Access control method, device, electronic device and storage medium

Abstract

The embodiment of the present invention provides an access control method, device, electronic device and storage medium. The method includes: adding site attributes to router attributes, including single-site attributes or cross-site attributes, configuring docking configurations between different controllers, creating port information and router information corresponding to the host when a host is online, and after judging that the security group rule associated with the port information is the same-group entry / exit rule and the router attribute is a cross-site attribute, synchronizing the port information to the opposite controller through the docking configuration, and jointly confirming all host information corresponding to the same-group entry / exit rule according to the port information synchronized by the opposite controller, generating an access control flow table according to all host information, and sending it to all virtual switches associated with the hosts corresponding to the same-group entry / exit rule, thereby realizing the technology of access policy control of hosts between sites managed by different controllers in edge cloud scenarios through remote security groups.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of communication technology, and in particular to an access control method, device, electronic device and storage medium. Background Art

[0002] Edge cloud computing, or edge cloud for short, is a cloud computing platform built on edge infrastructure based on the core of cloud computing technology and the ability of edge computing. It forms an elastic cloud platform with comprehensive computing, network, storage, security and other capabilities at the edge, and forms an end-to-end technical architecture of "cloud-edge-end collaboration" with the central cloud and IoT terminals. By placing network forwarding, storage, computing, intelligent data analysis and other tasks on the edge for processing, it reduces response latency, reduces cloud pressure, reduces bandwidth costs, and provides cloud services such as full-network scheduling and computing power distribution. The remote edge cloud solution is to build edge cloud sites on the basis of mobile public clouds, and connect edge cloud sites to public cloud data centers to achieve cloud-edge collaboration and computing sinking. Among them, the public cloud solution is based on the software defined network (SDN) controller. From a vertical level, it can be divided into four levels: service layer, network layer, control layer, and business layer. The business layer is responsible for unified management of business resources and realizes the coordinated scheduling of computing, storage, and network resources. The control layer is the SDN controller, which connects to the cloud platform in the north to achieve coordinated scheduling of network resources, manages network devices in the south, and completes service orchestration and automatic tenant network deployment through unified control of the physical network Underlay / virtual network Overlay interface. The network layer is composed of physical network devices, the access layer Leaf devices are fully connected with the aggregation layer Spine devices, and the equivalent multi-path improves the availability of the network.

[0003] In the edge cloud scenario, the main site (such as a provincial node) and the edge site deploy their own controllers (Open Networking Controller, ONC), and the ONCs are independent of each other. When the host at the main site goes online, the host port information on the cloud platform is sent to the main site ONC. When the host at the edge site goes online, the host port information on the cloud platform is sent to the edge site ONC. The ONC sends the open flow table on the virtual switch VSW to release the traffic according to the security group rules bound to the port. When the security rule policy is that the same group can enter / exit, ONC queries all ports bound to the same security group, sends the flow table according to the IP of the port, and releases the relevant traffic on the VSW.

[0004] In the prior art, when hosts bound to the same security rules under the same virtual private cloud (VPC) are launched at the main site and the edge site at the same time, and the security rules in the security group are remote security groups, since the ONCs of the main site and the edge site are deployed independently and do not have the port information of the other end, the flow table sent down does not contain the table entry for allowing the IP address of the other end host, and the hosts cannot access each other. Summary of the invention

[0005] In view of the defects in the prior art, the embodiments of the present invention provide an access control method, device, electronic device and storage medium.

[0006] In a first aspect, an embodiment of the present invention provides an access control method, which is applied to an edge cloud scenario, wherein the edge cloud scenario includes a cloud platform and at least two controllers, and the method is applied to the controller, and the method includes:

[0007] Receive a first notification sent by the cloud platform, the first notification is sent by the cloud platform after detecting that the first host associated with the controller is online, creating port information of the first host on the cloud platform and determining router information corresponding to the virtual private cloud to which the first host belongs, wherein the router information includes router attributes, the router attributes include single-site attributes or cross-site attributes, and the cloud platform determines the router attributes according to the number of controllers corresponding to all online hosts in the same virtual private cloud as the first host;

[0008] According to the first notification, synchronize the port information and router information corresponding to the first host on the controller, wherein the port information includes associated security group rules;

[0009] If the router attribute is a cross-site attribute, synchronizing the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration;

[0010] If the security group rule is a same-group entry / exit rule, then obtaining all host information associated with the same-group entry / exit rule, wherein all host information includes host information corresponding to port information associated with the same-group entry / exit rule synchronized by other controllers;

[0011] An access control flow table is generated according to the information of all hosts, and the access control flow table is sent to virtual switches associated with all hosts corresponding to the same group of entry / exit rules.

[0012] As in the above method, optionally, the edge cloud scenario includes a first controller and a second controller, the first controller is associated with a main site host, and the second controller is associated with all edge site hosts;

[0013] or,

[0014] The first controller is associated with all edge site hosts, and the second controller is associated with the main site host.

[0015] As in the above method, optionally, before receiving the first notification sent by the cloud platform, the method further includes:

[0016] The configuration information of the other controller is obtained, and a preset docking configuration is set according to the configuration information.

[0017] As in the above method, optionally, the creating the port information corresponding to the first host on the controller includes:

[0018] Receive the security group rules input by the user, create the port information corresponding to the first host on the controller according to the port information of the first host on the cloud platform, and set the security group rules associated with the port information to the security group rules input by the user.

[0019] As in the above method, optionally, before obtaining all host information associated with the same group of entry / exit rules, the method further includes:

[0020] Receiving port information synchronized by other controllers, wherein the port information includes associated security group rules;

[0021] Determine the host information corresponding to the port information of the security group rule in the synchronized port information as the port information of the same group of ingress / egress rules.

[0022] In a second aspect, an embodiment of the present invention provides an access control method, which is applied to an edge cloud scenario, wherein the edge cloud scenario includes a cloud platform and a controller, and the method is applied to the cloud platform, and the method includes:

[0023] After detecting that the first controller is associated with the first host and is online, determining the number of controllers corresponding to all online hosts in the virtual private cloud corresponding to the first host;

[0024] Creating port information of the first host on the cloud platform, and determining router information corresponding to the virtual private cloud, wherein the router information includes router attributes;

[0025] Setting the router attribute according to the number of controllers, the router attribute including a single-site attribute or a cross-site attribute;

[0026] A first notification is sent to the first controller so that the first controller performs the following steps according to the first notification: synchronize the port information and router information corresponding to the first host on the first controller, the port information including the associated security group rules; if the router attribute is a cross-site attribute, synchronize the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration; if the security group rule is a same-group entry / exit rule, obtain all host information associated with the same-group entry / exit rule, wherein all host information includes the host information corresponding to the port information associated with the same-group entry / exit rule synchronized by other controllers; generate an access control flow table based on all the host information, and send the access control flow table to all virtual switches associated with the hosts corresponding to the same-group entry / exit rule.

[0027] As in the above method, optionally, setting the router attribute according to the number of controllers includes:

[0028] If the number of the controllers is greater than 1, the router attribute is set to a cross-site attribute; otherwise, the router attribute is set to a single-site attribute.

[0029] As in the above method, optionally, determining the router information corresponding to the virtual private cloud includes:

[0030] Determine whether router information corresponding to the virtual private cloud has been created on the first controller;

[0031] If not created, determining router information corresponding to the virtual private cloud to be created on the first controller, and determining the router attributes;

[0032] Accordingly, the sending a first notification to the first controller includes:

[0033] Sending a first notification to the first controller, where the first notification carries port information of the first host on the cloud platform and router information to be created by the first controller;

[0034] If it has been created, determining whether the router attribute in the router information on the first controller has changed;

[0035] If the router attribute changes, determining the router information to be updated on the first controller;

[0036] Accordingly, the sending a first notification to the first controller includes:

[0037] Sending a first notification to the first controller, where the first notification carries port information of the first host on the cloud platform and router information to be updated on the first controller;

[0038] If the router attribute has not changed, sending the first notification to the first controller includes:

[0039] A first notification is sent to the first controller, where the first notification carries port information of the first host on the cloud platform.

[0040] As in the above method, optionally, determining the router information corresponding to the virtual private cloud includes:

[0041] Determine whether a router attribute in the router information associated with the first host in the cloud platform has changed;

[0042] If the router attribute changes, update the router information;

[0043] Accordingly, the sending a first notification to the first controller includes:

[0044] Sending a first notification to the first controller, where the first notification carries port information and updated router information of the first host on the cloud platform;

[0045] If the router attribute has not changed, sending the first notification to the first controller includes:

[0046] A first notification is sent to the first controller, where the first notification carries port information of the first host on the cloud platform.

[0047] In a third aspect, an embodiment of the present invention provides a controller, which is applied to an edge cloud scenario, wherein the edge cloud scenario includes a cloud platform and at least two controllers, and the controller includes:

[0048] a receiving module, configured to receive a first notification sent by a cloud platform, wherein the first notification is sent by the cloud platform after detecting that a first host associated with the controller is online, creating port information of the first host on the cloud platform and determining router information corresponding to a virtual private cloud to which the first host belongs, wherein the router information includes router attributes, and the router attributes include single-site attributes or cross-site attributes, and the cloud platform determines the router attributes according to the number of controllers corresponding to all online hosts in the same virtual private cloud as the first host;

[0049] A first synchronization module, configured to synchronize the port information and router information corresponding to the first host on the controller according to the first notification, wherein the port information includes associated security group rules;

[0050] A second synchronization module, configured to synchronize the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration if the router attribute is a cross-site attribute;

[0051] A first acquisition module is used for acquiring all host information associated with the same group entry / exit rule if the security group rule is a same group entry / exit rule, wherein the all host information includes host information corresponding to the port information associated with the same group entry / exit rule synchronized by the other controllers;

[0052] The access control module is used to generate an access control flow table according to the information of all hosts, and send the access control flow table to the virtual switches associated with all hosts corresponding to the same group of entry / exit rules.

[0053] As the above controller, optionally, the edge cloud scenario includes a first controller and a second controller, the first controller is associated with the main site host, and the second controller is associated with all edge site hosts;

[0054] or,

[0055] The first controller is associated with all edge site hosts, and the second controller is associated with the main site host.

[0056] As the above controller, optionally, further comprises: a second acquisition module;

[0057] The second acquisition module is used to acquire the configuration information of the other controllers before receiving the first notification sent by the cloud platform, and set the preset docking configuration according to the configuration information.

[0058] As in the above controller, optionally, the first synchronization module is specifically used for:

[0059] Receive the security group rules input by the user, create the port information corresponding to the first host on the controller according to the port information of the first host on the cloud platform, and set the security group rules associated with the port information to the security group rules input by the user.

[0060] As in the above controller, optionally, the receiving module is further used for:

[0061] Before obtaining all host information associated with the same group of entry / exit rules, receiving port information synchronized by other controllers, the port information including associated security group rules;

[0062] Determine the host information corresponding to the port information of the security group rule in the synchronized port information as the port information of the same group of ingress / egress rules.

[0063] In a fourth aspect, an embodiment of the present invention provides a cloud platform, which is applied to an edge cloud scenario. The edge cloud scenario also includes the cloud platform and at least two controllers. The cloud platform includes:

[0064] A detection module, configured to determine the number of controllers corresponding to all online hosts in the virtual private cloud corresponding to the first host after detecting that the first host associated with the first controller is online;

[0065] A creation module, used to create port information of the first host on the cloud platform, and determine router information corresponding to the virtual private cloud, wherein the router information includes router attributes;

[0066] A setting module, used for setting the router attribute according to the number of the controllers, wherein the router attribute includes a single-site attribute or a cross-site attribute;

[0067] A sending module is used to send a first notification to the first controller so that the first controller performs the following steps according to the first notification: synchronize the port information and router information corresponding to the first host on the first controller, the port information including the associated security group rules; if the router attribute is a cross-site attribute, synchronize the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration; if the security group rule is a same-group entry / exit rule, obtain all host information associated with the same-group entry / exit rule, wherein all host information includes the host information corresponding to the port information associated with the same-group entry / exit rule synchronized by the other controllers; generate an access control flow table according to all the host information, and send the access control flow table to all virtual switches associated with the hosts corresponding to the same-group entry / exit rule.

[0068] As in the above cloud platform, optionally, the creation module is specifically used for:

[0069] If the number of the controllers is greater than 1, the router attribute is set to a cross-site attribute; otherwise, the router attribute is set to a single-site attribute.

[0070] As in the above cloud platform, optionally, the creation module is specifically used for:

[0071] Determine whether router information corresponding to the virtual private cloud has been created on the cloud platform;

[0072] If not created, creating router information corresponding to the virtual private cloud and determining the router attributes;

[0073] Accordingly, the sending module is specifically used for:

[0074] Sending a first notification to the first controller, where the first notification carries port information of the first host on the cloud platform and created router information;

[0075] If it has been created, determining whether the router attribute in the router information has changed;

[0076] If the router attributes are changed, updating the router attributes;

[0077] Accordingly, the sending module is specifically used for:

[0078] Sending a first notification to the first controller, where the first notification carries port information and updated router information of the first host on the cloud platform;

[0079] If the router attribute has not changed, the sending module is specifically used for:

[0080] A first notification is sent to the first controller, where the first notification carries port information of the first host on the cloud platform.

[0081] In a fifth aspect, an embodiment of the present invention provides an access control system, comprising the cloud platform and controller as described above and at least two controllers as described above.

[0082] In a sixth aspect, an embodiment of the present invention provides an electronic device, including:

[0083] A memory and a processor, wherein the processor and the memory communicate with each other via a bus; the memory stores program instructions executable by the processor, and the processor calls the program instructions to execute the following method: receiving a first notification sent by a cloud platform, wherein the first notification is sent by the cloud platform after detecting that the first host associated with the controller is online, creating the port information of the first host on the cloud platform and determining the router information corresponding to the virtual private cloud to which the first host belongs, wherein the router information includes router attributes, and the router attributes include single-site attributes or cross-site attributes, and the cloud platform determines the router attributes according to the number of controllers corresponding to all online hosts in the same virtual private cloud as the first host. ; According to the first notification, synchronize the port information and router information corresponding to the first host on the controller, the port information including the associated security group rules; if the router attribute is a cross-site attribute, synchronize the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration; if the security group rule is a same-group entry / exit rule, obtain all host information associated with the same-group entry / exit rule, wherein all host information includes the host information corresponding to the port information associated with the same-group entry / exit rule synchronized by other controllers; generate an access control flow table based on all the host information, and send the access control flow table to all virtual switches associated with the hosts corresponding to the same-group entry / exit rule.

[0084] In a seventh aspect, an embodiment of the present invention provides a storage medium having a computer program stored thereon, which implements the following method when executed by a processor: receiving a first notification sent by a cloud platform, the first notification being sent by the cloud platform after detecting that the first host associated with the controller is online, creating the port information of the first host on the cloud platform and determining the router information corresponding to the virtual private cloud to which the first host belongs, wherein the router information includes router attributes, and the router attributes include single-site attributes or cross-site attributes, and the cloud platform determines the router attributes according to the number of controllers corresponding to all online hosts in the same virtual private cloud as the first host; according to the first notification, synchronizing the The port information and router information corresponding to the first host on the controller, the port information including the associated security group rules; if the router attribute is a cross-site attribute, synchronizing the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration; if the security group rule is a same-group entry / exit rule, obtaining all host information associated with the same-group entry / exit rule, wherein all host information includes host information corresponding to the port information associated with the same-group entry / exit rule synchronized by other controllers; generating an access control flow table based on all host information, and sending the access control flow table to the virtual switches associated with all hosts corresponding to the same-group entry / exit rule.

[0085] The access control method provided by the embodiment of the present invention adds site attributes to router attribute information, including single-site attributes or cross-site attributes, configures the docking configuration of the node controller and the edge site controller, and when a host goes online, creates port information and router information corresponding to the host. After judging that the security group rule associated with the port information is the same-group entry / exit rule and the router attribute is a cross-site attribute, the port information is synchronized to the opposite controller through the docking configuration, and all host information corresponding to the same-group entry / exit rule is jointly confirmed according to the port information synchronized by the opposite controller, and an access control flow table is generated according to all host information, and is sent to all virtual switches associated with the hosts corresponding to the same-group entry / exit rule. Interaction between controllers is realized through the docking configuration, and the port information of the local end is synchronized to the controller of the opposite end. When hosts under the same virtual private cloud go online at different sites, the intercommunication between hosts is controlled through the access control flow table corresponding to the remote security group rule, thereby realizing the technology of access policy control of hosts between sites managed by different controllers through remote security groups in edge cloud scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0087] Figure 1 A schematic diagram of the structure of an access control system provided by an embodiment of the present invention;

[0088] Figure 2 A schematic diagram of the access control method provided by an embodiment of the present invention;

[0089] Figure 3 A schematic diagram of a flow chart of an access control method provided by another embodiment of the present invention;

[0090] Figure 4 A schematic diagram of a flow chart of an access control method provided by another embodiment of the present invention;

[0091] Figure 5 A schematic diagram of the structure of a controller provided by an embodiment of the present invention;

[0092] Figure 6 A schematic diagram of the structure of a cloud platform provided by an embodiment of the present invention;

[0093] Figure 7 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0094] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0095] Figure 1 A schematic diagram of the access control system structure provided by an embodiment of the present invention, such as Figure 1As shown, the access control system includes a cloud platform, a main site and an edge site. The number of main sites and edge sites can be multiple, and one main site corresponds to multiple edge sites. The main site can be divided into central nodes and provincial nodes according to location distribution. Each main site corresponds to a controller, which is recorded as the main site controller ONC1. When the host associated with the main site (recorded as the first host) goes online, that is, the host goes online in the main site available zone (Available Zone, AZ), the cloud platform sends the host-related configuration to the main site controller ONC1. The available zone refers to the area managed by the node. Among them, the host going online in the main site AZ means that the host goes online in the virtual switch (Visual Switch, VSW) managed by the main site controller ONC1. Each VSW can only correspond to one set of ONC. The VSW is deployed in the main site AZ. For example, Figure 1 For example, the primary site includes VSW1, VSW2, VSW3, and VSW4, etc. These VSWs are collectively managed by the primary site controller ONC1.

[0096] In the access control system, one main site can correspond to multiple edge sites. Each edge site corresponds to an AZ. Different edge sites correspond to different AZs. The virtual switch / bare metal server in the edge site AZ should consider supporting the two-way access requirements of the virtual network Overlay and the physical network Underlay. The edge site AZ should consider using independent north-south exports or shared north-south exports to support the implementation of CMNET (China Mobile Internet), IP bearer network, dedicated line access network requirements and related NATGW (network address translation gateway), LB (LoadBalancer, load balancer), IPSecVPN, Secure Sockets Layer Protocol SSLVPN, floating address FIP, firewall FW, IPv4&IPv6 dual stack and other functions. The edge site AZ, between edge site AZs, and between edge site AZs and provincial nodes / central node AZs should consider supporting the interconnection within the virtual private cloud (VPC), and the interconnection between VPCs in the same AZ and across AZs. The edge site can correspond to at least one controller, which is recorded as the edge site controller ONC2. For example, all edge sites correspond to one edge site controller ONC2. When the host goes online at the edge site AZ, the cloud platform sends the host-related configuration to the edge site controller ONC2. The host goes online at the edge site AZ means that the host goes online at the VSW managed by the edge site controller ONC2. Each VSW can only correspond to one set of ONC. The VSW is deployed in the edge site AZ. For example, Figure 1For example, the edge sites include edge site 1 and edge site 2, edge site 1 includes VSW5, VSW6, VSW7, etc., edge site 2 includes VSW8, VSW9, etc., edge site 1 and edge site 2 share a set of controllers, then these VSWs are jointly managed by the edge site controller ONC2.

[0097] Since the information of each controller is known in advance, the controllers managed by the same cloud platform can obtain the configuration information of other controllers in advance. For example, the preset docking configuration of the peer controller can be set on the local controller through the controller address information and authentication method entered by the user.

[0098] Based on the above system, an embodiment of the present invention provides an access control method, which is applied to an edge cloud scenario. The edge cloud scenario includes a cloud platform and at least two controllers. The method is applied to the controller, such as Figure 2 As shown, the method includes:

[0099] Step S21, receiving a first notification sent by the cloud platform;

[0100] Specifically, when a host goes online on VSW, the cloud platform determines the availability zone AZ, virtual private cloud and controller corresponding to the online host through VSW, and determines the number of controllers corresponding to the online hosts that belong to the same virtual private cloud as the online host (recorded as the first host), creates the port information of the online host (first host) on the cloud platform, and determines the router information corresponding to the virtual private cloud to which the first host belongs.

[0101] In a possible implementation, the router information on the cloud platform and the controller are not synchronized. The cloud platform can determine whether the router information corresponding to the virtual private cloud to which the first host belongs has been created on the controller. If it has been created, it continues to determine whether the router information on the controller has changed. Specifically, if the router information corresponding to the virtual private cloud to which the first host belongs has not been created on the controller, the router information on the cloud platform of the first host to be created on the controller is determined. The router information includes router attributes. When the number of controllers corresponding to the online hosts of the same virtual private cloud is 1, the router attributes are set to single-site attributes. When the number of controllers corresponding to the online hosts of the same virtual private cloud is greater than 1, the router attributes are set to cross-site attributes.

[0102] If the router information corresponding to the virtual private cloud has been created on the controller, the router attributes on the controller are obtained to determine whether the router attributes in the router information have changed. If so, the router attributes to be updated by the controller are determined. For example, if the router attributes change from single-site attributes to cross-site attributes, or the router attributes change from cross-site attributes to single-site attributes, then the router attributes are updated to cross-site attributes or single-site attributes accordingly.

[0103] Afterwards, the cloud platform sends a first notification to the controller corresponding to the first host. The first notification carries the port information created by the cloud platform for the first host. The port information includes the port IP, etc. In addition, if router information needs to be created on the controller, the first notification also includes the router information to be created by the controller. If the controller needs to update the router information, the first notification also includes the router information to be updated by the controller. If the controller does not need to create new router information or change the attribute information of the existing router, the first notification no longer includes the router information, and only carries the port information created by the cloud platform for the first host.

[0104] In a possible implementation, the router information on the cloud platform and the controller is synchronized. When the cloud platform creates and updates the router information, the controller synchronously creates and updates the router information. Specifically, when the first host is associated with the router, the cloud platform determines whether the router attribute in the router information has changed. If so, the router attribute is updated. For example, if the router attribute changes from a single-site attribute to a cross-site attribute, or the router attribute changes from a cross-site attribute to a single-site attribute, then the router attribute is updated to a cross-site attribute or a single-site attribute accordingly.

[0105] Afterwards, the cloud platform sends a first notification to the controller corresponding to the first host. The first notification carries the port information created by the cloud platform for the first host. The port information includes the port IP, etc. In addition, if the cloud platform updates the router information, the first notification also includes the updated router information. If the cloud platform does not update the router information, the first notification no longer includes the router information, and only carries the port information created by the cloud platform for the first host. It should be noted that if the router information on the cloud platform and the controller is synchronized, the router information can be created on the cloud platform and synchronized on the controller before the host goes online. After the host goes online, it can be associated with the corresponding router.

[0106] Step S22: Synchronize the port information and router information corresponding to the first host on the controller according to the first notification, wherein the port information includes associated security group rules;

[0107] Specifically, the controller first creates the port information corresponding to the first host on the controller according to the first notification, and the port information includes the associated security group rules, wherein the security group rules can be the default security group rules of the tenant, or the security group rules created by the user. The controller creates the port information corresponding to the first host on the controller according to the port information of the first host on the cloud platform locally, and sets the security group rules associated with the port information to the security group rules input by the user. Afterwards, the controller analyzes whether the first notification carries the router information. If the first notification carries the updated router information, the controller updates the router information corresponding to the first host on the controller according to the updated router information of the first host; if the first notification does not carry the router information, the controller does not process the router information, wherein the router information includes the router attributes. In actual applications, when the cloud platform creates the port information of the first host and determines the router information, it can also set the network information of the first host, for example, setting the virtual private cloud where the first host is located as the network information of the first host. Similarly, after receiving the first notification, the controller can set the network information of the first host according to the setting information of the cloud platform.

[0108] Step S23: If the router attribute is a cross-site attribute, synchronizing the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration;

[0109] Specifically, if the router attribute corresponding to the first host is a cross-site attribute, the port information of the first host is synchronized to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration, and the synchronized port information includes the security group rules associated with the port.

[0110] Step S24: If the security group rule is a same-group entry / exit rule, obtain all host information associated with the same-group entry / exit rule;

[0111] Specifically, if the security group rule associated with the port is a same-group entry / exit rule (i.e., same-group entry or same-group exit rule), then all host information associated with the same-group entry / exit rule is obtained. Since the router attribute corresponding to the port is a cross-site attribute and the security group rule associated with the port is a same-group entry / exit rule, that is, the port is associated with a remote security group rule, and the security rule controlled by the remote security group allows the host address bound to the remote security group in the corresponding direction of the host on the virtual switch. Therefore, all host information associated with the same-group entry / exit rule includes both hosts bound to the same security group in the AZ controlled by itself and other host information synchronously bound to the same security group by other controllers. Specifically, receive the port information synchronized by other controllers, the synchronized port information includes the associated security group rules, determine the host information corresponding to the port information of the same-group entry / exit rule as the first host in the synchronized port information, and then combine the host information corresponding to the port information associated with the same same-group entry / exit rule in its own AZ, and use the above two types of host information together as all host information associated with the same-group entry / exit rule.

[0112] Step S25: Generate an access control flow table according to the information of all hosts, and send the access control flow table to the virtual switches associated with all hosts corresponding to the same group of entry / exit rules.

[0113] Specifically, the controller generates an access control flow table based on the host information, including security control entries, entries for host route forwarding to the same virtual private cloud, and default forwarding entries, and sends the access control flow table to the virtual switches associated with all hosts corresponding to the same group of entry / exit rules in the controller's available zone, so that hosts across sites can access each other through the access control flow table.

[0114] The access control method provided by the embodiment of the present invention adds site attributes to router attribute information, including single-site attributes or cross-site attributes, configures the docking configuration of the node controller and the edge site controller, and when a host goes online, creates the port information corresponding to the host and determines the router information. After judging that the security group rule associated with the port information is the same-group entry / exit rule and the router attribute is a cross-site attribute, the port information is synchronized to the opposite controller through the docking configuration, and all host information corresponding to the same-group entry / exit rule is jointly confirmed according to the port information synchronized by the opposite controller, and an access control flow table is generated according to all host information, and is sent to the virtual switch associated with all hosts corresponding to the same-group entry / exit rule. The interaction between controllers is realized through the docking configuration, and the port information of the local end is synchronized to the controller of the opposite end. When hosts under the same virtual private cloud go online at different sites, the intercommunication between the hosts is controlled by the access control flow table corresponding to the remote security group rule, so as to realize the technology of access policy control of hosts between sites managed by different controllers in the edge cloud scenario through the remote security group.

[0115] Based on the same inventive concept, an embodiment of the present invention further provides an access control method, which is applied to an edge cloud scenario. The edge cloud scenario includes a cloud platform and a controller. The method is applied to the cloud platform. Figure 3 As shown, the method includes:

[0116] Step S31: after detecting that a first host associated with a first controller is online, determining the number of controllers corresponding to all online hosts in a virtual private cloud corresponding to the first host;

[0117] Step S32: Create port information of the first host on the cloud platform, and determine the router information, where the router information includes router attributes;

[0118] Step S33: setting the router attribute according to the number of controllers, wherein the router attribute includes a single-site attribute or a cross-site attribute;

[0119] Step S34, sending a first notification to the first controller so that the first controller performs the following steps according to the first notification: synchronizing the port information and router information corresponding to the first host on the first controller, the port information including the associated security group rules; if the router attribute is a cross-site attribute, synchronizing the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration; if the security group rule is a same-group entry / exit rule, obtaining all host information associated with the same-group entry / exit rule, wherein all host information includes the host information corresponding to the port information associated with the same-group entry / exit rule synchronized by other controllers; generating an access control flow table based on all the host information, and sending the access control flow table to the virtual switches associated with all hosts corresponding to the same-group entry / exit rule.

[0120] As in the above method, optionally, setting the router attribute according to the number of controllers includes:

[0121] If the number of the controllers is greater than 1, the router attribute is set to a cross-site attribute; otherwise, the router attribute is set to a single-site attribute.

[0122] As in the above method, optionally, determining the router information corresponding to the virtual private cloud includes:

[0123] Determine whether router information corresponding to the virtual private cloud has been created on the first controller;

[0124] If not created, determining router information corresponding to the virtual private cloud to be created on the first controller, and determining the router attributes;

[0125] Accordingly, the sending a first notification to the first controller includes:

[0126] Sending a first notification to the first controller, where the first notification carries port information of the first host on the cloud platform and router information to be created by the first controller;

[0127] If it has been created, determining whether the router attribute in the router information on the first controller has changed;

[0128] If the router attribute changes, determining the router information to be updated on the first controller;

[0129] Accordingly, the sending a first notification to the first controller includes:

[0130] Sending a first notification to the first controller, where the first notification carries port information of the first host on the cloud platform and router information to be updated on the first controller;

[0131] If the router attribute has not changed, sending the first notification to the first controller includes:

[0132] A first notification is sent to the first controller, where the first notification carries port information of the first host on the cloud platform.

[0133] As in the above method, optionally, determining the router information corresponding to the virtual private cloud includes:

[0134] Determine whether a router attribute in the router information associated with the first host in the cloud platform has changed;

[0135] If the router attribute changes, update the router information;

[0136] Accordingly, the sending a first notification to the first controller includes:

[0137] Sending a first notification to the first controller, where the first notification carries port information and updated router information of the first host on the cloud platform;

[0138] If the router attribute has not changed, sending the first notification to the first controller includes:

[0139] A first notification is sent to the first controller, where the first notification carries port information of the first host on the cloud platform.

[0140] In a specific implementation, a first controller and a second controller may be set in an edge cloud scenario, wherein the first controller is associated with the main site host, and the second controller is associated with all edge site hosts; alternatively, the first controller is associated with all edge site hosts, and the second controller is associated with the main site host. The main site may be a provincial node or a central node. Under the same virtual private cloud, the main site corresponds to one controller, and all edge sites correspond to one controller.

[0141] The cloud platform network service process Neutron determines whether the host under the same virtual private cloud VPC belongs to multiple controllers ONC, and creates or updates a router with single-site or cross-site attributes. The controller ONC decides whether to query the port information based on whether the security rule bound to the port is a remote security group. The ONC decides whether to synchronize the port information of the opposite ONC based on whether the Router attribute associated with the port is a cross-site attribute. The information of the opposite ONC is obtained through the docking configuration. The flow management module generates the corresponding Openflow flow table based on the port information synchronized locally and at the opposite end. The flow management module sends the generated Openflow flow table to the VSW. Since the Openflow flow table contains the host information in the AZ of the opposite controller, the hosts of different controllers can access each other.

[0142] Figure 4 A schematic flow chart of an access control method provided by another embodiment of the present invention takes an edge cloud scenario including a cloud platform Openstack, a provincial node, and multiple edge sites as an example. Figure 4 As shown, the method includes:

[0143] Step S401: The cloud platform detects a virtual private cloud VPC online service host;

[0144] Step S402: The cloud platform creates a port for the online service host, including information such as the port IP address.

[0145] Step S403: The cloud platform determines whether the VPC service host crosses provincial nodes and edge sites. If so, execute step S404; otherwise, execute step S405.

[0146] Step S404: Update the router information. The Router attribute is a cross-site attribute.

[0147] Step S405: Update the router information, and the Router attribute is a single-site attribute;

[0148] Step S406, the network service driver Networking odl on the cloud platform notifies the controller ONC corresponding to the online host to create or update the Router, Network, Port, Security-Group and other related information corresponding to the host; if the cloud platform already has the router Router information of the online host on the cloud platform, it is determined whether the Router attribute has changed, if so, the notification carries the updated Router information; if not changed, the notification only carries the port information, if the router Router information of the online host on the cloud platform has not been created, the notification carries the Router information and port information of the router to be created.

[0149] Step S407, ONC creates or updates the Router, Network, Port, Security-Group and other related configurations of the online host on ONC according to the notification information; if the notification carries only Port information, then the Port is created; if the notification also carries updated Router information, then the Router is updated; if the notification carries the Router information to be created, then the Router is created.

[0150] Step S408, ONC determines whether the Router attribute is a cross-site attribute, if so, execute step S409, otherwise, execute step S410;

[0151] Step S409, ONC synchronizes the port information of the peer ONC;

[0152] Step S410, ONC determines whether the security group rule associated with the port is that the same group can enter or the same group can exit. If so, execute step S411, if not, execute step S412;

[0153] Step S411, ONC queries the port bound to the security group rule and obtains the port information;

[0154] Step S412, ONC notifies the flow management module to generate table entries according to the port information and security rules;

[0155] Step S413, ONC notifies the local flow management module to generate a table entry;

[0156] Step S414: The flow management module publishes the item through Openflow;

[0157] Step S416: VSW configures and installs Openflow table entries. Since the flow table contains peer information, VSWs can access each other.

[0158] The embodiment of the present invention realizes the interaction between ONCs and synchronizes the port information of the local end to the ONC of the opposite end, thereby realizing a technical solution that hosts between sites managed by different controllers under the same VPC can control the intercommunication between hosts through the security policy of the remote security group.

[0159] Based on the same inventive concept, an embodiment of the present invention further provides a controller, which is applied to an edge cloud scenario. The edge cloud scenario includes a cloud platform and at least two controllers, such as Figure 5 As shown, the controller includes: a receiving module 51, a first synchronization module 52, a second synchronization module 53, a first acquisition module 54 and an access control module 55, wherein:

[0160] The receiving module 51 is used to receive a first notification sent by the cloud platform, wherein the first notification is sent by the cloud platform after detecting that the first host associated with the controller is online, creating the port information of the first host on the cloud platform and determining the router information corresponding to the virtual private cloud to which the first host belongs, wherein the router information includes router attributes, and the router attributes include single-site attributes or cross-site attributes, and the cloud platform determines the router attributes according to the number of controllers corresponding to all online hosts in the same virtual private cloud as the first host; the first synchronization module 52 is used to synchronize the port information and router information corresponding to the first host on the controller according to the first notification, and the port information Including associated security group rules; the second synchronization module 53 is used to synchronize the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration if the router attribute is a cross-site attribute; the first acquisition module 54 is used to obtain all host information associated with the same group entry / exit rule if the security group rule is a same-group entry / exit rule, wherein all host information includes host information corresponding to the port information associated with the same group entry / exit rule synchronized by other controllers; the access control module 55 is used to generate an access control flow table based on all the host information, and send the access control flow table to the virtual switches associated with all hosts corresponding to the same-group entry / exit rule.

[0161] As the controller described above, optionally, the edge cloud scenario includes a first controller and a second controller, the first controller is associated with a main site host, and the second controller is associated with all edge site hosts;

[0162] or,

[0163] The first controller is associated with all edge site hosts, and the second controller is associated with the main site host.

[0164] As the above controller, optionally, further comprises: a second acquisition module;

[0165] The second acquisition module is used to acquire the configuration information of the other controllers before receiving the first notification sent by the cloud platform, and set the preset docking configuration according to the configuration information.

[0166] As in the above controller, optionally, the first synchronization module 52 is specifically used for:

[0167] Receive the security group rules input by the user, create the port information corresponding to the first host on the controller according to the port information of the first host on the cloud platform, and set the security group rules associated with the port information to the security group rules input by the user.

[0168] As in the above controller, optionally, the receiving module is further used for:

[0169] Before obtaining all host information associated with the same group of entry / exit rules, receiving port information synchronized by other controllers, the port information including associated security group rules;

[0170] Determine the host information corresponding to the port information of the security group rule in the synchronized port information as the port information of the same group of ingress / egress rules.

[0171] Based on the same inventive concept, an embodiment of the present invention further provides a cloud platform, which is applied to an edge cloud scenario. The edge cloud scenario also includes the cloud platform and at least two controllers, such as Figure 6 As shown, the cloud platform includes: a detection module 61, a creation module 62, a setting module 63 and a sending module 64, wherein:

[0172] The detection module 61 is used to determine the number of controllers corresponding to all online hosts in the virtual private cloud corresponding to the first host after detecting that the first host associated with the first controller is online; the creation module 62 is used to create the port information of the first host on the cloud platform and determine the router information corresponding to the virtual private cloud, wherein the router information includes router attributes; the setting module 63 is used to set the router attributes according to the number of controllers, wherein the router attributes include single-site attributes or cross-site attributes; the sending module 64 is used to send a first notification to the first controller so that the first controller performs the following steps according to the first notification: synchronize the first host on the first controller Corresponding port information and router information, the port information including associated security group rules; if the router attribute is a cross-site attribute, synchronizing the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration; if the security group rule is a same-group entry / exit rule, obtaining all host information associated with the same-group entry / exit rule, wherein all host information includes host information corresponding to the port information associated with the same-group entry / exit rule synchronized by other controllers; generating an access control flow table based on all host information, and sending the access control flow table to all virtual switches associated with the hosts corresponding to the same-group entry / exit rule.

[0173] As in the above cloud platform, optionally, the creation module 62 is specifically used for:

[0174] If the number of the controllers is greater than 1, the router attribute is set to a cross-site attribute; otherwise, the router attribute is set to a single-site attribute.

[0175] As in the above cloud platform, optionally, the creation module 62 is specifically used for:

[0176] Determine whether router information corresponding to the virtual private cloud has been created on the first controller;

[0177] If not created, determining router information corresponding to the virtual private cloud to be created on the first controller, and determining the router attributes;

[0178] Accordingly, the sending module 64 is specifically used for:

[0179] Sending a first notification to the first controller, where the first notification carries port information of the first host on the cloud platform and router information to be created by the first controller;

[0180] If it has been created, determining whether the router attribute in the router information on the first controller has changed;

[0181] If the router attribute changes, determining the router information to be updated on the first controller;

[0182] Accordingly, the sending module 64 is specifically used for:

[0183] Sending a first notification to the first controller, where the first notification carries port information of the first host on the cloud platform and router information to be updated on the first controller;

[0184] If the router attribute has not changed, the sending module 64 is specifically used to:

[0185] A first notification is sent to the first controller, where the first notification carries port information of the first host on the cloud platform.

[0186] As in the above cloud platform, optionally, the creation module 62 is specifically used for:

[0187] Determine whether a router attribute in the router information associated with the first host in the cloud platform has changed;

[0188] If the router attribute changes, update the router information;

[0189] Accordingly, the sending module 64 is specifically used for:

[0190] Sending a first notification to the first controller, where the first notification carries port information and updated router information of the first host on the cloud platform;

[0191] If the router attribute has not changed, the sending module 64 is specifically used to:

[0192] A first notification is sent to the first controller, where the first notification carries port information of the first host on the cloud platform.

[0193] The device provided in the embodiment of the present invention is used to implement the above method. Its functions are specifically referred to the above method embodiment and will not be described in detail here.

[0194] Figure 7 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention, such as Figure 7 As shown, the device includes: a processor 71, a memory 72 and a bus 73;

[0195] The processor 71 and the memory 72 communicate with each other via the bus 73;

[0196] The processor 71 is used to call the program instructions in the memory 72 to execute the methods provided by the above-mentioned method embodiments, for example, including: receiving a first notification sent by the cloud platform, the first notification is sent by the cloud platform after detecting that the first host associated with the controller is online, creating the port information of the first host on the cloud platform and determining the router information corresponding to the virtual private cloud to which the first host belongs, wherein the router information includes router attributes, and the router attributes include single-site attributes or cross-site attributes, and the cloud platform determines the router attributes according to the number of controllers corresponding to all online hosts in the same virtual private cloud as the first host; according to the first notification, synchronizing the first host The method comprises the steps of: obtaining port information and router information corresponding to the first host on the controller, wherein the port information includes the associated security group rule; if the router attribute is a cross-site attribute, synchronizing the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration; if the security group rule is a same-group entry / exit rule, obtaining all host information associated with the same-group entry / exit rule, wherein the all host information includes the host information corresponding to the port information associated with the same-group entry / exit rule synchronized by the other controllers; generating an access control flow table according to the all host information, and sending the access control flow table to the virtual switches associated with all hosts corresponding to the same-group entry / exit rule.

[0197] An embodiment of the present invention discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments, for example, including: receiving a first notification sent by a cloud platform, the first notification is sent by the cloud platform after detecting that the first host associated with the controller is online, creating the port information of the first host on the cloud platform and determining the router information corresponding to the virtual private cloud to which the first host belongs, wherein the router information includes router attributes, and the router attributes include single-site attributes or cross-site attributes, and the cloud platform determines the router information corresponding to the virtual private cloud to which the first host belongs according to the first host. The method comprises the following steps: determining a router attribute according to the number of controllers corresponding to the first host; synchronizing the port information and router information corresponding to the first host on the controller according to the first notification, wherein the port information includes the associated security group rules; if the router attribute is a cross-site attribute, synchronizing the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration; if the security group rule is a same-group entry / exit rule, obtaining all host information associated with the same-group entry / exit rule, wherein all host information includes the host information corresponding to the port information associated with the same-group entry / exit rule synchronized by other controllers; generating an access control flow table according to all the host information, and sending the access control flow table to the virtual switches associated with all the hosts corresponding to the same-group entry / exit rule.

[0198] An embodiment of the present invention provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, wherein the computer instructions enable the computer to execute the methods provided by the above-mentioned method embodiments, for example, including: receiving a first notification sent by a cloud platform, wherein the first notification is sent by the cloud platform after detecting that the first host associated with the controller is online, creating the port information of the first host on the cloud platform and determining the router information corresponding to the virtual private cloud to which the first host belongs, wherein the router information includes router attributes, wherein the router attributes include single-site attributes or cross-site attributes, and the cloud platform determines the router attributes according to the number of controllers corresponding to all online hosts in the same virtual private cloud as the first host. property; according to the first notification, synchronize the port information and router information corresponding to the first host on the controller, the port information including the associated security group rules; if the router attribute is a cross-site attribute, synchronize the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration; if the security group rule is a same-group entry / exit rule, obtain all host information associated with the same-group entry / exit rule, wherein all host information includes the host information corresponding to the port information associated with the same-group entry / exit rule synchronized by other controllers; generate an access control flow table based on all the host information, and send the access control flow table to all virtual switches associated with the hosts corresponding to the same-group entry / exit rule.

[0199] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0200] The above-described embodiments of the apparatus and the like are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0201] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0202] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention, rather than to limit them. Although the embodiments of the present invention have been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An access control method, characterized in that: Applied in an edge cloud scenario, the edge cloud scenario includes a cloud platform and at least two controllers, the method is applied to the controller, and the method includes: Receive a first notification sent by the cloud platform, the first notification is sent by the cloud platform after detecting that a first host associated with a first controller is online, creating port information of the first host on the cloud platform and determining router information corresponding to a virtual private cloud to which the first host belongs, wherein the router information includes router attributes, the router attributes include single-site attributes or cross-site attributes, and the cloud platform determines the router attributes according to the number of controllers corresponding to all online hosts in the same virtual private cloud as the first host; According to the first notification, synchronize the port information and router information corresponding to the first host on the first controller, wherein the port information includes associated security group rules; If the router attribute is a cross-site attribute, synchronizing the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration; If the security group rule is a same-group entry / exit rule, then obtaining all host information associated with the same-group entry / exit rule, wherein all host information includes host information corresponding to port information associated with the same-group entry / exit rule synchronized by other controllers; Generate an access control flow table according to the information of all hosts, and send the access control flow table to the virtual switches associated with all hosts corresponding to the same group of entry / exit rules; The step of determining the router information corresponding to the virtual private cloud to which the first host belongs includes: Determine whether router information corresponding to the virtual private cloud has been created on the first controller; If not created, determining router information corresponding to the virtual private cloud to be created on the first controller, and determining the router attributes; Accordingly, the receiving of the first notification sent by the cloud platform includes: The first notification carries the port information of the first host on the cloud platform and the router information to be created by the first controller; If it has been created, determining whether the router attribute in the router information on the first controller has changed; If the router attribute changes, determining the router information to be updated on the first controller; Accordingly, the receiving of the first notification sent by the cloud platform includes: The first notification carries the port information of the first host on the cloud platform and the router information to be updated on the first controller; If the attribute of the router has not changed, the receiving the first notification sent by the cloud platform includes: The first notification carries port information of the first host on the cloud platform.

2. The method according to claim 1, characterized in that The edge cloud scenario includes a first controller and a second controller, the first controller is associated with a main site host, and the second controller is associated with all edge site hosts; or, The first controller is associated with all edge site hosts, and the second controller is associated with the main site host.

3. The method according to claim 1, characterized in that Before receiving the first notification sent by the cloud platform, the following steps are also included: The configuration information of the other controller is obtained, and a preset docking configuration is set according to the configuration information.

4. The method according to claim 1, characterized in that The creating the port information corresponding to the first host on the first controller includes: Receive security group rules input by a user, create corresponding port information of the first host on the first controller according to the port information of the first host on the cloud platform, and set the security group rules associated with the port information to the security group rules input by the user.

5. The method according to any one of claims 1 to 4, characterized in that: Before obtaining all host information associated with the same group of entry / exit rules, the method further includes: Receiving port information synchronized by other controllers, wherein the port information includes associated security group rules; Determine the host information corresponding to the port information of the security group rule in the synchronized port information as the port information of the same group of ingress / egress rules.

6. An access control method, characterized in that: Applied in an edge cloud scenario, the edge cloud scenario includes a cloud platform and a controller, the method is applied in the cloud platform, and the method includes: After detecting that a first host associated with a first controller is online, determining the number of controllers corresponding to all online hosts in a virtual private cloud corresponding to the first host; Creating port information of the first host on the cloud platform, and determining router information corresponding to the virtual private cloud, wherein the router information includes router attributes; Setting the router attribute according to the number of controllers, the router attribute including a single-site attribute or a cross-site attribute; A first notification is sent to the first controller so that the first controller performs the following steps according to the first notification: synchronizing the port information and router information corresponding to the first host on the first controller, the port information including the associated security group rules; if the router attribute is a cross-site attribute, synchronizing the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration; if the security group rule is a same-group entry / exit rule, obtaining all host information associated with the same-group entry / exit rule, wherein all host information includes host information corresponding to the port information associated with the same-group entry / exit rule synchronized by other controllers; generating an access control flow table according to all host information, and sending the access control flow table to all virtual switches associated with the hosts corresponding to the same-group entry / exit rule; The step of determining the router information corresponding to the virtual private cloud includes: Determine whether router information corresponding to the virtual private cloud has been created on the first controller; If not created, determining router information corresponding to the virtual private cloud to be created on the first controller, and determining the router attributes; Accordingly, the sending a first notification to the first controller includes: Sending a first notification to the first controller, where the first notification carries port information of the first host on the cloud platform and router information to be created by the first controller; If it has been created, determining whether the router attribute in the router information on the first controller has changed; If the router attribute changes, determining the router information to be updated on the first controller; Accordingly, the sending a first notification to the first controller includes: Sending a first notification to the first controller, where the first notification carries port information of the first host on the cloud platform and router information to be updated on the first controller; If the router attribute has not changed, sending the first notification to the first controller includes: A first notification is sent to the first controller, where the first notification carries port information of the first host on the cloud platform.

7. The method according to claim 6, characterized in that The setting of the router attribute according to the number of controllers includes: If the number of the controllers is greater than 1, the router attribute is set to a cross-site attribute; otherwise, the router attribute is set to a single-site attribute.

8. The method according to claim 6, characterized in that The determining of router information corresponding to the virtual private cloud includes: Determine whether a router attribute in the router information associated with the first host in the cloud platform has changed; If the router attribute changes, update the router information; Accordingly, the sending a first notification to the first controller includes: Sending a first notification to the first controller, where the first notification carries port information and updated router information of the first host on the cloud platform; If the router attribute has not changed, sending the first notification to the first controller includes: A first notification is sent to the first controller, where the first notification carries port information of the first host on the cloud platform.

9. A controller, characterized in that: Applied in an edge cloud scenario, the edge cloud scenario includes a cloud platform and at least two controllers, the controllers include: a receiving module, configured to receive a first notification sent by a cloud platform, wherein the first notification is sent by the cloud platform after detecting that a first host associated with a first controller is online, creating port information of the first host on the cloud platform and determining router information corresponding to a virtual private cloud to which the first host belongs, wherein the router information includes router attributes, and the router attributes include single-site attributes or cross-site attributes, and the cloud platform determines the router attributes according to the number of controllers corresponding to all online hosts in the same virtual private cloud as the first host; A determination module, used to determine router information corresponding to the virtual private cloud to which the first host belongs, including: Determine whether router information corresponding to the virtual private cloud has been created on the first controller; If not created, determining router information corresponding to the virtual private cloud to be created on the first controller, and determining the router attributes; Accordingly, the receiving of the first notification sent by the cloud platform includes: The first notification carries the port information of the first host on the cloud platform and the router information to be created by the first controller; If it has been created, determining whether the router attribute in the router information on the first controller has changed; If the router attribute changes, determining the router information to be updated on the first controller; Accordingly, the receiving of the first notification sent by the cloud platform includes: The first notification carries the port information of the first host on the cloud platform and the router information to be updated on the first controller; If the attribute of the router has not changed, the receiving the first notification sent by the cloud platform includes: The first notification carries port information of the first host on the cloud platform; A first synchronization module, configured to synchronize the port information and router information corresponding to the first host on the first controller according to the first notification, wherein the port information includes associated security group rules; A second synchronization module, configured to synchronize the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration if the router attribute is a cross-site attribute; A first acquisition module is used for acquiring all host information associated with the same group entry / exit rule if the security group rule is a same group entry / exit rule, wherein the all host information includes host information corresponding to the port information associated with the same group entry / exit rule synchronized by the other controllers; The access control module is used to generate an access control flow table according to the information of all hosts, and send the access control flow table to the virtual switches associated with all hosts corresponding to the same group of entry / exit rules.

10. A cloud platform, characterized in that: Applied in an edge cloud scenario, the edge cloud scenario also includes the cloud platform and at least two controllers, and the cloud platform includes: A detection module, configured to determine the number of controllers corresponding to all online hosts in the virtual private cloud corresponding to the first host after detecting that the first host associated with the first controller is online; A creation module is used to create port information of the first host on the cloud platform and determine router information corresponding to the virtual private cloud, wherein the router information includes router attributes; A setting module, used for setting the router attribute according to the number of the controllers, wherein the router attribute includes a single-site attribute or a cross-site attribute; A sending module, used for sending a first notification to the first controller, so that the first controller performs the following steps according to the first notification: synchronizing the port information and router information corresponding to the first host on the first controller, the port information including the associated security group rules; if the router attribute is a cross-site attribute, synchronizing the port information to other controllers belonging to the same virtual private cloud as the first host through a preset docking configuration; if the security group rule is a same-group entry / exit rule, obtaining all host information associated with the same-group entry / exit rule, wherein all host information includes host information corresponding to the port information associated with the same-group entry / exit rule synchronized by other controllers; generating an access control flow table according to all host information, and sending the access control flow table to all virtual switches associated with the hosts corresponding to the same-group entry / exit rule; The step of determining the router information corresponding to the virtual private cloud includes: Determine whether router information corresponding to the virtual private cloud has been created on the first controller; If not created, determining router information corresponding to the virtual private cloud to be created on the first controller, and determining the router attributes; Accordingly, the sending a first notification to the first controller includes: Sending a first notification to the first controller, where the first notification carries port information of the first host on the cloud platform and router information to be created by the first controller; If it has been created, determining whether the router attribute in the router information on the first controller has changed; If the router attribute changes, determining the router information to be updated on the first controller; Accordingly, the sending a first notification to the first controller includes: Sending a first notification to the first controller, where the first notification carries port information of the first host on the cloud platform and router information to be updated on the first controller; If the router attribute has not changed, sending the first notification to the first controller includes: A first notification is sent to the first controller, where the first notification carries port information of the first host on the cloud platform.

11. An access control system, characterized in that: Comprising the cloud platform as claimed in claim 10 and at least two controllers as claimed in claim 9.

12. An electronic device, characterized in that: include: A memory and a processor, wherein the processor and the memory communicate with each other via a bus; The memory stores program instructions executable by the processor, and the processor can execute the method according to any one of claims 1 to 8 by calling the program instructions.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images