CN102025535B - Virtual machine management method and device and network equipment - Google Patents

Abstract

The present invention provides a virtual machine management method, device and network equipment. The method includes: the network equipment receives the data message, and parses the data message to obtain the MAC address in the data message; the network equipment according to the MAC address and the pre-stored virtual MAC address of the machine to identify whether the object sending the data packet is a virtual machine. By adopting the technical solution of the present invention, the virtual machine can be identified, and then the virtual machine can be further managed, such as security policy configuration, etc., which overcomes the defect caused by the inability of the network device to identify the virtual machine in the prior art, and is beneficial to improve the network overall. The efficiency with which the device manages virtual machines.

Description

Virtual machine management method, device and network equipment

technical field

The present invention relates to network communication technology, in particular to a virtual machine management method, device and network equipment. the

Background technique

Server virtualization is a technology that enables multiple virtual servers (also known as virtual machines in the industry) to run on a single physical server. The physical server provides abstraction of hardware resources that support the operation of multiple virtual machines, such as virtual basic input Output system (Basic Input Output System; referred to as: BIOS), virtual processors, virtual memory and virtual devices and input and output (Input Output; referred to as: IO), etc., and also provide good isolation and security for each virtual machine sex. For example: Before adopting server virtualization technology, customer relationship management (Customer Relationship Management; referred to as: CRM) system, online games and enterprise resource planning (Enterprise Resource Planning; referred to as: ERP) system needs to be on three independent physical servers After adopting server virtualization technology, the above three applications can run on three virtual machines, and the three virtual machines are hosted by one physical server. It can be seen that server virtualization technology can make more full use of physical server resources. For example, in the actual operation of the data center environment, server virtualization technology is usually used to install multiple systems on one physical server, and virtualize one physical server into multiple virtual machines for use, so as to improve the utilization rate of the physical server. the

Server real-time migration is a complete and rapid migration of the entire virtual machine's running state from the original physical server (called the source physical server) to a new physical server (the target physical server) during the running of the virtual machine. Technology. The migration process of the entire virtual machine is smooth and transparent to users. Because virtualization abstracts real physical resources, server live migration can support heterogeneity between source and target physical servers. Server live migration requires the cooperation of the virtual machine monitor on the source physical server (called the source virtual machine monitor) and the virtual machine monitor on the target physical server (the target virtual machine monitor) to complete the memory of the virtual machine operating system. or other copies of state information. After the server live migration starts, the memory pages are continuously copied from the source virtual machine monitor to the target virtual machine monitor; when the last part of the memory pages is copied to the target virtual machine monitor, the source virtual machine monitor and the target virtual machine The monitor completes the switching operation of the virtual machine, the virtual machine on the target physical server starts to run, the virtual machine on the source physical server is terminated, and the server real-time migration is completed. For example: in the data center environment, the maintenance and update of the system hardware can be completed by using the server live migration technology, that is, the virtual machine is migrated from one physical server to another physical server, and then the original physical server is Hardware maintenance; after the maintenance is completed, the virtual machine will be migrated back to the original physical server. The whole process can be completed without downtime, further improving the utilization rate of resources in the data center environment. the

Usually, a physical server is connected to a network device, and communicates with the outside world through the network device. Among them, the network device is responsible for the security and reliable transmission of the data flow of the external communication of the virtual machine on the physical server. Therefore, some security policies will be configured on the network device. When the virtual machine is migrated, the above security policy needs to be migrated to a new network device or a new port accordingly and take effect on the new network device or new port. However, since the current network equipment cannot perceive the migration of the virtual machine, after the migration of the virtual machine, the security policy corresponding to the virtual machine can only be migrated to the new network equipment or new network by the network administrator manually or through the network management software. port. The above operation method is not only inefficient, but also extremely inconvenient to operate. Therefore, how the network device can identify the migration of the virtual machine has become the primary problem to be solved in the current server virtualization technology. the

Contents of the invention

The present invention provides a virtual machine management method, device and network equipment, which are used to identify virtual machines and improve the efficiency of managing virtual machines as a whole.

The present invention provides a virtual machine management method, including:

The network device receives the data packet, and parses the data packet to obtain the media access control address in the data packet;

The network device identifies whether the object sending the data message is a virtual machine according to the media access control address and the pre-stored virtual machine media access control address;

When the network device recognizes that the object sending the data message is a virtual machine, judge whether the virtual machine has migrated according to the media access control address and the pre-acquired virtual machine state table;

When the judgment result is that the virtual machine is migrated, the network device sends a failure notification message to the network device connected before the virtual machine is migrated according to the virtual machine state table, so as to inform the network device connected before the migration Perform invalidation processing on the security policy of the virtual machine. the

The present invention provides a virtual machine management device, including:

The receiving module is used to receive the data message, and parse the data message to obtain the media access control address in the data message;

An identification module, configured to identify whether the object sending the data message is a virtual machine according to the media access control address and the pre-stored virtual machine media access control address;

A judging module, configured to judge whether the virtual machine has migrated according to the media access control address and the pre-acquired virtual machine state table when the identifying module identifies that the object sending the data message is a virtual machine;

A sending module, configured to send a failure notification message to a virtual machine management device connected before the virtual machine migration according to the virtual machine state table when the judging module judges that the virtual machine has migrated, to inform the The virtual machine management device connected before the migration performs invalidation processing on the security policy of the virtual machine. the

The present invention provides a network device, including any virtual machine management device provided by the present invention. the

The virtual machine management method, device, and network equipment provided by the present invention store the media access control address of the virtual machine in advance, obtain the media access control address in the received data message through parsing, and store the media access control address in the data message Compared with the media access control address of the virtual machine, it can be identified whether the object sending the data message is a virtual machine. Through the technical solution of the present invention, the network device can identify the virtual machine, and further manage the virtual machine, such as security policy configuration, etc., which overcomes the defect caused by the inability of the network device to identify the virtual machine in the prior art, and is beneficial to improve overall Efficiency of network devices to manage virtual machines. the

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. For those skilled in the art, other drawings can also be obtained according to these drawings without any creative effort. the

Fig. 1 is a flowchart of a virtual machine management method provided by Embodiment 1 of the present invention;

Fig. 2 is a flow chart of the virtual machine management method provided by Embodiment 2 of the present invention;

FIG. 3A is a flowchart of a virtual machine management method provided in Embodiment 3 of the present invention;

FIG. 3B is another flow chart of the virtual machine management method provided in Embodiment 3 of the present invention;

FIG. 4A is a flowchart of a virtual machine management method provided in Embodiment 4 of the present invention;

FIG. 4B is a schematic diagram of the network topology structure based on the virtual machine management method provided by Embodiment 4 of the present invention;

FIG. 5 is a schematic structural diagram of a virtual machine management device provided in Embodiment 5 of the present invention;

FIG. 6A is a schematic structural diagram of a virtual machine management device provided in Embodiment 6 of the present invention;

FIG. 6B is another schematic structural diagram of a virtual machine management device provided by Embodiment 6 of the present invention. the

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention. the

Embodiment one

FIG. 1 is a flowchart of a virtual machine management method provided by Embodiment 1 of the present invention. The execution subject of this embodiment is a network device, as shown in Figure 1, the method of this embodiment includes:

Step 101, the network device receives the data message, and parses the data message to obtain the Media Access Control (Media Access Control; referred to as: MAC) address in the data message;

In this embodiment, the network device is connected to the server, and the server communicates with the outside world through the network device. the

Step 102, the network device identifies whether the object to send the data packet is a virtual machine according to the MAC address and the pre-stored virtual machine MAC address. the

Wherein, each virtual machine corresponds to a virtual machine MAC address, and in each embodiment of the present invention, the MAC address corresponding to the virtual machine is called a virtual machine MAC address. Specifically, the MAC address of the virtual machine in the network is pre-stored in the network device; when the network device receives the data packet, the MAC address in the learned data packet is compared with the MAC address of the virtual machine stored locally ; If the result of the comparison is that the MAC address of the virtual machine consistent with the learned MAC address is found, it is confirmed that the object sending the data message is a virtual machine running on the physical server; otherwise, it is confirmed that the object sending the data message is a non-virtual machine machine. the

The virtual machine management method provided in this embodiment stores the virtual machine MAC address in advance, so that the network device can automatically identify whether the object sending the data message is a virtual machine through the two processes of MAC address learning and comparison, so as to identify the virtual machine. The purpose of the virtual machine, and then can perform subsequent management operations on the virtual machine when it is identified as a virtual machine, laying a foundation for improving the convenience and efficiency of virtual machine management. the

Among them, each virtual machine manufacturer has its own virtual machine MAC address, for example, the virtual machine MAC address field of VMware company has 00-1C-14-XX-XX-XX. Therefore, in each embodiment of the present invention, the administrator can pre-configure the virtual machine MAC addresses applied by each virtual machine manufacturer for network devices, and update the virtual machine MAC addresses of these virtual machine manufacturers through software upgrades or online updates. address field. the

When the network device receives the data packet, it learns and compares the MAC address. Once the virtual machine MAC address of the virtual machine manufacturer is obtained, it can be regarded as sensing the existence of the virtual machine, that is, identifying the virtual machine. the

In addition, the virtual machine MAC address in each embodiment of the present invention is not limited to the virtual machine MAC address applied by each virtual machine manufacturer, but can also be a specially configured virtual machine MAC address, such as a pre-agreed among network devices in a network A special virtual machine MAC address, which is manually added for network devices by the administrator. Wherein, only the network devices in the network can recognize the added MAC address as the virtual machine MAC address. the

Further, the virtual machine MAC address in each embodiment of the present invention may include the virtual machine MAC address applied by the virtual machine manufacturer and the virtual machine MAC address specially agreed to be used. Among them, the specially agreed virtual machine MAC address can meet the needs of some virtual machines when they have to use special MAC addresses due to special needs or reasons. the

Example two

FIG. 2 is a flowchart of a virtual machine management method provided by Embodiment 2 of the present invention. This embodiment can be implemented based on Embodiment 1, as shown in Figure 2, the virtual machine management method of this embodiment includes:

Step 201, the network device receives the data message, and parses the data message to obtain the MAC address in the data message; that is, the network device learns the MAC address. the

Step 202, the network device matches the learned MAC address with the pre-stored virtual machine MAC address, and judges whether a virtual machine MAC address that is consistent with the learned MAC address is matched; when the judgment result is yes, it indicates the match If the MAC address of the virtual machine consistent with the learned MAC address is found, that is, it is recognized that the object sending the data message is a virtual machine, then proceed to step 203; otherwise, it means that no virtual machine consistent with the learned MAC address is found If the MAC address of the machine is identified, that is, it is recognized that the object to send the data packet is a non-virtual machine, then step 204 is performed. the

Step 203 , the network device configures the security policy for the port that receives the data packet according to the learned MAC address and the virtual machine security policy correspondence table obtained in advance, and ends. the

In each embodiment of the present invention, the virtual machine security policy correspondence table is obtained in advance by the network device. Wherein, the virtual machine security policy correspondence table may be manually configured by an administrator according to network status, layout, etc., or may be learned by each network device through information interaction. Among them, the way of learning from each other to obtain the virtual machine security policy correspondence table has the advantages of being flexible and convenient, and can be changed automatically with changes in network conditions, and thus becomes a preferred way. the

Wherein, the virtual machine security policy correspondence table stores each virtual machine MAC address and a security policy corresponding to each virtual machine MAC address. And the virtual machine MAC address in the virtual machine security policy correspondence table is consistent with the virtual machine MAC address pre-stored in the network device. Therefore, when the network device recognizes the MAC address of the virtual machine through operations such as learning and matching, you can query the virtual machine security policy correspondence table to obtain the security policy corresponding to the virtual machine that sends the data packet, and configure the security policy on the network On the port of the device connected to the virtual machine (that is, the port that receives the data message), the security policy will take effect on the virtual machine on the port; in the future, the security control of the message of the virtual machine will be performed according to the security policy . the

Among them, the network device is mainly responsible for the safe and reliable transmission of the data flow when the server communicates externally through the security policy. Commonly used ways to implement security policies include configuring access control lists (Access Control List; abbreviated as: ACL). Among them, the ACL is to control the data packets received by the port of the network device by defining some rules: allow to pass or discard. Through the ACL, the network device can classify and filter the data packets when they pass through the network device, and check the data packets input or output from the specified port, and decide whether to allow them to pass (Permit) or discard them according to the matching conditions (Conditions) (Deny). An ACL consists of a series of entries. Each ACL entry includes matching conditions and actions when the matching conditions are met. The rules of the access ACL can be aimed at information such as the source MAC or source Internet Protocol (Internet Protocol; IP) address, destination MAC or destination IP address, upper-layer protocol, and time zone of the data packet. For example: when only the IP address of the network segment 192.168.1.0/24 is allowed to access the virtual machine, the network device should configure ACL in the output direction of the port connected to the virtual machine, and the ACL rule is: PERMIT (allow) source IP= 192.168.1.0/24, and make the ACL rule take effect on this port. Among them, by setting the default rule of the ACL to prohibit other data packets from passing, the data packets whose source IP addresses do not meet the above requirements will be filtered out. the

In addition, network devices can also perform security control through Quality of Service (QOS for short), for example, security control can be performed according to the limitation of network bandwidth. For example: when the virtual machine is only allowed to send 10M data packets, the network device needs to configure the QOS bandwidth limit rule on the port connected to the virtual machine. The QOS bandwidth limit rule is: rate limit 10M, and the QOS bandwidth limit rule is configured in this port. the

In step 204, the network device performs normal processing on the data packet. For example: the network device can check the legality of each field in the data message; another example: the network device can also search the MAC address table according to the destination MAC address in the data message. If the destination MAC address is found, it will The data message is forwarded to the corresponding port; otherwise, the data message is broadcast to all ports. Wherein, the routine processing in this embodiment refers to the processing of data packets sent by non-virtual machines, and the routine processing may also include security detection processing, which is not limited in this embodiment. the

It needs to be explained here that in the technical solution of this embodiment, when the virtual machine is always connected to a certain port of the network device, it is only necessary to perform an operation once on the port that receives the data message sent by the virtual machine according to the initially learned MAC address. Security policy configuration is sufficient, and there is no need to perform security policy configuration every time a MAC address is learned. the

In the virtual machine management method of this embodiment, by pre-storing the virtual machine MAC address, performing operations such as MAC address learning, matching, and judgment, the network device can identify the virtual machine, and after the virtual machine is identified, according to the pre-acquired virtual machine security The policy correspondence table performs security policy configuration by itself to ensure the safe and reliable transmission of data packets when the virtual machine communicates with the outside world; meanwhile, in this embodiment, based on the identification of the virtual machine, the network device can configure the security policy for the virtual machine, Manual operation by the administrator is not required, the efficiency of configuring security policies is improved, and virtual machines can be managed more conveniently. the

Embodiment three

FIG. 3A is a flowchart of a virtual machine management method provided by Embodiment 3 of the present invention. This embodiment can be implemented based on Embodiment 1 and Embodiment 2, as shown in Figure 3A, the management method of this embodiment includes:

Step 301, the network device receives the data message, and parses the data message to obtain the MAC address in the data message; that is, the network device learns the MAC address. the

Step 302, the network device matches the learned MAC address with the pre-stored virtual machine MAC address, and judges whether a virtual machine MAC address consistent with the learned MAC address is matched; when the judgment result is yes, execute the step 303; otherwise, execute step 305. the

Step 303, the network device judges whether the virtual machine corresponding to the learned MAC address is migrated according to the learned MAC address and the pre-acquired virtual machine state table; if the judgment result is yes, then execute step 304, if the judgment result is no , then end. the

Among them, the data packet corresponding to the MAC address received by the network device may be sent by a virtual machine that has been hosted by a server when it is newly started, or it may be migrated from one server (physical server) to another issued by a virtual machine on the server. Through the judging operation in step 303, it can be identified whether the virtual machine is migrated. the

Wherein, the virtual machine state table stores the status information of the virtual machines running on the servers connected to each network device in the network, such as including the port of the network device, the connected server, the virtual machine list running on the server corresponding to the port, and the virtual machine list. information such as the MAC address of the computer. the

Step 304, the network device sends a failure notification message to the network device connected before the virtual machine migration according to the state table of the virtual machine to inform the network device connected before the virtual machine migration to invalidate the security policy of the virtual machine, and ends. the

Among them, when it is found that the virtual machine is migrated from one server to another server, the original network device needs to be notified, so as to inform the network device connected before the migration to delete the security policy on the port connected to the virtual machine, that is, invalidate the operation. After the network device connected before the migration receives the invalidation notification message, it can parse and obtain the virtual machine MAC address carried in the notification message, and then invalidate the security policy on the corresponding port according to the virtual machine MAC address. This ensures the integrity of the security policy migration. the

Step 305, the network device performs normal processing on the data packet. the

In the virtual machine management method of this embodiment, by pre-storing the virtual machine MAC address, performing operations such as MAC address learning, matching, and judgment, the network device can identify the virtual machine, and can identify the migration of the virtual machine, and at the same time pass the failure notification report The document notifies the network device connected before the migration to invalidate the security policy before the migration, so as to complete the complete migration of the security policy; Migration issues to facilitate subsequent migration or configuration of security policies

In the above technical solution, when the network device recognizes the virtual machine, no matter whether the virtual machine is migrated from one server to another or has been hosted by one server all the time, the network device needs to perform Security policy configuration. Figure 3B is another schematic structural diagram of the virtual machine management method provided by Embodiment 3 of the present invention; the difference between the process shown in Figure 3B and Figure 3A is that after step 302, a step 303a is also included: the network device according to the learned MAC The address corresponds to the virtual machine security policy obtained in advance, and the security policy is configured for the port that receives the data packet. the

It should be noted here that, whether it is a virtual machine that has been hosted by a physical server or a virtual machine that has migrated, in step 303a of this embodiment, the network device only needs to receive the data sent by the virtual machine according to the initially learned MAC address. The port of the packet needs to be configured with a security policy once. the

It should be noted here that there is no sequence between step 303a and step 303, that is, the security policy configuration can be performed first, and then the judgment whether to migrate is performed; or it can be judged whether migration occurs first, and then the security policy is configured. Security policy configuration may be referred to as security policy migration. the

Furthermore, after the local network device completes the security policy configuration for the virtual machine, it can also send the security policy configured on each port and the virtual machine information corresponding to the security policy to other network devices, so that other network devices can record or update all stored information. the

In the virtual machine management method of this embodiment, the network device can identify the virtual machine and the migration of the virtual machine, and after identifying the virtual machine, configure the security policy by itself according to the virtual machine security policy correspondence table obtained in advance, ensuring that the virtual machine is in touch with the outside world. Safe and reliable transmission of data packets during communication; based on the identification of virtual machine migration, the network device can configure the security policy for the virtual machine by itself, without manual operation by the administrator, which improves the efficiency of configuring security policies and can be more convenient manage virtual machines. the

Wherein, this embodiment provides an implementation manner in which a network device obtains a virtual machine security policy correspondence table and a virtual machine state table in advance, but is not limited thereto. The implementation methods provided in this embodiment include:

Step 3031, when each network device is started, all send a first management message, the first management message includes the MAC address of the network device and the port information for sending the first management message, wherein the port information includes the port number and port number Type (such as device port or server port) and other information. the

Step 3033, the network device as the execution subject of this embodiment receives the first management message sent by other network devices, and identifies the device port and server port of the network device according to the first management message; wherein, the network device is not only connected to the server , and will also be connected to other network devices at the same time, the port connected to the server is called the server port, and the port connected to the network device is called the device port; Among them, it is pre-agreed that the first management message can only pass through the port connected to the network device ( That is, the device port) and can only be received through the device port. Therefore, the network device can identify the port that receives the first management packet as a device port, and other ports as server ports. Then, each network device can perform operations such as virtual machine identification, virtual machine security policy configuration or migration on its own server port according to the method provided by the above embodiment, or the virtual machine MAC address used by the administrator according to the network agreement can be Configure security policies on corresponding network devices. After each network device configures the security policy, it can send information such as the configured security policy and the virtual machine information corresponding to the security policy to other network devices other than itself through their respective device ports. the

Step 3035, the network device as the execution subject of this embodiment receives the second management message sent by other network devices through the device port, and the second management message includes the information of the virtual machine running on each server port of the other network device And the security policy configured for each virtual machine in the running state;

Step 3037, the network device as the execution subject of this embodiment generates a virtual machine security policy correspondence table and a virtual machine state table according to the second management message. the

Specifically, the network device performs comprehensive processing to generate the virtual machine security policy by obtaining the information of the virtual machine in the second management packet sent by each other network device, the security policy configured for each virtual machine, and the corresponding relationship between them. A correspondence table, the virtual machine security policy correspondence table includes virtual machine information, a security policy, and a correspondence between the security policy and the virtual machine; and according to the server port information (such as the port number) and the corresponding The virtual machine information (for example, the virtual machine MAC address) generates a virtual machine state table, and the virtual machine state table includes information such as the virtual machine, the server where the virtual machine is located, and the port of the network device connected to the server, as well as the correspondence between the above information. Therefore, when the network device as the execution subject recognizes the MAC address of the virtual machine, it can identify whether the virtual machine has migrated according to the virtual machine state table at the previous moment. If the MAC address of the virtual machine appears on other server ports at the same time, it means that the virtual machine The virtual machine is migrated, and the security policy of the virtual machine is migrated accordingly. the

Wherein, if there is no need to identify whether the virtual machine is migrated (such as the scenario described in Embodiment 2), the virtual machine security policy correspondence table can be generated only according to the technical solution of this embodiment, without generating the virtual machine state table. the

Through the above method, each network device can obtain the virtual machine security policy correspondence table and/or the virtual machine state table in advance. In order to ensure that the virtual machine security policy correspondence table and the virtual machine state table on each network device can change correspondingly following the network status or the migration of the virtual machine, it is also stipulated in this embodiment that each network device regularly sends the second management The message is used for each network device to obtain the information of the virtual machine running on other network devices in real time and the security policy corresponding to the virtual machine in the running state, so as to update the virtual machine security policy corresponding table and/or the virtual machine status table accordingly to update. the

Further, in the above-mentioned embodiment, step 3034 is also included after 3033, that is, the network device as the executive subject of this embodiment configures the security policy for the virtual machine on its server port, and periodically sends the policy to other network devices through the device port. The information of the virtual machines running on each server port thereof and the security policy configured for each virtual machine (i.e. the second management message) are used for other network devices to pre-generate a virtual machine security policy correspondence table and a virtual machine status table, And update the virtual machine security policy correspondence table and the virtual machine state table. the

The above is an implementation of the present invention to obtain the virtual machine security policy correspondence table and the virtual machine status table. This implementation mainly sends the first management message according to the pre-agreed rules for each network device to identify the device port and the server port. , and then, perform security policy configuration, and send a second management packet through the device port, so as to perform unified operations on the entire network of the virtual machine and the security policy corresponding to the virtual machine, that is, generate virtual machines with basically the same content on each network device The security policy correspondence table and the virtual machine state table further lay the foundation for the implementation of various embodiments of the present invention. the

The flow of the technical solution of the present invention will be described in detail below through specific embodiments in combination with the network topology. the

Embodiment four

FIG. 4A is a flowchart of a virtual machine management method provided in Embodiment 4 of the present invention; FIG. 4B is a schematic diagram of a network topology based on which the virtual machine management method provided in Embodiment 4 of the present invention is based. As shown in FIG. 4B, the present embodiment includes a network device 41, a network device 42, a network device 43, a network device 44, a server 45, and a server 46. The network device 41 is connected to the network device 42 , the network device 43 and the network device 44 respectively, the server 45 is connected to the network device 41 , and the server 46 is connected to the network device 42 . The network device 41, the network device 42, the network device 43, and the network device 44 respectively follow the pre-agreed virtual machine unified management mechanism, and each network device is configured with a virtual machine MAC address used by the network. Then the method of this embodiment includes:

Step 401 , after the network device 41 - network device 44 are turned on, broadcast the first management message to the outside at regular intervals, declaring that they support the virtual machine management mechanism, and let other network devices know. Wherein, network device 41-network device 44 will receive the port of the first management message, and record it as the device port (Net-Port). The network device sends the first management packet, but the port connected to the virtual machine will not receive the first management packet, so other ports that have not received the first management packet can be recorded as server ports (Server-Port). Based on this, in the network topology shown in FIG. 4B , there are device ports 51 , 52 and 53 ; and server ports 54 and 55 . Wherein, the format of the first management message includes but is not limited to the following information fields: the MAC address of the network device; the number of the port of the current network device that sends the first management message; the port of the current network device that sends the first management message Type (for example, Server-Port or Net-Port). the

Step 402, for the pre-configured virtual machine MAC address, identify the virtual machine, and generate a "virtual machine configuration unit" on the network device. Policies such as QOS) take effect on these "virtual machine configuration units". Among them, because a physical port of a network device is connected to a physical server, multiple virtual machines can be installed on the physical server, so a physical port of a network device can contain multiple "virtual machine configuration units" and generate Correspondence between multiple virtual machine MAC addresses and security policies. the

Step 403: Notify the corresponding relationship of <virtual machine MAC address, security policy> to all other network devices supporting the virtual machine management mechanism in the whole network through the device port through the second management message. At this time, the second management message adds but is not limited to the following fields on the basis of the first management message: the "Server-Port" list of the network device and its total number; the virtual machine configuration unit of the network device The list and its total number; the corresponding relationship between the virtual machine MAC address and the security policy applied to each virtual machine configuration unit, etc. the

Based on the above, the virtual machine security policy correspondence table has been stored on the network equipment 41-44, which is ready for the security policy to take effect quickly in real time. the

Step 404, assuming that the virtual machine migrates from the server 45 to the server 46, at this time, the network device 42 immediately learns that the virtual machine has migrated from the server 45 to the server 46 through the MAC address learning and the information in the virtual machine security policy correspondence table, and finds that If the MAC address is learned on the server port 55, the security policy corresponding to the virtual machine MAC address takes effect on the new server port 55. Among them, the security policy corresponding to the MAC address of the virtual machine can only take effect on the server port (Server-Port) and with the change of the MAC address, and cannot take effect on the device port (net-port). It should be noted here that in this embodiment, the virtual machine security policy correspondence table includes the information of the running virtual machine in the network, the security policy information corresponding to the virtual machine, and the server information of the virtual machine; that is, in this embodiment In the example, the network device does not need to separately generate a virtual machine state table to store information about the virtual machine and the server where the virtual machine resides and their corresponding relationship. the

Step 405, after the new security policy on the network device 42 takes effect successfully, the original network device 41 should be notified to delete the original security policy, so as to complete the process of "security policy migration". the

The above-mentioned method can solve the problem that existing network devices cannot independently and automatically migrate security policies applied to virtual machines, and achieve the purpose of intelligent and automatic management of security policies in the entire network in the data center network environment. the

Embodiment five

FIG. 5 is a schematic structural diagram of a virtual machine management device provided by Embodiment 5 of the present invention. As shown in FIG. 5 , the virtual machine management device of this embodiment includes: a receiving module 61 and an identifying module 62 . the

Wherein, the receiving module 61 is used to receive the data message, and parse the data message to obtain the MAC address in the data message; The stored virtual machine MAC address identifies whether the object sending the data packet is a virtual machine. the

The virtual machine management device provided in this embodiment can be used to execute the process of the virtual machine management method provided in the embodiment of the present invention. By pre-storing the virtual machine MAC address, the network device can automatically identify the virtual machine through the two processes of MAC address learning and comparison. In order to achieve the purpose of identifying the virtual machine, it is possible to perform subsequent management operations on the virtual machine when it is identified as a virtual machine, in order to improve the convenience and efficiency of virtual machine management Lay the groundwork. the

Embodiment six

FIG. 6A is a schematic structural diagram of a virtual machine management device provided by Embodiment 6 of the present invention. This embodiment can be implemented based on the fifth embodiment. As shown in FIG. 6A , the virtual machine management device of this embodiment further includes: a first configuration module 63 . the

Wherein, the first configuration module 63 is connected with the identification module 62, and is used for, when the identification module 62 identifies that the object to send the data message is a virtual machine, according to the MAC address and the pre-acquired virtual machine security policy correspondence table, Ports for data packets are configured with security policies. the

The virtual machine management device of this embodiment can also be used to execute the process of the virtual machine management method provided by the embodiment of the present invention, and can identify the virtual machine by pre-storing the virtual machine MAC address, performing operations such as MAC address learning, matching, and judgment, After the virtual machine is identified, the security policy configuration is performed according to the pre-acquired virtual machine security policy correspondence table, so as to ensure the safe and reliable transmission of data packets when the virtual machine communicates with the outside world; meanwhile, this embodiment is based on the virtual machine It can configure the security policy of the virtual machine by itself without manual operation by the administrator, which improves the efficiency of configuring security policies and makes it easier to manage the virtual machine. the

FIG. 6B is another schematic structural diagram of a virtual machine management device provided by Embodiment 6 of the present invention. As shown in FIG. 6B , the virtual machine management device of this embodiment further includes: a judging module 64 and a sending module 65 . the

When it is identified that the object sending the data packet is a virtual machine, it can also be identified whether the virtual machine has been migrated. The judging module 64 is connected to the receiving module 61 and the identifying module 62 respectively, and is used to judge whether the virtual machine has migrated according to the MAC address and the pre-acquired virtual machine state table; the sending module 65 is connected to the judging module 64, and is used to judge When the module 64 determines that the virtual machine has been migrated, it sends an invalidation notification message to the virtual machine management device connected before the virtual machine migration according to the virtual machine state table, so as to inform the virtual machine management device connected before the migration to implement the security policy of the virtual machine. Failure handling. the

The virtual machine management device shown in FIG. 6B of this embodiment can also be used to execute the process of the virtual machine management method provided by the embodiment of the present invention. After the virtual machine is identified, it is further judged whether the virtual machine is migrated. When the virtual machine is found to be migrated, By sending an invalidation notification message to the virtual machine management device connected before the migration of the virtual machine, the virtual machine management device connected before the migration can invalidate the security policy on the corresponding port, ensuring that the security policy is completely updated with the migration of the virtual machine migrate. the

Wherein, when the virtual machine is identified, the virtual machine management device needs to perform security policy configuration on the corresponding port no matter whether the migration of the virtual machine is identified or not. Based on this, as shown in FIG. 6B , the virtual machine management device of this embodiment further includes: a second configuration module 67, connected to the identification module 62, used to, when the identification module 62 identifies the virtual machine, according to the MAC address and pre-acquired The virtual machine security policy correspondence table is used to configure the security policy for the ports of the received data packets. the

Among them, the first configuration module 63 in FIG. 6A is used to configure the security policy when the virtual machine is identified without identifying whether the virtual machine has migrated; and the second configuration module 67 is used to identify the virtual machine and need to identify Configure security policies when virtual machines are migrated. However, in the specific implementation process, the first configuration module 63 and the second configuration module 67 can be realized by different modules; they can also be realized by the same module, and are used to configure security policies in different situations (in FIG. 6B, a The configuration module is taken as an example, that is, the second configuration module 67), which is not limited in this embodiment. the

Based on the above technical solution, as shown in FIG. 6B , the virtual machine management device of this embodiment also includes an acquisition module 66, which is respectively connected to the second configuration module 67 and the judgment module 64, and is used to pre-acquire the virtual machine security policy correspondence table and virtual Machine status table. Specifically, the acquiring module 66 includes: a first receiving unit, a second receiving unit and a generating unit. Wherein, the first receiving unit is configured to receive the first management message sent by other virtual machine management devices, and identify the device port and the server port of the local virtual machine management device according to the first management message, and the first management message The file includes MAC addresses of other network devices and port information for sending the first management message; the second receiving unit is configured to receive the second management message sent by other virtual machine management devices through the device port, and the second management message Including virtual machine information running on other virtual machine management devices and a security policy configured for the virtual machine; a generating unit configured to generate the virtual machine including the correspondence between the virtual machine and the security policy according to the second management message A security policy correspondence table, and the virtual machine state table including information of virtual machines in running state. It should be noted here that when it is not necessary to identify whether the virtual machine is migrated, the generating unit may only generate a virtual machine security policy correspondence table without generating a virtual machine state table. the

Further, the acquisition module 66 also includes: a sending unit, configured to configure the security policy for the virtual machine running on the server port of the local virtual machine management device, and periodically send the virtual machine running on the local virtual machine management device through the device port. The virtual machine information on each server port of the machine management device and the security policy (that is, the second management message) configured for each virtual machine are used for other virtual machine management devices to pre-generate a virtual machine security policy correspondence table and a virtual machine status table . Similarly, for other virtual machine management devices, when it is only necessary to identify the virtual machine but does not need to identify whether the virtual machine is migrated, only the virtual machine security policy correspondence table can be generated instead of the virtual machine state table, but whether to generate The virtual machine state table is not limited in this embodiment. the

Through the above technical solution, the virtual machine management device in this embodiment can obtain in advance the information of virtual machines running on other virtual machine management devices, the security policies configured for each virtual machine, and the corresponding relationship of the above information in the form of information interaction, Furthermore, a virtual machine security policy correspondence table and a virtual machine state table are generated in advance to provide a basis for implementation of various embodiments of the present invention. The virtual machine information on other virtual machine management devices obtained through the above technical solution, the security policy and the corresponding relationship between the above information are more accurate and timely, and the virtual machine security policy correspondence table and the virtual machine status table can be updated in time, improving the efficiency based on Accuracy and real-time performance of the above-mentioned information obtained for virtual machine management. the

Embodiment seven

Embodiment 7 of the present invention provides a network device, including a virtual machine management device. Wherein, the virtual machine management device may be the virtual machine management device provided by the embodiment of the present invention. For its working principle and structure, please refer to the description of the above-mentioned embodiments of the present invention, which will not be repeated here. The network device in this embodiment may be various network devices connected to the physical server running the virtual machine, such as a router, a switch, or various gateway devices, which may be used to manage the virtual machine. the

The network device of this embodiment has the virtual machine management device provided by the embodiment of the present invention, and can be used to execute the process of the virtual machine management method provided by the embodiment of the present invention. Therefore, the network device of this embodiment is used to manage the virtual machine. It can identify the migration of the virtual machine by itself, and configure the security policy for the virtual machine without manual configuration by the administrator, which improves the efficiency of configuring the security policy and greatly improves the convenience of managing the virtual machine. the

Those of ordinary skill in the art can understand that all or part of the steps for realizing the above-mentioned method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes. the

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the various embodiments of the present invention. the

Claims (9)

1. A virtual machine management method, characterized in that, comprising: The network device receives the data packet, and parses the data packet to obtain a media access control address in the data packet; The network device identifies whether the object sending the data packet is a virtual machine according to the media access control address and the pre-stored virtual machine media access control address; When the network device recognizes that the object sending the data message is a virtual machine, determine whether the virtual machine has migrated according to the media access control address and the pre-acquired virtual machine state table; When the judgment result is that the virtual machine is migrated, the network device sends a failure notification message to the network device connected before the virtual machine is migrated according to the virtual machine state table, so as to inform the network device connected before the migration Perform invalidation processing on the security policy of the virtual machine. 2. The virtual machine management method according to claim 1, further comprising: when the network device recognizes that the object sending the data message is a virtual machine: The network device configures the security policy for the port that receives the data packet according to the media access control address and the virtual machine security policy correspondence table obtained in advance. 3. The virtual machine management method according to claim 2, wherein the network device pre-obtaining the virtual machine security policy correspondence table and the virtual machine state table comprises: The network device receives a first management message sent by other network devices, and identifies a device port and a server port of the network device according to the first management message, and the first management message includes the A media access control address and port information for sending the first management packet; The network device receives a second management packet sent by the other network device through the device port, and the second management packet includes information about virtual machines running on the other network device and virtual machines in the running state. Security policy for virtual machine configuration; The network device generates, according to the second management message, the virtual machine security policy correspondence table including the correspondence between virtual machines and security policies, and the virtual machine status table including information about virtual machines in a running state. 4. The virtual machine management method according to claim 3, further comprising: The network device performs security policy configuration on the virtual machine running on the server port, and regularly sends information about the virtual machine running on the server port to the other network devices through the device port The security policy configured for the virtual machine in the state is used for the other network devices to pre-generate a virtual machine security policy correspondence table and a virtual machine state table. 5. A virtual machine management device, comprising: A receiving module, configured to receive a data packet, and parse the data packet to obtain a media access control address in the data packet; An identification module, configured to identify whether the object sending the data message is a virtual machine according to the media access control address and the pre-stored virtual machine media access control address; A judging module, configured to judge whether the virtual machine has been migrated according to the media access control address and the pre-acquired virtual machine state table when the identifying module identifies that the object sending the data message is a virtual machine; A sending module, configured to send a failure notification message to a virtual machine management device connected before the virtual machine migration according to the virtual machine state table when the judging module judges that the virtual machine has migrated, to inform the The virtual machine management device connected before the migration performs invalidation processing on the security policy of the virtual machine. 6. The virtual machine management device according to claim 5, further comprising: The second configuration module is configured to, when the identification module identifies that the object sending the data message is a virtual machine, according to the media access control address and the pre-acquired virtual machine security policy correspondence table, to receive the data The ports of the packets are configured with security policies. 7. The virtual machine management device according to claim 6, further comprising: an acquisition module; the acquisition module comprising: The first receiving unit is configured to receive a first management message sent by another virtual machine management device, and identify a device port and a server port of a local virtual machine management device according to the first management message, and the first management message The text includes media access control addresses of other network devices and port information for sending the first management packet; The second receiving unit is configured to receive a second management message sent by the other virtual machine management device through the device port, the second management message includes the virtual machine running on the other virtual machine management device information and security policies configured for running virtual machines; A generating unit, configured to generate, according to the second management message, the virtual machine security policy correspondence table including the correspondence between virtual machines and security policies, and the virtual machine state table including information about virtual machines in a running state . 8. The virtual machine management device according to claim 7, wherein the acquiring module further comprises: The sending unit is configured to perform security policy configuration on the virtual machine running on the server port of the local virtual machine management device, and regularly send the virtual machine running on the server port to the other virtual machine management device through the device port. The information about the virtual machine and the security policy configured for the virtual machine in the running state are used for the other virtual machine management devices to pre-generate a virtual machine security policy correspondence table and a virtual machine status table. 9. A network device, comprising the virtual machine management apparatus according to any one of claims 5-8.

Images