the VXLAN tunnel with the second dedicated gateway, so that the second dedicated gateway can forward the first data to the second virtual private cloud inside the second virtual private cloud. machine, so as to finally realize the intercommunication between the first virtual private cloud and the second virtual private cloud.

In addition, in order to accurately find the corresponding dedicated gateway in the virtual private cloud where the second virtual machine is located, in some implementations, before the above S220, the data transmission method provided by the embodiment of the present application may further include:

Obtaining target routing information between the first virtual machine and the second virtual machine according to the first destination address, where the first destination address is a virtual machine address of the second virtual machine in the second virtual private cloud;

Based on the destination routing information, a second dedicated gateway corresponding to the first destination address is determined.

Here, after the VPC joins the network and before communicating with other VPCs in the network, BGP (Border Gateway Protocol) can also be started in the dedicated gateway of the joined VPC, and the routing information of this VPC can be published to update The routing table completes the routing publishing and learning between dedicated gateways.

Based on this, before the first virtual machine sends the first data, it can set the destination address corresponding to the first data to be sent, that is, the first destination address, which can specifically be the address of the second virtual machine in the second virtual private cloud. virtual machine address. In this way, before the first dedicated gateway forwards the first data to the second dedicated gateway, it can first query the routing table according to the first destination address to obtain the target routing information between the first virtual machine and the second virtual machine, and through the The target routing information can determine the VPC to which the first destination address belongs, that is, the second virtual private cloud, and then the second dedicated gateway corresponding to the second virtual private cloud can be queried, and the first dedicated gateway can be the second dedicated gateway The corresponding external virtual IP address is a next-hop address, which accurately sends the first data to the dedicated gateway in the VPC where the second virtual machine is located.

In addition, in some implementation manners, before the above step of obtaining the target routing information between the first virtual machine and the second virtual machine according to the first destination address, this embodiment of the present application may further include:

Based on the Border Gateway Protocol BGP, using the virtual machine addresses corresponding to the virtual machines in the first virtual private cloud and the second virtual private cloud, any virtual machine in the first virtual private cloud and the virtual machine in the second virtual private cloud A BGP peer is established between any virtual machines to obtain routing information between any virtual machine in the first virtual private cloud and any virtual machine in the second virtual private cloud.

Correspondingly, the above-mentioned step of obtaining target routing information between the first virtual machine and the second virtual machine according to the first destination address may specifically include:

According to the first destination address, the destination routing information between the first virtual machine and the second virtual machine is obtained from the routing information.

Here, when the first virtual private cloud joins the network, it is also necessary to start BGP in the first dedicated gateway, using the internal addresses at both ends of the tunnel, for example, any virtual machine in the first virtual private cloud and any virtual machine in the second virtual private cloud The virtual machine addresses corresponding to the virtual machines respectively construct BGP peers, and then the routing information between any virtual machine in the first virtual private cloud and any virtual machine in the second virtual private cloud can be obtained.

In this way, based on the generated routing information, the target routing information from the virtual machine address corresponding to the first virtual machine to the first destination address can be queried, and then the target routing information can be used to determine the private virtual private cloud to which the second virtual machine belongs. gateway.

It should be noted that, in addition to establishing routing information with the second virtual private cloud, the first virtual private cloud can also establish routing information with other virtual private clouds in the same manner, so as to communicate with other virtual private clouds.

In addition, in some implementations, after obtaining the routing information between any virtual machine in the first virtual private cloud and any virtual machine in the second virtual private cloud, the data transmission method provided in the embodiment of the present application Can also include:

Publish routing information.

Here, after the first dedicated gateway generates the routing information, it can also publish the routing information to other virtual private clouds based on BGP, so as to complete the routing publishing and learning between the dedicated gateways.

In addition, in order to further improve the reliability and stability of communication between VPCs, in some implementations, the above-mentioned first virtual private cloud may also include a main gateway and a backup gateway, such as the first virtual private cloud 11 in FIG. 1 The first dedicated gateway 112 may include a main gateway 1121 and a standby gateway 1122 .

Based on this, the data transmission method provided in the embodiment of the present application may also include:

Determine whether the main gateway communication is normal;

When the main gateway communicates normally, use the main gateway as the first dedicated gateway;

When the communication of the main gateway is abnormal, the backup gateway is used as the first dedicated gateway.

Here, keepalived software can be configured between the main gateway and the backup gateway to maintain heartbeat monitoring. In this way, when the backup gateway detects that the communication of the main gateway is normal, the gateway function can not be activated, and the main gateway can continue to be used as the first virtual private cloud corresponding to the first dedicated gateway, and when the standby gateway detects that the communication of the main gateway is abnormal, the gateway function can be activated, and then the standby gateway can be used as the first dedicated gateway corresponding to the first virtual private cloud. Wherein, the situation of abnormal communication may include, for example, abnormal situations such as too slow network speed, power failure, and network disconnection.

In addition, after the standby gateway is started, the communication of the main gateway can be monitored in real time to see if the communication of the standby gateway is normal, so as to switch back to the main gateway when the communication of the standby gateway is abnormal.

In this way, through the switching between the active and standby gateways, the normal communication of the first dedicated gateway can be ensured as much as possible, so that the reliability and stability of the communication between VPCs can be further improved.

In addition, the first virtual private cloud can also receive data sent by other virtual private clouds. In some implementations, the data transmission method provided by the embodiment of the present application can also include:

When the first dedicated gateway receives the second data sent by other dedicated gateways, the first dedicated gateway sends the second data to the first virtual private cloud according to the second destination address corresponding to the second data. The virtual machine corresponding to the address.

For example, when the first dedicated gateway receives the second data sent by the dedicated gateway in other virtual private clouds, it can obtain the second destination address corresponding to the second data carried therein, that is, the address that needs to receive the second data virtual machine IP address, because the second destination address is the internal address in the first virtual private cloud, therefore, the first dedicated gateway can directly use the second destination address as the next-hop address, and use the second destination address in the first virtual private cloud The second data is forwarded to the corresponding virtual machine.

To sum up, through the data transmission method provided by the embodiment of the present application, the intercommunication between different VPCs can be realized.

It should be noted that the application scenarios described in the above embodiments of the present application are for more clearly illustrating the technical solutions of the embodiments of the present application, and do not constitute limitations on the technical solutions provided by the embodiments of the present application. Those of ordinary skill in the art know that, With the emergence of new application scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

Based on the same inventive concept, the present application also provides a virtual private cloud. It will be described in detail with reference to FIG. 3 .

Fig. 3 is a schematic structural diagram of a virtual private cloud provided by an embodiment of the present application.

As shown in FIG. 3 , the virtual private cloud 300 may include multiple virtual machines, the multiple virtual machines include at least a first virtual machine 301 , and a first dedicated gateway 302 is set in the virtual private cloud 300 .

Wherein, the first virtual machine 301 is configured to send the first data to the first dedicated gateway 302 when the first data needs to be transmitted to the second virtual machine in the second virtual private cloud;

The first dedicated gateway 302 is configured to forward the first data to the second dedicated gateway set in the second virtual private cloud, so that the second dedicated gateway forwards the first data to the second virtual machine.

The above-mentioned data transmission device 300 will be described in detail below, specifically as follows:

In some of these embodiments, the first dedicated gateway 302 is configured with a first virtual address;

The first virtual machine 301 is further configured to use the first virtual address as a next-hop address, and send the first data to the first dedicated gateway.

In some of these embodiments, the second dedicated gateway is configured with a second virtual address;

The first dedicated gateway 302 is further configured to use the second virtual address as a next-hop address, and send the first data to the second dedicated gateway.

In some of these embodiments, a third virtual address is configured in the first dedicated gateway;

The first dedicated gateway 302 is further configured to, before sending the first data to the second dedicated gateway using the second virtual address as the destination address, based on the third virtual address and the second virtual address, constructing an information transmission tunnel between the first dedicated gateway and the second dedicated gateway;

The first dedicated gateway 302 is further configured to use the second virtual address as a next-hop address, and send the first data to the second dedicated gateway based on the information transmission tunnel.

In some of these embodiments, the first dedicated gateway 302 is further configured to obtain the first Destination routing information between a virtual machine and the second virtual machine, wherein the first destination address is a virtual machine address of the second virtual machine in the second virtual private cloud;

The first dedicated gateway 302 is further configured to determine the second dedicated gateway corresponding to the first destination address based on the target routing information.

In some of these embodiments, the first dedicated gateway 302 is further configured to, based on Border Gateway Protocol BGP, before obtaining the target routing information between the first virtual machine and the second virtual machine according to the first destination address, Using the virtual machine addresses corresponding to the virtual machines in the first virtual private cloud and the second virtual private cloud, any virtual machine in the first virtual private cloud and the second virtual private cloud Build a BGP peer between any virtual machine in the virtual private cloud to obtain routing information between any virtual machine in the first virtual private cloud and any virtual machine in the second virtual private cloud;

The first dedicated gateway 302 is further configured to obtain destination routing information between the first virtual machine and the second virtual machine from the routing information according to the first destination address.

In some of these embodiments, the first dedicated gateway 302 is further configured to obtain routing information between any virtual machine in the first virtual private cloud and any virtual machine in the second virtual private cloud , publish the routing information.

In some of these embodiments, the first virtual private cloud includes a main gateway and a backup gateway;

The standby gateway is used to determine whether the communication of the main gateway is normal; if the communication of the main gateway is normal, use the main gateway as the first dedicated gateway; if the communication of the main gateway is abnormal, The standby gateway is used as the first dedicated gateway.

In some of these embodiments, the first dedicated gateway 302 is further configured to, when receiving second data sent by other dedicated gateways, send the second data to to the virtual machine corresponding to the second destination address in the first virtual private cloud.

Thus, by setting a dedicated gateway in each virtual private cloud, when the first virtual machine in the first virtual private cloud needs to transmit the first data to the second virtual machine in the second virtual private cloud, the second A virtual machine sends the first data to the first dedicated gateway set in the first virtual private cloud, and the first dedicated gateway forwards the first data to the second dedicated gateway set in the second virtual private cloud, so that Make the second dedicated gateway forward the first data to the second virtual machine. In this way, since the embodiment of the present application does not need to expose the service interfaces of the virtual machines in each virtual private cloud to the public network, the security of data transmission can be improved. In addition, since each virtual private cloud has its own dedicated gateway, and the dedicated gateway only bears the business traffic related to the VPC, it can improve the scalability of business data services. At the same time, different virtual private clouds do not share gateway nodes. Compared with the existing communication methods that rely on centralized gateway nodes, the embodiment of this application only affects the data services of this VPC when the dedicated gateway node fails. Therefore, The impact range of the fault can be controlled within the VPC to realize fault isolation control.

Fig. 4 is a schematic structural diagram of an electronic device provided by an embodiment of the present application.

The electronic device 400 may include a processor 401 and a memory 402 storing computer program instructions.

Specifically, the above-mentioned processor 401 may include a central processing unit (CPU), or an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

Memory 402 may include mass storage for data or instructions. By way of example and not limitation, memory 402 may include a hard disk drive (Hard Disk Drive, HDD), a floppy disk drive, a flash memory, an optical disk, a magneto-optical disk, a magnetic tape, or a Universal Serial Bus (Universal Serial Bus, USB) drive or two or more Combinations of multiple of the above. Storage 402 may include removable or non-removable (or fixed) media, where appropriate. Under appropriate circumstances, the storage 402 can be inside or outside the comprehensive gateway disaster recovery device. In a particular embodiment, memory 402 is a non-volatile solid-state memory.

In particular embodiments, memory may include read only memory (ROM), random access memory (RAM), magnetic disk storage media devices, optical storage media devices, flash memory devices, electrical, optical, or other physical/tangible memory storage devices. Thus, in general, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software comprising computer-executable instructions, and when the software is executed (e.g., by one or multiple processors) operable to perform the operations described with reference to the method according to an aspect of the present application.

The processor 401 reads and executes the computer program instructions stored in the memory 402 to implement any data transmission method in the foregoing embodiments.

In some examples, the electronic device 400 may further include a communication interface 403 and a bus 410 . Wherein, as shown in FIG. 4 , the processor 401 , the memory 402 , and the communication interface 403 are connected through a bus 410 to complete mutual communication.

The communication interface 403 is mainly used to implement communication between various modules, devices, units and/or devices in the embodiments of the present application.

The bus 410 includes hardware, software or both, and couples the components of the online data traffic charging device to each other. By way of example and not limitation, bus 410 may include Accelerated Graphics Port (AGP) or other graphics bus, Enhanced Industry Standard Architecture (EISA) bus, Front Side Bus (FSB), HyperTransport (HT) interconnect, Industry Standard Architecture (ISA ) bus, InfiniBand Interconnect, Low Pin Count (LPC) bus, memory bus, Micro Channel Architecture (MCA) bus, Peripheral Component Interconnect (PCI) bus, PCI-Express (PCI-X) bus, Serial Advanced A Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable bus or a combination of two or more of these. Bus 410 may comprise one or more buses, where appropriate. Although the embodiments of this application describe and illustrate a particular bus, this application contemplates any suitable bus or interconnect.

Exemplarily, the electronic device 400 may be a mobile phone, a tablet computer, a notebook computer, a palmtop computer, a vehicle electronic device, an ultra-mobile personal computer (ultra-mobile personal computer, UMPC), a netbook or a personal digital assistant (personal digital assistant, PDA) Wait.

The electronic device 400 can execute the data transmission method in the embodiment of the present application, so as to implement the data transmission method and apparatus described in conjunction with FIG. 1 and FIG. 3 .

In addition, in combination with the data transmission method in the foregoing embodiments, the embodiments of the present application may provide a computer-readable storage medium for implementation. The computer-readable storage medium stores computer program instructions; when the computer program instructions are executed by a processor, any one of the data transmission methods in the above-mentioned embodiments is implemented. Examples of computer readable storage media include non-transitory computer readable storage media such as portable disks, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory) ), portable compact disc read-only memory (CD-ROM), optical storage devices, magnetic storage devices, etc.

It is to be understood that the application is not limited to the specific configurations and processes described above and shown in the figures. For conciseness, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art may make various changes, modifications and additions, or change the order of the steps after understanding the spirit of the present application.

The functional blocks shown in the structural block diagrams described above may be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, it may be, for example, an electronic circuit, an application specific integrated circuit (ASIC), suitable firmware, a plug-in, a function card, or the like. When implemented in software, the elements of the present application are the programs or code segments employed to perform the required tasks. Programs or code segments can be stored in machine-readable media, or transmitted over transmission media or communication links by data signals carried in carrier waves. "Machine-readable medium" may include any medium that can store or transmit information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, and the like. Code segments may be downloaded via a computer network such as the Internet, an Intranet, or the like.

It should also be noted that the exemplary embodiments mentioned in this application describe some methods or systems based on a series of steps or devices. However, the present application is not limited to the order of the above steps, that is, the steps may be performed in the order mentioned in the embodiment, or may be different from the order in the embodiment, or several steps may be performed simultaneously.

Aspects of the present application are described above with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the present application. It will be understood that each block of the flowchart and/or block diagrams, and combinations of blocks in the flowchart and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine such that execution of these instructions via the processor of the computer or other programmable data processing apparatus enables Implementation of the functions/actions specified in one or more blocks of the flowchart and/or block diagrams. Such processors may be, but are not limited to, general purpose processors, special purpose processors, application specific processors, or field programmable logic circuits. It can also be understood that each block in the block diagrams and/or flowcharts and combinations of blocks in the block diagrams and/or flowcharts can also be realized by dedicated hardware for performing specified functions or actions, or can be implemented by dedicated hardware and combination of computer instructions.

The above is only a specific implementation of the present application, and those skilled in the art can clearly understand that for the convenience and brevity of the description, the specific working process of the above-described systems, modules and units can refer to the foregoing method embodiments The corresponding process in , will not be repeated here. It should be understood that the protection scope of the present application is not limited thereto, and any person familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the application, and these modifications or replacements should cover all Within the protection scope of this application.

Claims (13)

1. A data transmission method, characterized in that it is applied to a first virtual private cloud, and a first dedicated gateway is set in the first virtual private cloud, and the method comprises: When the first virtual machine in the first virtual private cloud needs to transmit the first data to the second virtual machine in the second virtual private cloud, the first virtual machine sends the first data to the The first dedicated gateway; The first dedicated gateway forwards the first data to a second dedicated gateway set in the second virtual private cloud, so that the second dedicated gateway forwards the first data to the second virtual machine . 2. The method according to claim 1, wherein a first virtual address is configured in the first dedicated gateway; The sending of the first data to the first dedicated gateway by the first virtual machine includes: The first virtual machine uses the first virtual address as a next-hop address, and sends the first data to the first dedicated gateway. 3. The method according to claim 1, wherein a second virtual address is configured in the second dedicated gateway; The first dedicated gateway forwards the first data to the second dedicated gateway set in the second virtual private cloud, including: The first dedicated gateway uses the second virtual address as a next-hop address, and sends the first data to the second dedicated gateway. 4. The method according to claim 3, wherein a third virtual address is configured in the first dedicated gateway; Before the first dedicated gateway sends the first data to the second dedicated gateway using the second virtual address as a destination address, the method further includes: Building an information transmission tunnel between the first dedicated gateway and the second dedicated gateway based on the third virtual address and the second virtual address; The first dedicated gateway uses the second virtual address as a next-hop address, and sends the first data to the second dedicated gateway, including: The first dedicated gateway uses the second virtual address as a next-hop address, and sends the first data to the second dedicated gateway based on the information transmission tunnel. 5. The method according to claim 1, wherein before the first dedicated gateway forwards the first data to the second dedicated gateway set in the second virtual private cloud, the method further comprises : Obtain destination routing information between the first virtual machine and the second virtual machine according to the first destination address, where the first destination address is the second virtual machine in the second virtual private cloud The address of the virtual machine in; Based on the target routing information, determine the second dedicated gateway corresponding to the first destination address. 6. The method according to claim 5, wherein before obtaining the target routing information between the first virtual machine and the second virtual machine according to the first destination address, the method further comprises: Based on the border gateway protocol BGP, using the virtual machine addresses corresponding to the virtual machines in the first virtual private cloud and the second virtual private cloud, any virtual machine in the first virtual private cloud and the Build a BGP peer between any virtual machine in the second virtual private cloud to obtain a connection between any virtual machine in the first virtual private cloud and any virtual machine in the second virtual private cloud routing information; The acquiring destination routing information between the first virtual machine and the second virtual machine according to the first destination address includes: Obtain destination routing information between the first virtual machine and the second virtual machine from the routing information according to the first destination address. 7. The method according to claim 6, wherein after obtaining the routing information between any virtual machine in the first virtual private cloud and any virtual machine in the second virtual private cloud , the method also includes: Publish the routing information. 8. The method according to claim 1, wherein the first virtual private cloud includes a master gateway and a backup gateway; The method also includes: Determine whether the main gateway communication is normal; When the master gateway communicates normally, use the master gateway as the first dedicated gateway; When the primary gateway communicates abnormally, the backup gateway is used as the first dedicated gateway. 9. The method according to claim 1, further comprising: When the first dedicated gateway receives the second data sent by other dedicated gateways, the first dedicated gateway sends the second data to the A virtual machine corresponding to the second destination address in the first virtual private cloud. 10. A virtual private cloud, characterized in that the virtual private cloud is provided with a first dedicated gateway, the virtual private cloud includes a plurality of virtual machines, and the plurality of virtual machines includes at least the first virtual machine ; The first virtual machine is configured to send the first data to the first dedicated gateway when the first data needs to be transmitted to the second virtual machine in the second virtual private cloud; The first dedicated gateway is configured to forward the first data to a second dedicated gateway set in the second virtual private cloud, so that the second dedicated gateway forwards the first data to the second dedicated gateway. Two virtual machines. 11. An electronic device, characterized in that the device comprises: a processor and a memory storing computer program instructions; The steps of the data transmission method according to any one of claims 1-9 are implemented when the processor executes the computer program instructions. 12. A computer-readable storage medium, characterized in that computer program instructions are stored on the computer-readable storage medium, and when the computer program instructions are executed by a processor, the computer program instructions described in any one of claims 1-9 are implemented. The steps of the data transfer method. 13. A computer program product, characterized in that, when the instructions in the computer program product are executed by the processor of the electronic device, the electronic device executes the data transmission method according to any one of claims 1-9 A step of.

Images