Method, device and equipment for dynamically isolating and allocating virtual network address and storage medium

Abstract

This application discloses a method, apparatus, device, and storage medium for dynamic isolation and allocation of virtual network addresses, relating to the field of virtual internet technology. The method includes receiving resource request information from a user, determining the currently allocated target virtual network address, and then determining the target network access zone where the target virtual network address resides; obtaining the target tenant identifier corresponding to the target network access zone; and accessing resource information under the target tenant associated with the target tenant identifier through the resource request information. By establishing the correspondence between the target virtual network address, the target network access zone, and the target tenant identifier, the method solves the problems of missing tenant isolation and inefficient fault recovery in related technologies, thereby achieving technical effects such as improved fault recovery efficiency, reduced data leakage risk, and enhanced data security.

Description

Technical Field

[0001] This application relates to the field of virtual internet technology, and in particular to a method, apparatus, device and storage medium for dynamic isolation and allocation of virtual network addresses. Background Technology

[0002] With the increasing prevalence of multi-tenant architectures, CTDB (Clustered Trivial Database), as a high-availability management component in distributed storage systems, directly impacts service continuity and resource utilization through its VIP (Virtual IP Address) allocation mechanism. Because existing CTDB virtual IP allocation schemes do not differentiate between tenant identities, different tenants' VIPs may share the same physical node, potentially leading to data leaks. Furthermore, after a node failure, VIP reallocation may disrupt tenant isolation policies, causing the same tenant's VIPs to concentrate on a few nodes, creating performance bottlenecks. Therefore, related technologies still suffer from issues such as inadequate tenant isolation, insufficient dynamic scaling, and inefficient fault recovery. Summary of the Invention

[0003] This application provides a method, apparatus, device, and storage medium for dynamic isolation and allocation of virtual network addresses, in order to at least solve the problem in related technologies where, in multi-tenant scenarios, VIPs of different tenants may be allocated to the same physical node, posing risks of resource contention and data leakage.

[0004] This application provides a method for dynamic isolation and allocation of virtual network addresses, the method comprising:

[0005] Receive user resource request information; Based on resource request information and domain name resolution rules, determine the target virtual network address to be allocated. Determine the target network access zone where the target virtual network address is located. The target virtual network address is contained within the target network access zone, and each target network access zone is configured with a unique subdomain. Obtain the target tenant identifier corresponding to the target network access zone, wherein there is a mapping relationship between the target network access zone and the target tenant identifier; Based on the resource request information, access the resource information of the target tenant associated with the target tenant identifier.

[0006] This application also provides a virtual network address dynamic isolation and allocation device, the device comprising: The receiving module is used to receive resource request information from users; The first determination module is used to determine the currently allocated target virtual network address based on resource request information and domain name resolution rules; The second determining module is used to determine the target network access zone where the target virtual network address is located, wherein the target virtual network address is contained in the target network access zone, and each target network access zone is configured with a unique subdomain. The acquisition module is used to acquire the target tenant identifier corresponding to the target network access zone, wherein there is a mapping relationship between the target network access zone and the target tenant identifier; The access module is used to access resource information under the target tenant associated with the target tenant identifier based on resource request information.

[0007] This application also provides an electronic device, including: Memory, used to store computer programs; A processor, used to implement any of the above-mentioned methods for dynamically isolating and allocating virtual network addresses when executing computer programs.

[0008] This application also provides a computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements the steps of any of the above-described virtual network address dynamic isolation allocation methods.

[0009] In the embodiments of this application, resource request information from a user is received, and based on the received resource request information and domain name resolution rules, the currently allocated target virtual network address is determined; after determining the target virtual network address, the target network access zone where the target virtual network address is located is determined, wherein the target virtual network address is contained in the target network access zone, and each target network access zone is configured with a unique subdomain; the corresponding target tenant identifier that has a mapping relationship with the target network access zone is obtained; and based on the resource request information, the resource information under the target tenant associated with the target tenant identifier is accessed. Therefore, this application receives resource requests and determines the target virtual network address according to the domain name resolution rules, then locates the target network access zone where the target virtual network address is located to obtain the corresponding target tenant identifier, thereby accessing the resources under the target tenant. Since each target network access zone is configured with a unique subdomain, it ensures that the VIPs of the same tenant are only distributed in the dedicated target network access zone, realizing the isolation between tenants. This not only solves the problem that the allocation scheme in related technologies does not distinguish the tenant identity, but also solves the problem of data leakage caused by VIPs of different tenants sharing the same physical node. At the same time, it also solves the problem that after a node failure, the redistribution of VIPs will break the tenant isolation strategy, resulting in the same tenant's VIPs being concentrated on some nodes and forming a performance bottleneck. This has the technical effects of improving the efficiency of fault recovery, reducing the risk of data leakage, and strengthening data security. Attached Figure Description

[0010] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A schematic diagram illustrating the process of a method for dynamically isolating and allocating virtual network addresses according to an embodiment of this application; Figure 2 A schematic diagram illustrating the process of another method for dynamic isolation and allocation of virtual network addresses provided in this application embodiment; Figure 3 A schematic diagram illustrating the process of another method for dynamic isolation and allocation of virtual network addresses provided in this application embodiment; Figure 4 A schematic diagram illustrating the flow of another method for dynamic isolation and allocation of virtual network addresses provided in this application embodiment; Figure 5 A schematic diagram illustrating a core process for tenant virtual network address allocation provided in an embodiment of this application; Figure 6 A block diagram of a virtual network address dynamic isolation and allocation device provided in an embodiment of this application; Figure 7 A block diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0012] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0013] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe the order or sequence of events.

[0014] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0015] With the increasing popularity of multi-tenant architectures, CTDB, as a high-availability management component, directly impacts service continuity and resource utilization through its VIP allocation mechanism. However, CTDB's VIP allocation scheme has several problems in related technologies: Traditional solutions do not differentiate between tenant identities, leading to VIPs from different tenants potentially sharing the same physical node. The lack of tenant isolation mechanisms can result in data leaks (e.g., in financial and healthcare scenarios). Furthermore, when the number of tenants surges, static allocation strategies can easily exhaust the VIP pool, and the inability to adjust resource quotas on demand leads to insufficient dynamic scaling. Additionally, VIP redistribution after node failures can disrupt tenant isolation strategies, resulting in VIPs from the same tenant concentrated on a few nodes, creating performance bottlenecks. Therefore, these technologies also suffer from inefficient fault recovery.

[0016] To address the aforementioned issues, related technologies prioritize allocating VIPs to the node with the fewest currently held business IPs during dynamic weight selection and node recovery. If multiple nodes have the same number of business IPs, the node with the fewest total virtual IPs is selected. However, these technologies lack tenant identifiers (such as Tenant-IDs), making it impossible to distinguish VIP resource pools from different tenants. Furthermore, in multi-tenant scenarios, VIPs from different tenants may be allocated to the same physical node, failing to resolve critical issues such as resource contention and data leakage (e.g., the mixing of VIPs from financial and medical tenants). Moreover, these technologies suffer from poor dynamic scalability, especially when the number of tenants surges. Due to the use of fixed allocation rules, tenant VIP quotas cannot be dynamically adjusted, leading to the problem of easily depleted tenant resources.

[0017] To address the aforementioned problems, embodiments of this application provide a method for dynamically isolating and allocating virtual network addresses, such as... Figure 1 As shown, Figure 1 The schematic diagram illustrates a method for dynamically isolating and allocating virtual network addresses according to an embodiment of this application. The specific process is as follows: Step S101: Receive the user's resource request information.

[0018] Specifically, in order to receive user resource request information, users can initiate requests through channels such as clients, Web (World Wide Web) interfaces, and API (Application Programming Interface) interfaces. Then, the requests are transmitted to the server through network protocols such as HTTP (Hypertext Transfer Protocol) / HTTPS (Hypertext Transfer Protocol Secure) and TCP / IP (Transmission Control Protocol / Internet Protocol). Some network listening components receive data packets and ensure data integrity and security during transmission through encryption, verification and other mechanisms. Subsequently, the server parses the received requests according to the protocol and format, and extracts key information such as user identifier, resource type, and quantity according to the corresponding specifications (such as parsing the request header and request body for HTTP requests, and RESTful (Representational State Transfer-full) for API requests).

[0019] The aforementioned resource request information includes, but is not limited to: core resource requirements (such as virtual network addresses, storage and other resource types, CPU (Central Processing Unit) / memory, storage capacity and other specifications and requested quantities), tenant association identifiers in multi-tenant scenarios (such as tenant identifiers and tenant names, used to locate the tenant), identity information of the initiator verifying the legitimacy of the request (such as user account, login token (i.e., a token, which in the computer field often refers to an abstract credential used for identity verification and permission management, and in natural language processing it can also refer to the basic unit after text segmentation), API key, etc.), additional constraints and configuration requirements of the user on the resources (such as resource usage period, access permission settings, deployment network access zone preferences, fault recovery requirements), and request metadata automatically generated by the system (such as request initiation time, unique tracking identifier, request source entry identifier). This information together ensures that the backend system can clearly understand the user's request, complete the legitimacy verification, and accurately match the corresponding tenant and resource configuration.

[0020] Step S102: Based on the resource request information and domain name resolution rules, determine the target virtual network address to be allocated.

[0021] Specifically, the Domain Name System (DNS) works by converting domain names into computer-readable IP (Internet Protocol) addresses. During execution, based on resource request information, it first queries the local device's cache (e.g., the browser's cache). If no result is found, the local DNS server initiates a recursive query, then queries DNS servers at various levels to obtain and determine the IP address (i.e., the target virtual network address) corresponding to the target domain name. At the same time, the local DNS caches the query results to speed up the processing of subsequent similar requests, ensuring that domain names and IP addresses are mapped efficiently and accurately.

[0022] Step S103: Determine the target network access zone where the target virtual network address is located. The target virtual network address is contained in the target network access zone, and each target network access zone is configured with a unique subdomain.

[0023] Specifically, since there is a pre-defined mapping relationship between virtual network addresses and network access zones ("domain name—virtual network address—network access zone—subnet—tenant"), the target network access zone that is mapped to the target virtual network address can be obtained based on this pre-defined mapping relationship, thus determining the target network access zone to which the target virtual network address belongs. A network access zone contains multiple virtual network addresses. First, an independent and non-overlapping virtual network address is assigned to each network access zone. Then, a unique subdomain is bound to each network access zone through DNS.

[0024] For example, a separately configured subdomain is resolved to the target network access zone. Finally, the entry device (such as a load balancer) forwards the request for the separately configured subdomain to the target virtual network address within the target network access zone for processing through an internal routing strategy (such as forwarding the request to the business node (such as a web server or database) with the corresponding virtual network address in the zone according to a preset logic). This achieves the isolation of the target virtual network address in the target access zone and the unique mapping of the subdomain.

[0025] Step S104: Obtain the target tenant identifier corresponding to the target network access zone, wherein there is a mapping relationship between the target network access zone and the target tenant identifier.

[0026] Specifically, through the pre-defined mapping relationship of "domain name - virtual network address - network access zone - subnet - tenant", the tenant ID (Identification / Identity Document) that the business needs to access can be obtained: Specifically, the associations are matched layer by layer in reverse order along the mapping chain: First, identify the target AZ (Availability Zone). Then, filter out all subnets explicitly belonging to that AZ from the mapping relationships (because an AZ is a network partition above a subnet, and one AZ typically corresponds to multiple subnets). Based on the association of "virtual network address—network access zone—subnet," reverse-confirm the virtual network addresses corresponding to these subnets. Finally, based on the mapping rule of "subnet—tenant," where each subnet records its unique tenant ID in the system (subnets are network resources of tenants and are directly bound to their tenants), extract all tenant IDs associated with subnets under that AZ.

[0027] Step S105: Based on the resource request information, access the resource information under the target tenant associated with the target tenant identifier.

[0028] Specifically, by introducing a tenant identifier (such as a Tenant-ID), a one-to-one correspondence is established between the tenant identifier and the tenant. This means that the target tenant can be obtained based on the target tenant identifier, thereby accessing the resource information under the target tenant. The aforementioned resource information can include core resource requirement information such as virtual network addresses and storage resource types, as well as various other resource information such as tenant association identifiers in multi-tenant scenarios, the identity information of the initiator of the verification request, and additional constraints and configuration requirements imposed by users on resources.

[0029] In the embodiments of this application, resource request information from a user is received, and based on the received resource request information and domain name resolution rules, the currently allocated target virtual network address is determined; after determining the target virtual network address, the target network access zone where the target virtual network address is located is determined, wherein the target virtual network address is contained in the target network access zone, and each target network access zone is configured with a unique subdomain; the corresponding target tenant identifier that has a mapping relationship with the target network access zone is obtained; and based on the resource request information, the resource information under the target tenant associated with the target tenant identifier is accessed. Therefore, this application receives resource requests and determines the target virtual network address according to the domain name resolution rules, then locates the target network access zone where the target virtual network address is located to obtain the corresponding target tenant identifier, thereby accessing the resources under the target tenant. Since each target network access zone is configured with a unique subdomain, it ensures that the VIPs of the same tenant are only distributed in the dedicated target network access zone, realizing the isolation between tenants. This not only solves the problem that the allocation scheme in related technologies does not distinguish the tenant identity, but also solves the problem of data leakage caused by VIPs of different tenants sharing the same physical node. At the same time, it also solves the problem that after a node failure, the redistribution of VIPs will break the tenant isolation strategy, resulting in the same tenant's VIPs being concentrated on some nodes and forming a performance bottleneck. This has the technical effects of improving the efficiency of fault recovery, reducing the risk of data leakage, and strengthening data security.

[0030] This embodiment provides yet another method for dynamic isolation and allocation of virtual network addresses. Figure 2 This is a flowchart of another method for dynamically isolating and allocating virtual network addresses according to an embodiment of this application, such as... Figure 2 As shown, the process includes the following steps: Step S201: Receive the user's resource request information. For details, please refer to [link to relevant documentation]. Figure 1 Step S101 of the illustrated embodiment will not be described again here.

[0031] Step S202: Based on the resource request information and domain name resolution rules, determine the currently allocated target virtual network address. For details, please refer to [link to relevant documentation]. Figure 1 Step S102 of the illustrated embodiment will not be described again here.

[0032] Step a1: Obtain multiple tenants and the tenant identifier corresponding to each tenant.

[0033] Specifically, in this embodiment, it is necessary to first determine which tenants are accessible under the current resource allocation network architecture. For example, a tenant table in a PostgreSQL database (a powerful open-source relational database management system) can be used to store multiple tenants. Each tenant has a tenant identifier (such as tenant ID), tenant name, and other information. By entering the tenant ID into the tenant table, the corresponding tenant can be identified. Currently, UUID (Universally Unique Identifier) ​​can be used as the tenant ID to avoid ID conflicts.

[0034] Step a2: Obtain the tenant subnet information and create a network access zone based on the subnet information.

[0035] Specifically, the subnet table in the PostgreSQL database records information such as subnet ID, subnet name, subnet gateway, subnet mask, IP address type, and DNS service. The subnet gateway is the gateway corresponding to the subnet's IP address. The IP address type includes "IPv4 (Internet Protocol version 4)" and "IPv6 (Internet Protocol version 6)". When the IP address is IPv4, it stores the subnet mask; when the IP address is IPv6, it stores the prefix length of the IPv6 address. Once a subnet is created, the IP address type cannot be changed. If you need to modify the IP address type, you must delete and recreate the subnet.

[0036] The AZ table in the PostgreSQL database is used to record AZ ID, AZ name, subnet name, tenant name, subdomain, DNS policy, etc. The subdomain needs to be used in conjunction with the common DNS service within the subnet. Since the DNS service, subnet name, and other common information in the subnet table are shared, tenants can use this shared information to create AZs.

[0037] Step a3: Establish the mapping relationship between the tenant identifier and the network access zone. The network access zone contains a list of virtual network addresses, which contains multiple virtual network addresses. The target tenant identifier is contained in the tenant identifier, and the target network access zone is contained in the network access zone.

[0038] Specifically, this application utilizes tenant tables, subnet tables, AZ tables, virtual IP tables, port tables, and DNS policy tables in a PostgreSQL database to confirm the mapping relationship of "domain name—virtual network address—network access zone—subnet—tenant". The tenant table stores tenant IDs, and the AZ table stores AZ IDs. Based on the above mapping relationship, a mapping relationship between tenant IDs and AZ IDs is established. Since the target tenant ID is one of many tenant IDs, and the target AZ ID is one of many AZ IDs, a mapping relationship exists between the target tenant ID and the target AZ ID.

[0039] An Availability Zone (AZ) contains an independent VIP list, DNS, and other information. Since the AZ contains a VIP list with multiple VIPs, and due to the mapping relationship between tenants and AZs, and the mapping relationship between tenant IDs and AZ IDs, it is possible to use a domain name and locate the target tenant through the mapping relationship of "domain name - virtual network address - network access zone - subnet - tenant".

[0040] Step S203: Determine the target network access zone where the target virtual network address resides. The target virtual network address is contained within the target network access zone, and each target network access zone is configured with a unique subdomain. For details, please refer to [link to relevant documentation]. Figure 1 Step S103 of the illustrated embodiment will not be described again here.

[0041] Step S204: Obtain the target tenant identifier corresponding to the target network access zone, wherein there is a mapping relationship between the target network access zone and the target tenant identifier. For details, please refer to [link to relevant documentation]. Figure 1 Step S104 of the illustrated embodiment will not be described again here.

[0042] Step S205: Based on the resource request information, access the resource information under the target tenant associated with the target tenant identifier. For details, please refer to [link to relevant documentation]. Figure 1 Step S105 of the illustrated embodiment will not be described again here.

[0043] In the embodiments of this application, information such as the tenant table, subnet table, AZ table, virtual IP table, port table, and DNS policy table in the PostgreSQL database is used to obtain multiple tenants and the tenant identifier corresponding to each tenant, and to obtain the subnet information of the tenants. A network access zone is created based on the subnet information, and finally a mapping relationship between the tenant identifier and the network access zone is established, thereby achieving network isolation. In the event of a failure, since the virtual IP will only drift within the AZ, it plays a role in protecting the tenant isolation policy.

[0044] As an optional embodiment, step S102 above, which determines the currently allocated target virtual network address based on resource request information and domain name resolution rules, includes: Step S1021: Based on the domain name resolution rules, resolve the resource request information into a list of target virtual network addresses.

[0045] Specifically, the domain name is resolved into a list of VIPs through the DNS policy table, and the target domain name is associated with the corresponding VIP list in the DNS policy table (for example, service.example.com is mapped to VIPs such as 10.0.1.10 and 10.0.1.11, and the numerous mapped VIPs form a VIP list).

[0046] Step S1022: Obtain resource data for each virtual network address in the target virtual network address list.

[0047] Specifically, if the scenario is a public cloud scenario, you can use the API to filter the corresponding VIP by the VIP list and obtain resource data such as CPU, memory, and network interfaces. If the scenario is a private virtualization scenario, you can use common management tools such as VMware vSphere Client and OpenStack Dashboard to enter the VIP to locate the virtual machine, view its hardware configuration and resource usage, and obtain resource data such as the number of node connections, CPU utilization, memory utilization, and bandwidth utilization.

[0048] Step S1023: Based on the resource data of each virtual network address and the preset algorithm, obtain the first balance value.

[0049] Specifically, using a preset algorithm, such as CTDB's LCP2 virtual IP algorithm, each AZ runs the above algorithm independently, and calculates the first balance value of each virtual network address to achieve load balancing.

[0050] Step S1024: Select the virtual network address whose first balance value meets the preset condition among all virtual network addresses as the target virtual network address.

[0051] Specifically, the preset condition set above is: lowest resource utilization. At this point, it is necessary to select the virtual network address with the lowest resource utilization from multiple first equilibrium values, and use the selected virtual network address as the target virtual network address.

[0052] In the embodiments of this application, a target virtual network address is selected from the VIP list by calculating a balance value using a preset algorithm. Using this preset algorithm not only combines various resource data to calculate the balance value, but also allows for the selection of nodes with the lowest resource utilization based on the calculated balance value, thus optimizing load balancing and improving overall stability.

[0053] As an optional embodiment, step S3021 above, which resolves the resource request information into a list of target virtual network addresses based on domain name resolution rules, includes: Step b1: Configure the domain name resolution rule policy table.

[0054] Specifically, different server types have different instructions for configuring DNS policy tables. For example, in Windows Server, server-level or client-side subnet-level policies are created using PowerShell commands (such as Add -DnsServerQueryResolutionPolicy); in Linux systems, commonly used software is installed first and then the main configuration file and zone files are edited, or the DNS server specified by the client is directly modified; Cisco devices can add rules by accessing the corresponding policy page through tools (such as FMC (Cisco Secure Firewall Management Center, a centralized firewall management platform)).

[0055] Step b2: Receive the domain name resolution request for the resource request information.

[0056] Specifically, in order to receive domain name resolution requests from users for resource requests, users can initiate requests through channels such as clients, web interfaces, and API interfaces. The requests are then transmitted to the server via network protocols, where network listening components receive the data packets and use encryption and verification mechanisms to ensure data integrity and security during transmission. Subsequently, the server parses the received requests according to their protocols and formats to extract the domain name resolution requests.

[0057] Step b3: Find the policy for the domain name in the domain name resolution rule policy table and filter out the list of target virtual network addresses.

[0058] Specifically, since the domain name has been resolved into a VIP list through the DNS policy table, low-load VIPs are prioritized in the VIP list resolved by the DNS policy table. The set of many low-load VIPs selected is the target virtual network address list.

[0059] In the embodiments of this application, resource request information is resolved into a VIP list via DNS, providing a basis for subsequent VIP allocation.

[0060] This embodiment provides another method for dynamic isolation and allocation of virtual network addresses. Figure 3 This is a flowchart of another method for dynamically isolating and allocating virtual network addresses according to an embodiment of this application, such as... Figure 3 As shown, the process includes the following steps: Step S301: Receive the user's resource request information. For details, please refer to [link to relevant documentation]. Figure 1 Step S101 of the illustrated embodiment will not be described again here.

[0061] Step S302: Based on the resource request information and domain name resolution rules, determine the currently allocated target virtual network address.

[0062] Specifically, step S302 includes: Step S3021: Read the database configuration file to obtain the list of unused network addresses, available network port status, and associated node information in the target network access zone.

[0063] Specifically, the CTDB configuration file is read to obtain the AZ topology, IP pool range (e.g., 10.0.1.0 / 24), and node network interface information. Simultaneously, each AZ independently scans its local IP pool, marking idle IPs and associated ports.

[0064] Step S3022: Determine the reference virtual network address based on the list of unoccupied network addresses, the status of available network ports, and the associated node information.

[0065] Specifically, based on the AZ configuration, a list of unoccupied IP addresses in each AZ is collected, the available network interface status and associated node information of each AZ are obtained, and the allocated IP addresses are matched with physical resources. Nodes with normal available network interface status and unoccupied in the network address list are identified as reference virtual network addresses.

[0066] Step S3023: Based on the resource data of the reference virtual network address and the preset algorithm, a second balance value is obtained.

[0067] Specifically, using a preset algorithm, such as CTDB's LCP2 virtual IP algorithm, each AZ runs the above algorithm independently, and calculates the second balance value for each virtual network address to achieve load balancing.

[0068] Step S3024: Select the virtual network address whose second balance value meets the preset condition among all virtual network addresses as the target virtual network address.

[0069] Specifically, the preset condition set above is: lowest resource utilization. At this point, it is necessary to select the virtual network address with the lowest resource utilization from multiple second equilibrium values, and use the selected virtual network address as the target virtual network address.

[0070] Step S303: Determine the target network access zone where the target virtual network address resides. The target virtual network address is contained within the target network access zone, and each target network access zone is configured with a unique subdomain. For details, please refer to [link to relevant documentation]. Figure 1 Step S103 of the illustrated embodiment will not be described again here.

[0071] Step S304: Obtain the target tenant identifier corresponding to the target network access zone, wherein there is a mapping relationship between the target network access zone and the target tenant identifier. For details, please refer to [link to relevant documentation]. Figure 1 Step S104 of the illustrated embodiment will not be described again here.

[0072] Step S305: Based on the resource request information, access the resource information under the target tenant associated with the target tenant identifier. For details, please refer to [link to relevant documentation]. Figure 1 Step S105 of the illustrated embodiment will not be described again here.

[0073] In the embodiments of this application, a balance value is calculated by using a preset algorithm and a balance value calculation, combined with various resource data, and a target virtual network address is selected from the VIP list based on the calculated balance value, thereby further optimizing load balancing.

[0074] This embodiment provides another method for dynamic isolation and allocation of virtual network addresses. Figure 4 This is a flowchart of another method for dynamically isolating and allocating virtual network addresses according to an embodiment of this application, such as... Figure 4 As shown, the process includes the following steps: Step S401: Receive network address release message.

[0075] Specifically, the aforementioned network address release message is an IP release message. By receiving a network address release message, the occupied IP resource is released, allowing other nodes within the network to reuse the IP address.

[0076] Step S402: Based on the network address release message, change the allocated target virtual network address to an idle state.

[0077] Specifically, upon receiving an IP release message, the faulty node will actively or passively release the VIP it holds and reclaim the VIP resources that are no longer needed, thus preventing the VIP from "hovering" on the unavailable node and causing service interruption.

[0078] In the embodiments of this application, redundant IPs are actively reclaimed by releasing IP release messages, ensuring the accuracy of resource allocation and avoiding service interruptions caused by VIP "hovering", thereby further improving security and stability.

[0079] As an optional embodiment, the method further includes: Step c1: Receive network address acquisition message.

[0080] Specifically, the network address retrieval message mentioned above is an IP take message. Since each IP address is unique, the data packet can locate the recipient by the received IP address, avoiding mistransmission of information.

[0081] Step c2: Obtain messages based on network addresses, query the list of unused network addresses in the target network access zone, allocate the free virtual network addresses, and complete the binding of virtual network addresses.

[0082] Specifically, the target network area is scanned, and unused VIPs are identified based on existing allocation records. When a device requests access, a temporary VIP is selected from the available VIPs according to rules. After the device confirms, the address is bound to the device and updated to "occupied," while the lease is recorded to ensure that the VIP always points to an available node, thus achieving VIP binding. After allocating available VIPs, expired or restricted VIPs are reclaimed for reallocation, securely taking over available resources.

[0083] In the embodiments of this application, network management efficiency is further improved and address conflicts are avoided by securely taking over available resources through receiving IP take messages; expired or idle addresses are reclaimed through IP take messages, realizing efficient utilization of virtual network address resources, avoiding resource waste, and further optimizing resource utilization.

[0084] This application also provides a core process for tenant virtual network address allocation, applicable to methods for dynamic isolation and allocation of virtual network addresses, such as... Figure 5 As shown: For each Availability Zone (AZ) corresponding to a tenant (i.e., the minimum network resource), this embodiment will independently perform calculations based on the AZ ID, for the virtual IP pool and port pool within a group of AZs, using the CTDB virtual IP allocation algorithm. Specifically, the main steps can be summarized as follows: Step S501: CTDB reads and parses the configuration file.

[0085] Specifically, the CTDB configuration file is read to obtain the AZ topology, IP pool range (e.g., 10.0.1.0 / 24), and node network interface information. Simultaneously, each AZ independently scans its local IP pool, marking idle IPs and associated ports.

[0086] Step S502: Obtain the available IPs for each AZ based on the AZ configuration.

[0087] Specifically, based on the AZ configuration, a list of unused IP addresses is collected in each AZ.

[0088] Step S503: Obtain the available network ports and node information for each AZ according to the AZ configuration.

[0089] Specifically, the available network interface status and associated node information of each AZ are obtained to ensure that the allocated IP matches the physical resources and to achieve resource information synchronization.

[0090] Step S504: Each AZ uses an IP allocation algorithm to allocate IP addresses.

[0091] Specifically, the LCP2 virtual IP algorithm of CTDB (i.e., the IP allocation algorithm shown in the figure) is used. Each AZ runs the algorithm independently to generate IP allocation configurations. Finally, the allocation results of all virtual IPs are aggregated.

[0092] Step S505: Send a message to all nodes to release the IP address.

[0093] Specifically, an IP release command, or IP release message, is sent to all nodes to reclaim IP resources that are no longer needed.

[0094] Step S506: Send a message to all nodes to perform IP take.

[0095] Specifically, an IP takeover command, or IP take message, is sent to the target node to complete the IP binding.

[0096] In the embodiments of this application, the independence is improved by executing the IP allocation algorithm independently within each AZ to avoid cross-AZ resource contention; load balancing and dynamic balancing are achieved by calculating the balance value and allocating the IP with the lowest resource utilization based on the balance value; and the accuracy of resource allocation is ensured by actively reclaiming redundant IPs, achieving redundancy cleanup and securely taking over available resources, further improving security and stability.

[0097] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0098] This embodiment also provides a virtual network address dynamic isolation allocation device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0099] Embodiments of this application also provide a virtual network address dynamic isolation and allocation device, such as... Figure 6 As shown, the device includes: The first receiving module 601 is used to receive user resource request information; The first determining module 602 is used to determine the currently allocated target virtual network address based on resource request information and domain name resolution rules; The second determining module 603 is used to determine the target network access zone where the target virtual network address is located, wherein the target virtual network address is contained in the target network access zone, and each target network access zone is configured with a unique subdomain. The acquisition module 604 is used to acquire the target tenant identifier corresponding to the target network access zone, wherein there is a mapping relationship between the target network access zone and the target tenant identifier; Access module 605 is used to access resource information under the target tenant associated with the target tenant identifier based on resource request information.

[0100] As an optional implementation, the device further includes: The allocation module is used to obtain multiple tenants and the tenant identifier corresponding to each tenant before determining the target network access zone where the target virtual network address is located; Create a module to obtain the tenant's subnet information and create a network access zone based on the subnet information; The establishment module is used to establish the mapping relationship between the tenant identifier and the network access zone. The network access zone contains a list of virtual network addresses, which contains multiple virtual network addresses. The target tenant identifier is contained in the tenant identifier, and the target network access zone is contained in the network access zone.

[0101] As an optional implementation, the first determining module 602 includes: The parsing submodule is used to parse resource request information into a list of target virtual network addresses based on domain name resolution rules; The acquisition submodule is used to acquire resource data for each virtual network address in the target virtual network address list; The first submodule is used to obtain the first balance value based on the resource data of each virtual network address and a preset algorithm; The first selection submodule is used to select the virtual network address whose first balance value meets the preset conditions among various virtual network addresses as the target virtual network address.

[0102] As an optional implementation, the parsing submodule includes: The configuration unit is used to configure the domain name resolution rule policy table; The receiving unit is used to receive domain name resolution requests for resource request information; The filtering unit is used to find the policy for the domain name in the domain name resolution rule policy table and filter out the list of target virtual network addresses.

[0103] As an optional implementation, the first determining module 602 includes: The read submodule is used to read the database configuration file and obtain the list of unused network addresses, available network interface status, and associated node information in the target network access zone; The determination submodule is used to determine the reference virtual network address based on the list of unoccupied network addresses, the status of available network ports, and associated node information; The second submodule is used to obtain a second equilibrium value based on resource data from the reference virtual network address and a preset algorithm. The second selection submodule is used to select the virtual network address whose second balance value meets the preset conditions among the various virtual network addresses as the target virtual network address.

[0104] As an optional implementation, the device further includes: The second receiving module is used to receive network address release messages; The modification module is used to release messages based on network addresses, changing the allocated target virtual network address to an idle state.

[0105] As an optional implementation, the device further includes: The third receiving module is used to receive network address acquisition messages; The binding module is used to obtain messages based on network addresses, query the list of unused network addresses in the target network access zone, allocate the free virtual network addresses, and complete the binding of virtual network addresses.

[0106] For a description of the features in the embodiment corresponding to the virtual network address dynamic isolation allocation device, please refer to the relevant description of the embodiment corresponding to the virtual network address dynamic isolation allocation method, which will not be repeated here.

[0107] Embodiments of this application also provide an electronic device, such as... Figure 7 As shown, it includes a memory 10 and a processor 20. The memory 10 stores a computer program, and the processor 20 is configured to run the computer program to perform the steps in any of the above embodiments of the virtual network address dynamic isolation allocation method.

[0108] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above embodiments of the virtual network address dynamic isolation allocation method when running.

[0109] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0110] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above embodiments of the virtual network address dynamic isolation allocation method.

[0111] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above embodiments of the virtual network address dynamic isolation allocation method.

[0112] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the second application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each second application, but such implementation should not be considered beyond the scope of this application.

[0113] The foregoing has provided a detailed description of a method, apparatus, device, and storage medium for dynamic isolation and allocation of virtual network addresses provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only intended to aid in understanding the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of the claims of this application.

Claims

1. A method for dynamically isolating and allocating virtual network addresses, characterized in that, The method includes: Receive user resource request information; Based on the resource request information and domain name resolution rules, the target virtual network address to be allocated is determined. Determine the target network access zone where the target virtual network address is located, wherein the target virtual network address is contained in the target network access zone, and each target network access zone is configured with a unique subdomain. Obtain the target tenant identifier corresponding to the target network access zone, wherein there is a mapping relationship between the target network access zone and the target tenant identifier; Based on the resource request information, access the resource information under the target tenant associated with the target tenant identifier.

2. The method according to claim 1, characterized in that, Before determining the target network access zone where the target virtual network address is located, the method further includes: Retrieve multiple tenants and the tenant identifier for each tenant; Obtain the tenant's subnet information and create a network access zone based on the subnet information; Establish a mapping relationship between the tenant identifier and the network access zone, wherein the network access zone contains a list of virtual network addresses, the list of virtual network addresses contains multiple virtual network addresses, the target tenant identifier is contained in the tenant identifier, and the target network access zone is contained in the network access zone.

3. The method according to claim 2, characterized in that, The step of determining the currently allocated target virtual network address based on the resource request information and domain name resolution rules includes: Based on the domain name resolution rules, the resource request information is resolved into the target virtual network address list; Obtain resource data for each virtual network address in the target virtual network address list; Based on the resource data of each virtual network address and a preset algorithm, a first balance value is obtained; The virtual network address whose first balance value satisfies the preset condition among all the virtual network addresses is selected as the target virtual network address.

4. The method according to claim 3, characterized in that, The step of resolving the resource request information into the target virtual network address list based on the domain name resolution rules includes: Configure the domain name resolution rule policy table; Receive the domain name resolution request for the resource request information; The policy for the domain name is found in the domain name resolution rule policy table, and the list of target virtual network addresses is filtered out.

5. The method according to claim 1, characterized in that, The step of determining the currently allocated target virtual network address based on the resource request information and domain name resolution rules includes: Read the database configuration file to obtain the list of unoccupied network addresses, available network port status, and associated node information in the target network access zone; Based on the list of unoccupied network addresses, the status of available network ports, and the associated node information, a reference virtual network address is determined; Based on the resource data of the reference virtual network address and the preset algorithm, a second balance value is obtained; The virtual network address whose second balance value satisfies the preset condition among all the virtual network addresses is selected as the target virtual network address.

6. The method according to claim 1, characterized in that, The method further includes: Receive network address release message; Based on the network address release message, the allocated target virtual network address is changed to an idle state.

7. The method according to claim 5, characterized in that, The method further includes: Receive messages from network addresses; Based on the network address, the system retrieves the message, queries the list of unoccupied network addresses within the target network access zone, allocates the available virtual network addresses, and completes the binding of the virtual network addresses.

8. A virtual network address dynamic isolation and allocation device, characterized in that, The device includes: The first receiving module is used to receive user resource request information; The first determining module is used to determine the currently allocated target virtual network address based on the resource request information and the domain name resolution rules; The second determining module is used to determine the target network access zone where the target virtual network address is located, wherein the target virtual network address is contained in the target network access zone, and each target network access zone is configured with a unique subdomain. The acquisition module is used to acquire the target tenant identifier corresponding to the target network access zone, wherein there is a mapping relationship between the target network access zone and the target tenant identifier; The access module is used to access resource information under the target tenant associated with the target tenant identifier based on the resource request information.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the virtual network address dynamic isolation allocation method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein when the computer program is executed by a processor, it implements the steps of the virtual network address dynamic isolation allocation method as described in any one of claims 1 to 7.

Images