基于OpenStack的高吞吐量路由仿真技术研究

融合了轻量级虚拟化、全虚拟化以及SDN技术的OpenStack云平台具有逼真度高、可扩展性强等优势,可有效满足网络仿真的大规模、高逼真、灵活构建的需求。在网络仿真层面,OpenStack的neutron机制支持三层网络高逼真仿真,可为各虚拟设备的无缝通信提供便利,但其虚拟路由器qrouter只能够转发直连网络的数据,难以构建复杂的仿真网络。为此,基于OpenStack平台,提出了一种基于集中式路由引擎与分布式路由部署的路由仿真技术。实验表明,该方法不仅可以基于qrouter构建复杂的仿真网络,而且具有高吞吐量的优势。     

基于 OpenStack 的虚拟资源调度技术研究

传统的高能物理计算系统基于物理机集群,主要通过 Torque、Condor、LSF 等资源管理和作业调度系统将作业调度到物理机器上运行,缺少对虚拟化计算的接口支持。我们选取 OpenStack 作为底层虚拟化平台,设计并实现上层调度系统与 OpenStack 之间的桥梁,采用推拉结合的作业运行方式,构建虚拟计算集群。     

基于OpenStack虚拟化网络管理平台的设计与实现

随着互联网技术的高速发展,服务器和网络设备等设备数量指数增长,基础设施和网络资源的管理与配置越来越成为互联网发展道路上的障碍,面临严峻的挑战。而虚拟化技术作为解决上述困难得方式之一,也被密切关注着。但是,目前的虚拟化研究主要关注虚拟基础架构的规划或者嵌入以及虚拟化的实现上,而虚拟化网络管理与实现尚未深入研究。本文通过分析云计算以及开源云平台OpenStack的技术原理,参考传统的网络管理模式方案,采用分层设计的方法设计实现了一个可对网络进行虚拟化和集中管理的平台并对其进行了测试。该平台可根据用户需求,快速部署和管理虚拟网络和创建虚拟机实例,实现资源的按需分配和高效用比。     

开源云平台OpenStack的手动部署过程研究

传统的开源云平台采用单点部署的方式，无法实现多点同步部署操作，这种方式存在操作失误和部署效率低下的问题，给整个部署过程带来极大的困难。基于此，文章对传统部署方法与过程进行了优化设计。首先，手动安装部署云平台运行所需的组件，达到配置修改的目的。其次，部署开源云平台配置网络，实现云平台的交互目标。最后，虚拟化开源云平台OpenStack节点部署，适应平台多用户的需求。实验分析可知，提出的手动部署过程具有较高可行性，在平台用户数量规模逐渐增大的情况下，部署时间较短，工作效率较高。     

基于虚拟化技术的网络攻防平台设计

随着因特网的飞速发展,网络安全问题已成为关乎国家安全与稳定的重大问题。为了研究网络攻防武器,需要一个既能代表真实网络主机对战的环境又能快速完成网络部署的攻防平台。使用仿真软件将使实验脱离真实网络环境,直接使用物理设备搭建平台则面临着开销大、管理难等问题。该文使用虚拟化技术设计网络攻防平台,将有限的物理资源进行整合,模拟出一个易于扩展和可自动化配置的实验环境,实现硬件资源部署自动化、虚拟资源管理自动化、实验网络构建自动化,具有较大的实用价值。     

基于能耗的虚拟路由器转发实例动态迁移机制研究

虚拟路由器平台是支撑网络虚拟化技术的关键网络设备。传统的虚拟路由器平台存在着物理资源利用率低,能耗损失严重等问题。现有的节能机制大多是通过虚拟路由器平台间的虚拟路由器实例动态迁移来降低能耗,并未有学者研究平台内部虚拟路由器实例动态迁移对能耗的影响。提出一种基于能耗的虚拟路由器转发实例动态迁移算法。该算法将转发实例动态迁移到更少的物理服务器,调整平台内部的转发实例与物理服务器之间的映射关系,关闭空闲服务器。实验表明,该算法能够提高虚拟路由器平台的物理资源利用率,降低平台总能耗。     

基于虚拟设备的虚拟交换机设计

网络虚拟化为共享在同一主机上的多个虚拟机创造了一个新的网络接入层。传统模式网络部署方式已经不能满足虚拟化部署环境对网络的要求。这个新的虚拟网络接入层合理的隔离了系统软件和实际的物理设备,虚拟网络接入层还提供了物理网络层不具有的优势,例如灵活的软件配置,弹性的功能扩展。设计虚拟网络交换机,通过采用虚拟设备引入一个软件抽象层,该抽象层将流量从物理网络元素中分离出来。通过这些虚拟设备可以合理动态的管理虚拟化网络资源,有效的整合这些虚拟网络元素。介绍虚拟交换机是如何设计的,可以用来解决虚拟环境中虚拟机跨子网的流动性和虚拟主机之间流量的逻辑隔离等问题。     

基于网卡虚拟化的高性能容器网络设计

单根I/O虚拟化技术为传统数据中心提供高效的服务器整合能力和灵活的应用部署能力,通过将多个网卡直通到虚拟机,减少额外包复制带来的性能损失,使得网络I/O具有接近主机的性能。然而,在网络功能虚拟化场景下单独使用单根I/O虚拟化技术会降低传统数据中心的网络I/O虚拟化性能。针对网络功能虚拟化长链场景,结合单根I/O虚拟化技术和软件虚拟化技术,设计基于网卡虚拟化的高性能容器网络。通过转发模块判断网络流量的目的地址,寻找最优的流量转发路径,实现流量的灵活转发。利用基于脚本程序的自动化部署模块,对每个节点业务进行支持动态增删服务的配置,便于用户对网络进行管理和修改。实验结果表明,在网络功能虚拟化长链场景下,相比单根I/O虚拟化技术,该网络延迟降低约20%,同时能够有效提高网络吞吐量,解决数据中心的网络I/O虚拟化问题。     

SR-IOV技术在OpenStack中的应用

在OpenStack云平台中,一台物理服务器上可能同时运行着十几台虚拟机,这对于物理服务器的I/O性能要求是非常高的.因此,I/O虚拟化技术的效率对于整个OpenStack云平台的网络性能提升都有着至关重要的作用.为了提高系统整体的网络性能,在OpenStack云平台中引入SR-IOV技术成为了一种可选的方式.本文通过对比实验测试了SR-IOV技术对于OpenStack云平台上网络I/O性能的影响.最终对实验结果进行分析可知,在引入SR-IOV技术后,OpenStack云平台上的计算节点I/O虚拟化性能提升了大概50%.     

云计算网络中多租户虚拟网络隔离的分布式实现研究

近年来,随着网络虚拟化技术的快速发展,云服务提供商可以将一套物理网络抽象成多套相互独立的虚拟网络提供给租户。在多租户网络环境中,需要保证租户网络的安全隔离,确保租户数据不会遭到来自其他租户以及外部网络的非法访问。相比传统物理网络的边界,虚拟网络的边界定义更加模糊,需要更细粒度的网络隔离;当前以OpenStack为代表的主流开源云平台采用集中式部署网络边界节点的方式实现虚拟网络的隔离,虚拟机流量大多集中到单一物理节点上,存在单点故障的隐患。提出分布式实现虚拟网络隔离的方式,把原本集中的虚拟网络边界分布到各台物理服务器,从而将原本集中于同一节点的网络流量分摊到各物理服务器,降低单点故障造成损失的可能性。最后经过实验证实了分布式部署的有效性,同时能够降低虚拟机通信的网络延迟。     

High-performance docker integration scheme based on OpenStack

As an emerging technology in cloud computing Docker is becoming increasingly popular due to its high speed high efficiency and portability. The integration of Docker with OpenStack has been a hot topic in research and industrial areas e.g. as an emulation platform for evaluating cyberspace security technologies. This paper introduces a high-performance Docker integration scheme based on OpenStack that implements a container management service called Yun. Yun interacts with OpenStack’s services and manages the lifecycle of the container through the Docker Engine to integrate OpenStack and Docker. Yun improves the container deployment and throughput as well as the system performance by optimizing the message transmission architecture between internal components the underlying network data transmission architecture between containers and the scheduling methods. Based on the Docker Engine API Yun provides users with interfaces for CPU memory and disk resource limits to satisfy precise resource limits. Regarding scheduling Yun introduces a new NUMA-aware and resource-utilization-aware scheduling model to improve the performance of containers under resource competition and to balance the load of computing resources. Simultaneously Yun decouples from OpenStack versions by isolating its own running environment from the running environment of OpenStack to achieve better compatibility. Experiments show that compared to traditional methods Yun not only achieves the integration of OpenStack and Docker but also exhibits high performance in terms of deployment efficiency container throughput and the container’s system while also achieving load balancing.

     

基于标签的POF网络虚拟化技术研究

针对SDN新一代转发控制分离技术——协议无感知转发(POF),提出了协议字段全开放的SDN网络虚拟化架构。该架构提出了基于标签的网络虚拟化技术和POF物理交换机流表分配技术,通过网络虚拟化中间件将POF交换机与POF控制器之间传递的消息进行转换,对物理网络中传输的数据进行标签封装,从而区分不同网络切片与虚拟链路的流量信息。与已有的虚拟化中间件Flow Visor、Open Virtex、Co Visor等相比,该虚拟化中间件全面支持POF协议,通过物理网络中的数据的标签化处理,实现了SDN转发平面全字段开放的网络虚拟化。同时,基于该套架构,实现了POF网络虚拟化中间件系统POFHyper Visor,并验证了该POF网络虚拟化中间件系统的功能与性能,经测试,虚拟化消息处理能力损失在17.1%~29.9%。     

A flexible data schema and system architecture for the virtualization of manufacturing machines (VMM)

Future factories will feature strong integration of physical machines and cyber-enabled software, working seamlessly to improve manufacturing production efficiency. In these digitally enabled and network connected factories, each physical machine on the shop floor can have its ‘virtual twin’ available in cyberspace. This ‘virtual twin’ is populated with data streaming in from the physical machines to represent a near real-time as-is state of the machine in cyberspace. This results in the virtualization of a machine resource to external factory manufacturing systems. This paper describes how streaming data can be stored in a scalable and flexible document schema based database such as MongoDB, a data store that makes up the virtual twin system. We present an architecture, which allows third-party integration of software apps to interface with the virtual manufacturing machines. We evaluate our database schema against query statements and provide examples of how third-party apps can interface with manufacturing machines using the VMM middleware. Finally, we discuss an operating system architecture for VMMs across the manufacturing cyberspace, which necessitates command and control of various virtualized manufacturing machines, opening new possibilities in cyber-physical systems in manufacturing.     

基于SDN网络构架的网络动态优化研究

针对动态网络优化依赖虚拟机在线迁移技术的问题,利用新型的网络架构SDN很好地实现了对网络设备的灵活管理和配置,达到数据中心虚拟化管理,且使得数据中心在资源优化,差错容忍和负载均衡方面具有很好的灵活性。同时,提出了一种基于QoS流机制的多路径虚拟机迁移策略(QMA),该机制通过对网络动态传输的虚拟机迁移资源划分为不同的QoS流,然后对每一个流选择有效的转发路径进行迁移,从而提高虚拟机整体迁移性能,最终达到对网络资源动态优化管理。     

Accelerator Virtualization Framework Based on Inter-VM Exitless Communication

The increasing deployment of artificial intelligence has placed unprecedent requirements on the computing power of cloud computing. Cloud service providers have integrated accelerators with massive parallel computing units in the data center. These accelerators need to be combined with existing virtualization platforms to partition the computing resources. The current mainstream accelerator virtualization solution is through the PCI passthrough approach, which however does not support fine-grained resource provisioning. Some manufacturers also start to provide time-sliced multiplexing schemes and use drivers to cooperate with specific hardware to divide resources and time slices to different virtual machines, which unfortunately suffer from poor portability and flexibility. One alternative but promising approach is based on API forwarding, which forwards the virtual machine''s request to the back-end driver for processing through a separate driver model. Yet, the communication due to API forwarding can easily become the performance bottleneck. This paper proposes Wormhole, an accelerator virtualization framework based on the C/S architecture that supports rapid delegated execution across virtual machines. It aims to provide upper-level users with an efficient and transparent way to accelerate the virtualization of accelerators with API forwarding while ensuring strong isolation between multiple users. By leveraging hardware virtualization feature, the framework minimizes performance degradation through exitless inter-VM control flow switch. Experimental results show that Wormhole''s prototype system can achieve up to 5 times performance improvement over the traditional open-source virtualization solution such as GVirtuS in the training test of the classic model.     

基于虚拟化环境下的网络安全监控技术应用

在某大型国企的数据中心虚拟化环境背景下,分析虚拟化与云计算安全在网络接入层的"虚拟以太网交换机"(Virtual Ethernet Bridge,VEB)技术在目前的实现方式中的优缺点,研究业界为解决其不足之处所提出的相关方案,阐述采用基于新型网络架构"软件定义网络"(Software Defined Network,SDN)中OpenFlow框架的可行性,提出采用该框架下的Open vSwitch开源技术来实现虚拟网络隔离、QoS配置、流量监控以及数据包分析等虚拟化网络安全监控工作的应用思路。本研究在虚拟网络交换的数据转发与安全控制的解耦、网络安全服务的独立和虚拟网络的安全控制等方面具有创新性,为采用虚拟化和云计算技术的信息系统在接入安全方面提供了参考价值。     

VM内部隔离驱动程序的可靠性架构

利用虚拟化技术来整合资源已成为高性能服务器提高资源利用率的重要手段,虚拟化技术的可靠性对于高性能服务器所提供服务的质量至关重要.然而,驱动故障严重影响了虚拟机中操作系统的可靠性,也同样影响到整个服务器的可靠性.为此,提出一种在虚拟机内部通过隔离故障驱动程序来提高虚拟机可靠性的架构,该架构通过监视驱动程序所使用的内存信息来建立驱动可写权限的授权表,并在虚拟机监视器中设置虚拟机内核空间对应影子页表的写保护来捕获虚拟机的写操作,进而结合授权表判断被隔离驱动程序写操作的正确性.目前,该架构能够在无需修改驱动程序的情况下,在虚拟机内部实现对驱动程序的隔离.实验结果表明：该架构可以隔离84.63%的注入故障造成的系统崩溃失效,并且对于驱动性能的影响小于20%,提高了虚拟化环境的可靠性.     

Mobile Fog Computing by Using SDN/NFV on 5G Edge Nodes

Fog computing provides quality of service for cloud infrastructure. As the data computation intensifies, edge computing becomes difficult. Therefore, mobile fog computing is used for reducing traffic and the time for data computation in the network. In previous studies, software-defined networking (SDN) and network functions virtualization (NFV) were used separately in edge computing. Current industrial and academic research is tackling to integrate SDN and NFV in different environments to address the challenges in performance, reliability, and scalability. SDN/NFV is still in development. The traditional Internet of things (IoT) data analysis system is only based on a linear and time-variant system that needs an IoT data system with a high-precision model. This paper proposes a combined architecture of SDN and NFV on an edge node server for IoT devices to reduce the computational complexity in cloud-based fog computing. SDN provides a generalization structure of the forwarding plane, which is separated from the control plane. Meanwhile, NFV concentrates on virtualization by combining the forwarding model with virtual network functions (VNFs) as a single or chain of VNFs, which leads to interoperability and consistency. The orchestrator layer in the proposed software-defined NFV is responsible for handling real-time tasks by using an edge node server through the SDN controller via four actions: task creation, modification, operation, and completion. Our proposed architecture is simulated on the EstiNet simulator, and total time delay, reliability, and satisfaction are used as evaluation parameters. The simulation results are compared with the results of existing architectures, such as software-defined unified virtual monitoring function and ASTP, to analyze the performance of the proposed architecture. The analysis results indicate that our proposed architecture achieves better performance in terms of total time delay (1800 s for 200 IoT devices), reliability (90%), and satisfaction (90%).