Method, device and system for virtual machines to access physical servers in cloud computing systems

Abstract

A method, device and system for a virtual machine to access a physical server in a cloud computing system, wherein a service is deployed on the physical server, a cloud platform allocates a published IP address and a published port corresponding to the service to the service, publishes the service externally, and configures a NAT rule on an access network element of the virtual machine, wherein the NAT rule includes a correspondence between the published IP address and the published port and the IP address and port of the physical server running the service, and when the access network element receives a service access request from the virtual machine to access the service, the destination address of the service access request is modified to the IP address and port of the physical server according to the NAT rule, and the modified service access request is routed to the physical server, thereby enabling the virtual machine to access the service on the physical server without knowing the real IP address and port of the physical server.

Description

Technical Field

[0001] The present invention relates to the field of IT technology, and in particular to a method, device and system for a virtual machine to access a physical server in a cloud computing system. Background Art

[0002] In the cloud computing environment, due to configuration or performance factors, some services need to be run directly on physical servers (PM), such as Oracle databases (DB). Users log in to virtual machines (VMs) and access the physical servers where the above services are deployed through the network.

[0003] In the prior art, VMs need to obtain the IP address of PMs to access various services on physical servers. When VMs can obtain the real IP address of PMs or PM clusters running services, the network planning information of the physical servers where the services are located on the cloud platform is exposed, and malicious users can launch network attacks on the network where the PMs are located and the devices in the network, thereby endangering the security of the cloud platform. Summary of the invention

[0004] The embodiments of the present invention describe a method, device and system for a virtual machine to access a physical server, so as to prevent the virtual machine from obtaining the real address of the physical server and endangering network security.

[0005] On the one hand, an embodiment of the present invention provides a system for a virtual machine to access a physical server, the system comprising a cloud platform, at least one physical server, at least one host and at least one access network element, the host, the physical server and the cloud platform communicate with each other, at least one virtual machine runs on the host, the virtual machine accesses the physical server through the access network element, and a service is deployed on the physical server, wherein the cloud platform allocates a published IP address and a published port corresponding to the service to the service, establishes a correspondence between the published IP address and the published port and the IP address and port of the physical server running the service, and the cloud platform publishes the service so that the service is visible to the virtual machine; the cloud platform sends a NAT rule associated with the virtual machine to the access network element, the NAT rule includes a correspondence between the published IP address and the published port and the IP address and port of the physical server running the service; the access network element receives a service access request sent by the virtual machine, replaces the destination address of the service access request with the IP address and port of the physical server according to the NAT rule, routes the modified service access request to the physical server, and receives a service response message returned by the physical server. Through the above process, the virtual machine can access the service without knowing the real IP address and port of the physical server where the service is deployed. In addition, since the service can be uniquely identified by the published IP address and published port corresponding to the service, even if the service is deployed on different physical servers or physical server clusters with multiple IP addresses, different virtual machines can use the same published IP address and published port to access the same service without paying attention to the real IP address and port of the physical server or physical server cluster where the service is actually located, thereby achieving a unified service access method.

[0006] In one possible design, the source address of the service response message is the IP address and port of the physical server. When the access network element receives the service response message returned by the cloud platform, the source address of the service response message can be replaced with the published IP address and published port corresponding to the service according to the NAT rule, and the modified service response message is sent to the virtual machine, so that the service response message received by the virtual machine still does not contain the real address of the physical server. It should be noted that the source address of the service response message sent by the cloud platform can also be directly set to the published IP address and published port, without the need for the access unit to modify the source address. When the source address of the service response message sent by the physical server is the real address of the physical server, the physical server does not need to be modified to adapt to the embodiment of the present invention, thereby improving the efficiency of service deployment and release. When the source address of the service response message sent by the physical server is the published IP address and the published port corresponding to the service, the physical server needs to be adaptively modified to record the correspondence between the service and the published IP address and the published port. When the physical server sends a service response message, the source address of the service response message is set to the published IP address and the published port. At this time, the access network element does not need to perform NAT conversion on the source address of the service response message, which improves the efficiency of the virtual machine accessing the service deployed on the physical server. On the other hand, since the physical server needs to be modified to execute the solution of the embodiment of the present invention, the efficiency of service deployment and release is reduced.

[0007] In a possible design, the cloud platform can use multiple methods to publish the service. It should be noted that the cloud platform has a service presentation interface for users and a management presentation interface for operation and maintenance personnel. Users can log in to the service presentation interface, browse various services provided by the cloud platform, and initiate service applications. The cloud platform displays service information on the service presentation interface and provides users with an introduction to the service. The service information includes the external display address of the service.

[0008] In a possible design, the external display address of the service can be the published IP address and the published port, or the domain name corresponding to the service. When the external display address is the published IP address and the published port, the virtual machine can use the published IP address and the published port as the destination address to request access to the service from the physical server; when the external display address is the domain name, the virtual machine needs to first obtain the address corresponding to the domain name, so the virtual machine initiates a domain name resolution operation to the DNS server, and obtains the address corresponding to the domain name from the DNS server, wherein the address corresponding to the domain name is the published IP address and the published port. The cloud platform can send the corresponding relationship between the domain name and the published IP address and the published port corresponding to the service to the DNS server in advance through the registration process. Specifically, the cloud platform sends the corresponding relationship between the domain name and the published IP address and the published port to the domain name system DNS server; the virtual machine is used to initiate a domain name resolution operation, and obtain the published IP address and the published port corresponding to the service from the DNS server according to the domain name.

[0009] In one possible design, a user logs in to the service presentation page and applies for a service from the cloud platform. The cloud platform returns a service application response to the virtual machine, and the service application response carries the external display address.

[0010] In one possible design, for a user's service application request, after the cloud platform determines that the service authorization is passed, the cloud platform records the authorization information of the user to which the virtual machine belongs, where the authorization information of the user includes a user ID, a virtual machine ID, and an account number and password assigned to the user. The cloud platform can use the recorded authorization information to authenticate the user's service access request.

[0011] In one possible design, the cloud platform can perform service authorization based on the granularity of the user, that is, when the user has multiple virtual machines, the user can access the authorized services through any of the virtual machines. When the user creates a new virtual machine, the cloud platform sends the NAT rules to the access network element connected to the new virtual machine, so that the user can normally access the services on the physical server through the new virtual machine. Performing service authorization based on the granularity of the user can bring greater convenience to the user, so that the user does not need to apply for service authorization for each virtual machine separately. Furthermore, when the user deletes any virtual machine belonging to the user, the cloud platform notifies the access network element to delete the NAT rules associated with the virtual machine when deleting the virtual machine.

[0012] The user can actively request to terminate the service authorization, or the cloud platform can actively terminate the service authorization for the user when the user is in arrears. When the cloud platform determines that the service authorization of the user needs to be terminated, the cloud platform determines the virtual machine involved and sends a deletion message to the access network element connected to the virtual machine, notifying the access network element to delete the NAT rules of the virtual machine.

[0013] The cloud platform may also have the capability of service detection / collection, and when a new service is launched on a physical server, the cloud platform may timely obtain service information and information of the physical server on which the service is deployed.

[0014] In one possible design, the physical server is a single physical server or a physical server cluster.

[0015] On the other hand, an embodiment of the present invention provides a method for a virtual machine to access a physical server in a cloud computing system, and a cloud platform executes the steps in the above system.

[0016] On the other hand, an embodiment of the present invention provides another method for a virtual machine to access a physical server in a cloud computing system, wherein an access network element executes the steps in the above system.

[0017] Corresponding to the above-mentioned system and method, an embodiment of the present invention provides a cloud platform, which has the function of implementing the cloud platform defined in the above-mentioned system. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions.

[0018] Corresponding to the aforementioned system and method, an embodiment of the present invention further provides a host on which a virtual machine and an access network element defined in the system are running. The access network element may be a virtual machine network element, for example, openvswitch, or the access network element may be implemented in hardware, specifically a top-of-rack switch on the host. The host has the function of implementing the access network element defined in the above system. Furthermore, the host may also have the function of the virtual machine defined in the above system. The function may be implemented by hardware, or may be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0019] In a possible design, the cloud platform and the host are implemented by a general or dedicated server, the structure of the server includes a processor, a memory, a system bus, and an input and output interface, and the processor is configured to support the corresponding functions of the cloud platform or the host in the system. The input and output interface is used to communicate with other components in the cloud computing system, and the processor executes instructions stored in the memory.

[0020] On the other hand, an embodiment of the present invention provides a computer storage medium for storing computer software instructions used for the above-mentioned cloud platform, which includes a program designed for executing the above-mentioned aspects.

[0021] On the other hand, an embodiment of the present invention provides a computer storage medium for storing computer software instructions for the above-mentioned host, which includes a program designed for executing the above-mentioned aspects.

[0022] Compared with the prior art, the solution provided by the embodiment of the present invention can shield the real address of the physical server where the service is deployed from the virtual machine, while providing a unified access method to the virtual machine, which not only ensures the network security of the cloud platform, but also improves the convenience of user access to services. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art description are briefly introduced below. Obviously, the following drawings only reflect some embodiments of the present invention. For ordinary technicians in this field, other implementation methods of the present invention can be obtained based on these drawings without creative work. All these embodiments or implementation methods are within the protection scope of the present invention.

[0024] Figure 1A is a schematic diagram of a network architecture of a cloud computing system provided by an embodiment of the present invention;

[0025] Figure 1B is a schematic diagram of a network architecture of another cloud computing system provided by an embodiment of the present invention;

[0026] Figure 2 It is a schematic diagram of the hardware structure of a computer device provided by an embodiment of the present invention;

[0027] Figure 3 is a schematic diagram of a virtualization structure on a host provided by an embodiment of the present invention;

[0028] Figure 4 It is a flow chart of message forwarding processing for a virtual machine to access a physical server provided by an embodiment of the present invention;

[0029] Figure 5 It is a flow chart of a virtual machine accessing a service running on a physical server provided by an embodiment of the present invention;

[0030] Figure 6 It is a structural schematic diagram of a cloud platform provided by an embodiment of the present invention;

[0031] Fig. 7A A schematic diagram of the structure of an access device provided by an embodiment of the present invention;

[0032] Figure 7B A schematic diagram of the structure of another access device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0033] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] The network architecture and business scenarios described in the embodiments of the present invention are intended to more clearly illustrate the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. A person of ordinary skill in the art can appreciate that with the evolution of the network architecture and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present invention are equally applicable to similar technical problems.

[0035] like Figure 1A and Figure 1B As shown, it is a network architecture diagram of a cloud computing system provided in an embodiment of the present invention, and the cloud computing system includes a host 101, a cloud platform 102, a physical server 103, a network 104, and an access network element 105. Several virtual machines are running on the host 101, and the virtual machines are connected to the network 104, access the cloud platform 102, and the physical server 103 through the access network element 105.

[0036] The virtual machine running on the host 101 carries the user's business. The user uses the client to log in to the virtual machine, and then accesses various services released by the cloud platform 102 through the network 104. The services are services running on the physical server 103, such as database services. The cloud computing system can be structurally divided into the Infrastructure as a Service (IAAS) layer, the Platform as a Service (PAAS) layer, and the Software as a Service (SAAS) layer. The services deployed on the physical server 103 are generally PAAS layer services.

[0037] Cloud platform 102: The management end of the cloud computing system, used to manage the underlying equipment and services provided by the cloud computing provider, including the management of computing, network and storage resources, and monitoring of operation and maintenance. Cloud platform 102 also includes a service presentation page for users and a management presentation page for administrators. The administrator configures and manages the services deployed on the physical server through the management presentation page; when the service deployment is completed, the user logs in to the service presentation page of the cloud platform 102 to view the available services. The service information displayed on the service presentation page includes the external display address of the service. When the VM needs to access the above service, the VM initiates a request to access the above service through the external display address. The external display address can uniquely identify the above service deployed on the physical server. The external display address can specifically be the published IP address and published port corresponding to the service, or the domain name corresponding to the service.

[0038] The cloud platform 102 establishes a correspondence between the published IP address and published port corresponding to the service and the real address of the physical server 103 where the service is deployed, and sends the correspondence to the access network element 105 of each virtual machine. When the external display address of the service is the published IP address and published port, the virtual machine uses the published IP address and published port as the destination address of the service access request to initiate the service access process; when the external display address of the service is the domain name corresponding to the service, the virtual machine needs to first initiate the domain name resolution process, obtain the published IP address and published port corresponding to the domain name from the DNS server, and then use the published IP address and published port as the destination address of the service access request to initiate the service access process. It should be noted that when the external display address of the service is the domain name corresponding to the service, after the service deployment is completed, the cloud platform 102 is also used to send the correspondence between the domain name and the published IP address and published port to the domain name system DNS server. The DNS server is used internally by the cloud computing system, and the DNS server is connected to the host 101 and the cloud platform 102 through the network 104.

[0039] In a specific implementation scenario, the cloud platform 102 includes an SDN (Software Defined Network) controller. Preferably, the SDN controller in the cloud platform 102 obtains the network topology of the virtual machine and sends network address translation (NAT) rules to the access network element 105 of the virtual machine in the form of a flow table. The NAT rules include the correspondence between the published IP address and the published port and the IP address and port of the physical server 103 running the service.

[0040] The published IP and published port are specifically the IP and port corresponding to the service, that is, a service can be uniquely identified by the published IP address and published port. The published IP can use a reserved address, which is an IP address that cannot be used by the data service network, such as 169.254.*.*; the published port can use a well-known port, which is a port number reserved by the Internet Corporation for Assigned Names and Numbers (ICANN) for the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP). For example, 169.254.169.254+3306 can be used to represent the access address of the database service.

[0041] In the embodiment of the present invention, the external display address of the same service is the same for different users.

[0042] The cloud platform 102 may have the following functions:

[0043] Operation and maintenance function, that is, the system administrator can configure and manage the service through the management presentation interface provided by the cloud platform 102;

[0044] Monitoring function, that is, real-time monitoring of physical servers to obtain service online / offline information;

[0045] A network information acquisition function, namely, acquiring the network topology of the virtual machine running on the host 101 and acquiring the IP address and port of the physical server 103 running the service;

[0046] Service publishing function, that is, presenting service information to users through the service presentation interface;

[0047] Furthermore, the cloud platform 102 may also have functions such as service billing and alarm.

[0048] Physical server 103: The physical server on which the above services are deployed can be a single physical server or a server cluster. The virtual machine accesses the physical server 103 through the network 104 and accesses the services running on the physical server 103. It should be noted that when the physical server 103 is a physical server cluster, the real address of the physical server on which the above services are deployed is the address presented to the outside by the physical server cluster. For example, when the cluster is in the active-standby mode, the active-standby physical servers have the same address, and the same address is the address presented to the outside by the physical server cluster; or, when multiple physical servers form a cluster, the virtual IP address of the master node in the cluster is presented to the outside as the address presented to the outside by the physical server cluster. When the service access request of the virtual machine is routed to the address presented to the outside by the physical server cluster, the service can be provided by a server in the cluster in a load balancing manner. It should be noted that the embodiment of the present invention does not limit the implementation form of the above server cluster. As long as the service access request can be routed to the server cluster through the address presented to the outside by the server cluster, the implementation method of load balancing within the server cluster can adopt various solutions in the prior art.

[0049] When the physical server 103 receives a service access request from the virtual machine, it processes the service access request and returns a service access response. Exemplarily, the service access request may be a database query request initiated by the virtual machine, which is used to query data from a database service deployed on the physical server 103. The database query request may carry query conditions. When the database query request is routed to the physical server 103, the physical server 103 generates a query result according to the query condition, carries the query result in a service access response, and returns the service access response to the virtual machine. It should be noted that the embodiments of the present invention do not limit the type and purpose of the service access request, nor do they limit the specific method for the physical server 103 to process the service access request. Various service access requests commonly used in the prior art are applicable in the embodiments of the present invention. Various methods for physical servers to process service access requests disclosed in the prior art may also be directly referenced in the embodiments of the present invention.

[0050] Access network element 105: specifically, it can be a virtual network element (e.g., Open vSwitch) running on the host 101 or a top of rack switch (TOP OF Rack, TOR) of the host. The access network element 105 is connected to the virtual machine and provides network access capabilities to the virtual machine. The access network element 105 can be as follows: Figure 1A As shown, it is located in the virtualization layer of the host 101; it can also be as shown Figure 1BAs shown, it is a top-of-rack switch physically connected to the host 101. The top-of-rack switch is an independent hardware device. In a specific application scenario, a host can exclusively use a top-of-rack switch, multiple hosts can share a top-of-rack switch, or multiple hosts can share multiple top-of-rack switches. The embodiment of the present invention does not limit this.

[0051] A NAT rule associated with the virtual machine is configured on the access network element, wherein the NAT rule includes a correspondence between a published IP address and a published port corresponding to the service and an IP address and a port of the physical server. Furthermore, the NAT rule may be directed to both the outbound VM direction and the inbound VM direction. It should be noted that, in each embodiment of the present invention, the IP address and port of the physical server are the real IP address and port of the physical server, to distinguish them from the published IP address and published port corresponding to the service.

[0052] In a possible implementation manner, the NAT rule may be implemented by using Iptables in a Linux system, or a flow table issued by an SDN controller. The embodiment of the present invention does not limit the specific implementation manner.

[0053] In a typical scenario, the VM on the IAAS layer of the cloud platform vendor accesses the PAAS service running on the PM through the network. When IAAS and PAAS are provided by different vendors, the PAAS service running on the PM can be decoupled from IAAS, which is conducive to the rapid integration of IAAS and PAAS.

[0054] The method for a virtual machine to access a physical server proposed in an embodiment of the present invention can make the real address of the physical server invisible to the virtual machine, thereby shielding the virtual machine from network attacks on the physical server, and improving the security of the cloud computing system; for different users, the physical server presents the same external display address to the outside world, and the embodiment of the present invention can further provide different users with the same access method to access services running on the physical server, realize access address normalization, and improve the efficiency of the cloud platform in publishing new services deployed on the physical server.

[0055] In a possible implementation, the cloud platform can control the deployment of physical servers. After running the service on the physical server, the cloud platform publishes the information of the service running on the physical server. The user can view the published service through the service presentation interface provided by the cloud platform and initiate a service application. The cloud platform approves the user's service application. If the approval is passed, the authorization information is returned to the user. The authorization information may include the user ID, virtual machine ID, authority, and the account and password assigned to the user. The cloud platform records the user's information, including the information of each virtual machine used by the user. The cloud platform can authorize the user to access the service on the physical server at the user level. At this time, each virtual machine of the user can access the server; the cloud platform can also authorize the user to access the service on the physical server at the virtual machine level, that is, the cloud platform authorizes the user to access the service through a specific virtual machine. In the above manner, the cloud platform can determine the list of authorized virtual machines, and the cloud platform sends the above NAT rules to the access network element connected to each authorized virtual machine, and realizes the conversion of the external display address of the service into the real IP address and port of the physical server through the NAT rule, so that the user's virtual machine can access the service of the physical server. The above access network element can be a mounting network element or a tunnel encapsulation network element of the virtual machine.

[0056] Figure 1A and Figure 1B The cloud platform, host, physical server for deploying services, and access network element in the cloud computing system shown in FIG. 1 can be implemented by hardware / software, for example, Figure 2 2 is a schematic diagram of the hardware structure of a computer device provided in an embodiment of the present invention. The computer device 200 includes at least one processor 201 , a communication bus 202 , a memory 203 and at least one communication interface 204 .

[0057] The processor 201 may be a general-purpose central processing unit (CPU) or a microprocessor, and executes instructions in the memory 203 to implement the functions of the above-mentioned devices.

[0058] The communication bus 202 may include a path to transmit information between the above components. The communication interface 304 may be any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Networks (WLAN), etc.

[0059] The memory 203 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor through a bus.

[0060] The memory 203 is used to store application code for executing the solution of the present invention, and the execution is controlled by the processor 201. The processor 201 is used to execute the application code stored in the memory 203.

[0061] In a specific implementation, as an embodiment, the processor 201 may include one or more CPUs, such as Figure 2 CPU0 and CPU1 in.

[0062] In a specific implementation, as an embodiment, the computer device 200 may include multiple processors, such as Figure 2 201 and processor 208 in the embodiment of the present invention. Each of these processors may be a single-CPU processor or a multi-CPU processor. The processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0063] In a specific implementation, as an embodiment, the computer device 200 may further include an output device 205 and an input device 206. The output device 205 communicates with the processor 201 and may display information in a variety of ways. For example, the output device 205 may be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device 206 communicates with the processor 201 and may receive user input in a variety of ways. For example, the input device 206 may be a mouse, a keyboard, a touch screen device, or a sensor device.

[0064] The computer device 200 may be a general-purpose computer device or a dedicated computer device. In a specific implementation, the computer device 200 may be a desktop computer, a portable computer, a network server, a PDA (Personal Digital Assistant), a mobile phone, a tablet computer, a wireless terminal device, a communication device, an embedded device, or a computer with a plurality of computer terminals. Figure 2 The embodiment of the present invention does not limit the type of the computer device 200.

[0065] Figure 1A and Figure 1B The cloud platform, host, physical server for deploying services, and access network elements can be Figure 2 The device shown has one or more software modules stored in the memory, which are used to implement the functions of the cloud platform, the host, the physical server where the service is deployed, and the access network element (for example, NAT conversion function, etc.). The cloud platform, the host, the physical server where the service is deployed, and the access network element can implement a method for a virtual machine to access a service deployed on a physical server through the program code in the processor and the memory.

[0066] It should be noted that Figure 2 The computer device shown merely provides a possible hardware implementation of each part of the cloud computing system. According to the differences or changes in the functions of each part of the system, the hardware components of the computer device can be added or deleted to match the functions of each part of the system.

[0067] like Figure 3The above is a schematic diagram of the virtualization structure on the host provided by the embodiment of the present invention. The host is a physical server, and the bottom layer of the host is the hardware layer, which mainly includes hardware resources such as the central processing unit (CPU), memory, hard disk and physical network card. Server virtualization is to implement the virtualized operating environment of multiple virtual machines (VM) on the physical server with the help of virtualization software (such as VMWare ESX, Citrix XEN). The software layer installed on the server to implement the virtualization environment is called the virtual machine monitor (Virtual Machine Monitor), VMM. The VMM running on the hardware layer is responsible for scheduling, allocating and managing the hardware resources in the hardware layer. Multiple virtual machines VM run on the VMM, and the VMM provides each virtual machine with a virtualized CPU, memory, storage, IO devices (such as physical network card) and Ethernet switch and other hardware environments to ensure that multiple virtual machines are isolated from each other.

[0068] In a virtualized operating environment, VMM creates a virtual network interface card (vNIC) for each virtual machine, and the virtual switch vSwitch provides communication capabilities between virtual machines and between virtual machines and external networks. For the vSwitch running in VMM, the virtual network card of each virtual machine corresponds to a virtual port of the vSwitch, and the physical network card of the host corresponds to the port connecting the vSwitch to the external top-of-rack switch. Figure 3 The dashed lines in the figure represent logical connections in the virtual network, and the solid lines represent physical connections.

[0069] In one possible design, the functions of the above-mentioned access network element are implemented by a virtual switch (vSwitch). The cloud platform sends the NAT rules of the virtual machine to the virtual switch. The virtual switch configures the NAT rules on the virtual port connected to the virtual machine. When the virtual machine switch receives a service access request from the virtual machine, it uses the NAT rules to modify the destination address of the service access request to the published IP address and published port corresponding to the service, thereby routing the message access request to the physical server where the service is deployed.

[0070] In another possible design, the functions of the above-mentioned access network element are implemented by a top-of-rack switch connected to the host. The cloud platform sends the NAT rules of the virtual machine to the top-of-rack switch, and configures the NAT rules of the virtual machine on the top-of-rack switch. When the top-of-rack switch receives a service access request from the virtual machine, the NAT rules are used to modify the destination address of the service access request to the published IP address and published port corresponding to the service, thereby routing the packet access request to the physical server where the service is deployed.

[0071] It should be noted that no matter whether the NAT rule is configured on a virtual network element on a host or on a top-of-rack switch, the same function is achieved, that is, NAT conversion is performed on the address of the physical server, and in the direction out of the VM, the destination address of the message is modified to the published IP address and published port corresponding to the service, and in the direction into the VM, the source address of the message is modified to the published IP address and published port corresponding to the service. The routing process of the message between the host and the physical server is performed in accordance with the existing standard definition method, and the embodiment of the present invention does not limit it, as long as the message can be routed to the physical server according to the published IP address and published port.

[0072] Combination Figure 1A and Figure 1B The system architecture shown in Figure 4 As shown, the message forwarding process for a virtual machine to access a physical server provided by an embodiment of the present invention includes:

[0073] Step 401: The external display address of the service running on the physical server is visible to the virtual machine, and the virtual machine sends a service access request to the physical server, where the destination address of the service access request is the published IP address and published port corresponding to the service.

[0074] In a possible implementation scenario, the external display address includes a published IP address and a published port, and the published IP address and the published port can uniquely identify the service running on the physical server;

[0075] In another possible implementation scenario, the external display address is a domain name, and the domain name can uniquely identify the service running on the physical server. The virtual machine initiates a domain name resolution operation on the domain name to obtain the published IP address and published port corresponding to the service running on the physical server.

[0076] After obtaining the published IP address and published port corresponding to the service running on the physical server, the virtual machine initiates the service access request with the published IP address and published port as the destination address.

[0077] Step 402: The access network element receives the service access request and replaces the destination address carried in the request message with the IP address and port of the physical server running the service according to the NAT rule. The NAT rule includes the correspondence between the IP address and port of the physical server running the service and the published IP address and published port corresponding to the service.

[0078] In a possible design, the NAT rule may specifically be a flow table issued by the SDN controller in the cloud platform.

[0079] Step 403: The service access request after NAT conversion is routed through the network to the physical server running the service.

[0080] Step 404: The physical server receives the service access request of the virtual machine and returns a service response message to the virtual machine.

[0081] On the one hand, the source address of the service response message sent by the physical server can be the published IP address and published port corresponding to the service. When the access network element receives the service response message, there is no need to perform NAT conversion on the source address of the service response message, so as to ensure that the virtual machine cannot obtain the real address of the physical server. It should be noted that the physical server needs to be modified to record the published IP address and published port corresponding to the service, and set the source address to the published IP address and published port in the returned response message. Although the above modification will reduce the deployment efficiency of the physical server, since the access network element does not need to replace the source address of the service response message after receiving the service response message, it can improve the efficiency of the virtual machine accessing the service on the physical server.

[0082] On the other hand, the source address of the service response message sent by the physical server can be the real IP address and port of the physical server. The service response message is routed through the network to the access network element. The access network element replaces the source address of the service response message with the published IP address and published port corresponding to the service according to the NAT rule, and returns the service response message to the virtual machine. Through the above processing flow, it can be ensured that the virtual machine cannot obtain the real address of the physical server without modifying the physical server.

[0083] After the above service access process, the virtual machine can access the physical server running the service. The same service has the same external display address, thus unifying the access method of the virtual machine. At the same time, the real address of the physical server is invisible to the virtual machine, ensuring the network security of the physical server.

[0084] When the user to whom the virtual machine belongs applies to terminate the service or the service is terminated due to arrears, the cloud platform deletes the recorded user authorization information, terminates the service authorization, and notifies the access network element connected to the virtual machine to delete the NAT rule associated with the user.

[0085] Furthermore, in the virtual machine migration scenario, when the virtual machine migrates from host 1 to host 2, the NAT rules corresponding to the virtual machine are also dynamically migrated at the same time. Specifically, dynamic migration can be achieved through a migration tool or by dynamically sending openflow flow tables through an SDN controller, thereby ensuring that the virtual machine can continue to access services on the physical server during migration. In one possible design, the access network element before the virtual machine migration establishes a connection with the access network element after the migration, and sends the NAT rules corresponding to the virtual machine to the access network element after the virtual machine migration; in another possible design, the SDN controller obtains the address of the access network element after the virtual machine migration, and sends the NAT rules to the access network element after the migration in the form of a flow table, ensuring that the virtual machine can access the service normally after the migration. In order to ensure that the virtual machine access service is not interrupted during the migration process, tools such as Conntrackd can be used to transmit the status information of the virtual machine to host 2.

[0086] It should be noted that the physical server running the service can be a single physical server or a physical server cluster with high availability. The server cluster can be implemented based on existing tools or protocols according to the performance requirements of the service, and the embodiments of the present invention do not limit this. When the physical server is a server cluster, it can specifically be a shared service cluster or a single-instance service cluster. The shared service cluster provides a cluster of physical servers that isolate services from each other based on user access rights, and the single-instance service cluster provides a cluster of physical servers that cannot isolate services from each other based on user access rights. For the aforementioned different physical server clusters, the service access method provided in the embodiments of the present invention is applicable.

[0087] Figure 5 The corresponding embodiment provides a schematic diagram of the process of a virtual machine accessing a service running on a physical server, including a service deployment phase, a service application phase, and a service access phase.

[0088] Cloud service deployment phase:

[0089] Step 501: After the physical server is online, one or more services provided to the virtual machine are deployed on the physical server.

[0090] The above services can be deployed on a single physical server or on a physical server cluster with high availability. The cloud platform administrator configures the physical server and deploys services on the physical server through the management presentation interface. The specific process can adopt the existing solution, which is not limited in the embodiment of the present invention.

[0091] Step 502: The cloud platform records the IP address and port of the physical server running the service.

[0092] When the above services are deployed on a single physical server, the virtual machine accesses the single physical server to access the above services; when the above services are deployed on a physical server cluster, the IP address and port of the physical server running the service recorded by the cloud platform are the IP address and port presented to the outside by the physical server cluster. For example, when the cluster is in active-standby mode, the active and standby physical servers have the same IP address and port, which is the address presented to the outside by the physical server cluster; or, when multiple physical servers form a cluster, the virtual IP address and virtual port of the master node in the cluster are presented to the outside as the address presented to the outside by the physical server cluster.

[0093] It should be noted that different services have different ports. When multiple services are deployed on the same physical server, different services can be distinguished by ports.

[0094] Step 503: The cloud platform allocates an external display address to the service, and the external display address can uniquely identify the service. In one possible implementation scenario, the external display address includes a publishing IP address and a publishing port; in another possible implementation scenario, the external display address is a domain name corresponding to the service, and the cloud platform allocates a publishing IP address and a publishing port to the service, and establishes a mapping relationship between the domain name and the publishing IP address and the publishing port.

[0095] In one possible design, the cloud platform records the IP address and port of the physical server, the identifier of the service running on the physical server, and the association between the published IP address and the published port corresponding to the service. Furthermore, when the external display address is the domain name corresponding to the service, the association may also include the domain name corresponding to the service.

[0096] Step 504: After the service deployment is completed, the cloud platform publishes service information externally, and the service information includes the external display address of the service.

[0097] Service application stage

[0098] Step 505: The user queries the services provided by the cloud platform and initiates a service application request to the cloud platform.

[0099] The service presentation interface of the cloud platform is visible to the user. The user logs in to the service presentation interface through the virtual machine, queries service information, and initiates a service application request to the cloud platform. The service application request may carry the identifier of the service to be applied for, the user identifier, and the virtual machine identifier, etc. It should be noted that the embodiment of the present invention does not limit the content carried by the service application request, as long as the cloud platform can obtain the information required for executing service approval from the service application request.

[0100] Step 506: The cloud platform approves the service application request. After approval, the cloud platform records the user's authorization information, which includes the user ID, virtual machine ID, permissions, and the account and password assigned to the user.

[0101] After receiving the user's service application, the cloud platform can automatically approve it or manually approve it by the administrator. For service applications that are not approved, the failure reason is returned to the virtual machine. When the service application request is approved, the cloud platform returns the authorization information to the virtual machine.

[0102] It should be noted that service authorization can be user-level, that is, when a user's service application request is approved, all virtual machines belonging to the user can access the service, and the authorization information may not contain the virtual machine ID; service authorization can be virtual machine-level, that is, the user can only access the service through the approved virtual machine, and the authorization information may not contain the user ID. The permissions in the authorization information refer to the user's operational permissions to access the service. For example, the permissions in the authorization information can limit the user to only have the query permission for the database service, or grant the user the update permission for the database service.

[0103] Step 507: The cloud platform returns a service application response to the virtual machine. When the service application request from the virtual machine is approved, the service application response includes the external display address of the service, the authorization information, and the like.

[0104] Step 508: The cloud platform sends NAT rules to the access network element of the virtual machine, where the NAT rules include the correspondence between the IP address and port of the physical server running the service and the published IP address and published port corresponding to the service.

[0105] Step 509: The access network element of the virtual machine receives and records the NAT rule for subsequent data packet processing.

[0106] Service access phase

[0107] Step 510: The virtual machine sends a service access request, the destination address of the service access request being the published IP address and published port corresponding to the service.

[0108] It should be noted that the external display address of the service can be a domain name. After the service deployment is completed, the cloud platform can send the correspondence between the domain name and the published IP address and published port corresponding to the service to the domain name system DNS server through the registration process; the virtual machine is used to initiate a domain name resolution operation, and obtain the published IP address and published port corresponding to the service from the DNS server according to the domain name. The DNS server is the internal DNS server of the cloud computing system.

[0109] Step 511: The access network element receives the service access request, and according to the NAT rules, replaces the destination address of the service access request with the IP address and port of the physical server running the service. The NAT rules include the correspondence between the IP address and port of the physical server running the service and the published IP address and published port corresponding to the service.

[0110] Step 512: The NAT-converted service access request is routed through the network to the physical server running the service.

[0111] Step 513: The physical server receives the service access request of the virtual machine and returns a service response message, wherein the source address of the service response message is the IP address and port of the physical server.

[0112] Step 514: The service response message is routed to the access network element via the network.

[0113] Step 515: The access network element replaces the source address of the service response message with the published IP address and published port corresponding to the service according to the NAT rule, and returns the service response message to the virtual machine.

[0114] The method for virtual machines to access physical servers provided in the embodiments of the present invention can shield the real IP address of the physical server where the service is deployed from the virtual machine, and at the same time provide a unified access method to the virtual machine, which not only ensures the network security of the cloud platform, but also improves the convenience of user access to services. Furthermore, configuring the same access method for the same service reduces the complexity of deploying and operating and maintaining services on the physical server, and users do not need to pay attention to the online, operating, upgrading and high availability functions of the physical server; the above service access process does not require the use of tunnel technologies such as Vxlan, and the transmission efficiency is higher; the access network element connected by each virtual machine executes NAT rules, which improves the concurrent processing efficiency of massive users' secure access to PAAS services.

[0115] It should be noted that users can log in to the service presentation interface provided by the cloud platform, view service information, and initiate service applications. The cloud platform can authenticate service applications from virtual machines. The specific authentication method can be an account password method or other methods, which are not limited in the embodiments of the present invention.

[0116] The cloud platform can control the virtual machine's access to services at the granularity of users, virtual machines or hosts. For example, the cloud platform authorizes the user for services, and all virtual machines belonging to the user can access the services; or, the cloud platform authorizes service access for virtual machines, and each virtual machine accesses the services of the physical server with a different IP address; or, multiple virtual machines on a host share an IP address, which appears to the cloud platform as accessing the services of the physical server with the same IP address. In this case, multiple virtual machines on the same host can be distinguished by unused message ports.

[0117] Furthermore, the cloud platform can also terminate the service access authorization of the virtual machine. The termination of service access authorization may be caused by the user actively initiating a termination application or the cloud platform determining that the user is in arrears. The cloud platform sends a deletion message to the access network element where the virtual machine is located, which is used to delete the NAT rules of the virtual machine recorded on the access network element, delete the user information recorded in the cloud platform, and stop the access authorization to the user. The cloud platform can retain the user's data for a certain period of time and provide data copy services to the user. Within a reasonable period of validity, the user can choose to renew and continue to use the services provided by the PM.

[0118] With the aforementioned Figure 1A and Figure 1B The cloud computing system shown and Figure 4 , 5 The access process shown in the figure corresponds to Figure 6 , which is a schematic diagram of the structure of a cloud platform provided by an embodiment of the present invention, includes: a processing unit 601, a publishing unit 602, a receiving unit 603 and a sending unit 604,

[0119] The processing unit 601 is used to allocate a publishing IP address and a publishing port corresponding to the service to the service, and record the corresponding relationship between the publishing IP address and the publishing port and the IP address and port of the physical server running the service;

[0120] The publishing unit 602 is used to publish the service;

[0121] The receiving unit 603 is used to receive a service application request sent by the virtual machine;

[0122] The sending unit 604 is used to send NAT rules to the access network element of the virtual machine, and the NAT rules include the correspondence between the published IP address and the published port and the IP address and port of the physical server running the service, wherein the virtual machine accesses the network of the cloud computing system through the access network element.

[0123] Furthermore, the cloud platform releases service information to the outside through the above-mentioned publishing unit as follows:

[0124] The publishing unit 602 is specifically configured to provide a service presentation interface to the virtual machine to display service information, wherein the service information includes an external display address of the service.

[0125] The external display address includes a domain name corresponding to the service, or a publishing IP address and a publishing port corresponding to the service. The external display address can uniquely identify the service.

[0126] Furthermore, the cloud computing system also includes a DNS server, which is a DNS server used internally by the cloud computing system. The host running the virtual machine, the cloud platform, and the DNS server are connected through a network. After the cloud platform completes the service deployment, when the external display address of the service is the domain name corresponding to the service, the sending unit 604 is also used to send the correspondence between the domain name and the published IP address and the published port to the domain name system DNS server.

[0127] The sending unit 604 is further configured to return a service request response to the virtual machine, where the service request response carries the external display address.

[0128] The processing unit 601 is further configured to record the authorization information of the user to which the virtual machine belongs, wherein the authorization information of the user includes a user ID, a virtual machine ID, and an account number and a password assigned to the user.

[0129] The receiving unit 603 is further configured to receive a virtual machine creation request;

[0130] The processing unit 601 is further configured to create another virtual machine for the user according to the virtual machine creation request;

[0131] The sending unit 604 is further configured to send the NAT rule to an access network element connected to the other virtual machine after the other virtual machine is created.

[0132] The processing unit 601 is further configured to terminate the service authorization for the virtual machine;

[0133] The sending unit 604 is further configured to send a deletion message to the access network element to notify the access network element to delete the NAT rule of the virtual machine.

[0134] like Fig. 7A and 7B As shown, an access device provided by an embodiment of the present invention implements the function of the access network element in the above system, and the access device includes:

[0135] The client sending unit 701 is used to forward the service application request of the virtual machine to the cloud platform;

[0136] The client receiving unit 702 is used to receive the NAT rule of the virtual machine returned by the cloud platform after the service application request is approved, wherein the NAT rule includes the correspondence between the published IP address and the published port and the IP address and port of the physical server running the service, wherein the virtual machine accesses the network of the cloud computing system through the access network element;

[0137] The client sending unit 701 is further configured to receive a service access request sent by the virtual machine, wherein the destination address of the service access request is the published IP address and published port corresponding to the service;

[0138] The client processing unit 703 is used to replace the destination address of the service access request with the IP address and port of the physical server according to the NAT rule;

[0139] The client sending unit 701 is further used to route the modified service access request to the physical server;

[0140] The client receiving unit 702 is used to receive a service response message returned by the physical server.

[0141] Further, the client processing unit 703 is further configured to replace the source address of the service response message with the publishing IP address and publishing port corresponding to the service according to the NAT rule;

[0142] The client sending unit 702 is further configured to send the modified service response message to the virtual machine.

[0143] like Fig. 7A As shown, the access device may be a functional component on the host in the aforementioned system, and the central processing unit on the host executes instructions to implement the above functions of the access device; Figure 7BAs shown, the access device may be the top-of-rack switch described in the aforementioned system, and the top-of-rack switch may be a physical device independent of the host. In another possible design, the top-of-rack switch may be a physical component in the host. Figure 2 The computer device shown implements.

[0144] The embodiment of the present invention also provides a computer storage medium for storing the above Figure 6 and Fig. 7A - The computer software instructions used by the device shown in B include a program designed for executing the above method embodiment. By executing the stored program, a method for a virtual machine to access a service deployed on a physical server can be implemented.

[0145] In summary, the method, device and system for a virtual machine to access a physical server provided in the embodiments of the present invention can shield the real IP address of the physical server where the service is deployed from the virtual machine, and provide a unified access method to the virtual machine, which not only ensures the network security of the cloud platform, but also improves the convenience of user access to services. Furthermore, configuring the same access method for the same service reduces the complexity of deploying and operating and maintaining services on the physical server, and users do not need to pay attention to the online, operating, upgrading and high availability functions of the physical server; the virtual machine's access to the physical server does not use tunneling technologies such as Vxlan, and the transmission efficiency is higher; the access network element connected by each virtual machine executes NAT rules, which improves the concurrent processing efficiency of massive users' secure access to PAAS services.

[0146] Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed invention, those skilled in the art may understand and implement other variations of the disclosed embodiments by viewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "one" or "an" does not exclude multiple situations. A single processor or other unit may implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0147] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, devices (equipment), or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. The computer program is stored / distributed in a suitable medium, provided together with other hardware or as a part of the hardware, or may take other distribution forms, such as through the Internet or other wired or wireless telecommunication systems.

[0148] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (equipment) and computer program products of the embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0149] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0150] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0151] Although the present invention has been described in conjunction with specific features and embodiments thereof, it is apparent that various modifications and combinations may be made thereto without departing from the spirit and scope of the present invention. Accordingly, this specification and the accompanying drawings are merely exemplary illustrations of the present invention as defined by the appended claims and are deemed to cover any and all modifications, variations, combinations or equivalents within the scope of the present invention. Obviously, those skilled in the art may make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. Thus, the present invention is intended to include such modifications and variations if they fall within the scope of the claims of the present invention and their equivalents.

Claims

1. A cloud computing system, characterized in that: The system includes a cloud platform, at least one physical server, at least one host and at least one access network element, wherein the host, the physical server and the cloud platform communicate with each other, at least one virtual machine runs on the host, the virtual machine accesses the physical server through the access network element, and a service is deployed on the physical server. The cloud platform is used to allocate a publishing IP address and a publishing port corresponding to the service to the service; The cloud platform is further used to issue a NAT rule to the access network element, wherein the NAT rule includes a correspondence between the IP address and port of the physical server and a published IP address and a published port corresponding to the service; The cloud platform is also used to receive service application requests from users, and automatically or manually approve the service application requests; The access network element is used to receive a service access request sent by the virtual machine, where the destination address of the service access request is the published IP address and the published port corresponding to the service; The access network element is also used to replace the destination address of the service access request with the IP address and port of the physical server according to the NAT rule, route the modified service access request to the physical server, and receive a service response message returned by the physical server.

2. The system according to claim 1, characterized in that The service application request also includes at least one of the following: a service identifier and a user identifier.

3. The system according to claim 1 or 2, characterized in that: The published IP address is a reserved address.

4. The system according to claim 1, characterized in that The source address of the service response message is the IP address and port of the physical server; The access network element is further used to replace the source address of the service response message with the published IP address and the published port corresponding to the service according to the NAT rule, and send the modified service response message to the virtual machine.

5. The system according to claim 1, wherein: The cloud platform is also used to provide a service presentation interface to users and display service information, wherein the service information includes an external display address of the service.

6. The system according to claim 5, characterized in that The external display address includes a domain name corresponding to the service, or a publishing IP address and a publishing port corresponding to the service.

7. The system according to claim 6, characterized in that When the external display address of the service is a domain name corresponding to the service, the cloud platform is further used to send a corresponding relationship between the domain name and the publishing IP address and the publishing port to a domain name system DNS server; The virtual machine is used to initiate a domain name resolution operation, and obtain the publishing IP address and the publishing port corresponding to the service from the DNS server according to the domain name.

8. The system according to claim 6 or 7, characterized in that The cloud platform is also used to return a service application response to the virtual machine, where the service application response carries the external display address.

9. The system according to claim 8, characterized in that The cloud platform is also used to record the authorization information of the user to which the virtual machine belongs. The authorization information of the user includes a user ID, a virtual machine ID, permissions, and an account number and password assigned to the user.

10. A method for a virtual machine to access a physical server in a cloud computing system, characterized in that: include: The cloud platform allocates a publishing IP address and publishing port corresponding to the service to the service; The cloud platform sends a NAT rule to the access network element, wherein the NAT rule includes a correspondence between the IP address and port of the physical server and a published IP address and a published port corresponding to the service; The cloud platform receives the user's service application request and automatically or manually approves the service application request; The virtual machine is connected to the network of the cloud computing system through the access network element; The access network element receives a service access request sent by the virtual machine, where the destination address of the service access request is the published IP address and the published port corresponding to the service; The access network element replaces the destination address of the service access request with the IP address and port of the physical server according to the NAT rule, and routes the modified service access request to the physical server; The access network element receives the service response message returned by the physical server, and sends the service response message to the virtual machine.

11. The method according to claim 10, characterized in that The service application request also includes at least one of the following: a service identifier and a user identifier.

12. The method according to claim 10 or 11, characterized in that The published IP address is a reserved address.

13. The method according to claim 10, characterized in that The cloud platform publishes the services including: The cloud platform provides a service presentation interface to users, displaying service information, wherein the service information includes an external display address of the service.

14. The method according to claim 13, characterized in that The external display address includes a domain name corresponding to the service, or a publishing IP address and a publishing port corresponding to the service.

15. The method according to claim 14, characterized in that When the external display address of the service is a domain name corresponding to the service, before the cloud platform receives the service application request sent by the virtual machine, the method further includes: The cloud platform sends the correspondence between the domain name and the published IP address and the published port to the domain name system DNS server, so that when the virtual machine initiates a domain name resolution operation, it obtains the published IP address and the published port corresponding to the service from the DNS server according to the domain name.

16. The method according to claim 13, characterized in that After the cloud platform receives the service application request sent by the virtual machine, the method further includes: The cloud platform returns a service request response to the virtual machine, where the service request response carries the external display address.

17. The method according to claim 16, characterized in that After the service application request is approved, the method further includes: The cloud platform records the authorization information of the user to which the virtual machine belongs, and the authorization information of the user includes a user ID, a virtual machine ID, permissions, and an account number and password assigned to the user.

18. A method for a virtual machine to access a physical server in a cloud computing system, characterized in that: include: The virtual machine is connected to the network of the cloud computing system through the access network element; The access network element obtains a NAT rule issued by the cloud platform, wherein the NAT rule includes a correspondence between the IP address and port of the physical server and a published IP address and a published port corresponding to a service, and the service runs on the physical server; The access network element receives a service access request sent by the virtual machine, where the destination address of the service access request is the published IP address and the published port corresponding to the service; The access network element replaces the destination address of the service access request with the IP address and port of the physical server according to the NAT rule, routes the modified service access request to the physical server, and receives a service response message returned by the physical server.

19. The method according to claim 18, characterized in that The source address of the service response message is the IP address and port of the physical server, and the method further includes: The access network element replaces the source address of the service response message with the published IP address and published port corresponding to the service according to the NAT rule, and sends the modified service response message to the virtual machine.

20. An access device, characterized in that: include: A client receiving unit, configured to receive a NAT rule issued by a cloud platform, wherein the NAT rule includes a correspondence between an IP address and a port of a physical server and a published IP address and a published port corresponding to a service, wherein the service runs on the physical server; The client sending unit is further used to receive a service access request sent by the virtual machine, the destination address of the service access request is the published IP address and published port corresponding to the service, and the virtual machine accesses the physical server through the access device; A client processing unit, configured to replace the destination address of the service access request with the IP address and port of the physical server according to the NAT rule; The client sending unit is further used to route the modified service access request to the physical server; The client receiving unit is used to receive a service response message returned by the physical server.

21. The access device according to claim 20, characterized in that: The client processing unit is further used to replace the source address of the service response message with the publishing IP address and publishing port corresponding to the service according to the NAT rule; The client sending unit is further configured to send the modified service response message to the virtual machine.

22. A computer, characterized in that: The method comprises a processor, a memory and a system bus, wherein the memory stores instructions, and the processor executes the instructions in the memory to perform the method according to any one of claims 10 to 19.

Images