Data processing method and device

Abstract

The embodiments of this specification provide a data processing method and device, wherein the data processing method includes: establishing a first data transmission channel between a first VPC and a second VPC, and establishing a second data transmission channel between the second VPC and a service network, wherein the first VPC includes a first type of test application, the second VPC includes a second type of test application, and the service network includes a service object; based on the first data transmission channel, processing the first test data between the first type of test application in the first VPC and the second type of test application in the second VPC; based on the second data transmission channel, processing the second test data between the second type of test application in the second VPC and the service object in the service network. Network isolation between the first VPC and the service network is achieved, and damage caused by the leakage of the first test data to the service network is avoided.

Description

Technical Field

[0001] The embodiments of the present specification relate to the field of computer technology, and in particular, to a data processing method. Background Art

[0002] With the continuous development of Internet technology, applications need to be frequently updated to meet different user needs. In order to ensure that the updated applications can run stably, the updated applications need to be tested.

[0003] In the prior art, the updated application is tested through simulated traffic to determine the stability of the updated application. However, since some updated applications need to interact with the real network environment during the test, and the simulated traffic is completely consistent with the traffic in the real network environment, if the simulated traffic used for testing is leaked into the real network environment, it will damage the real network environment and affect the data security of users in the real network environment. Summary of the invention

[0004] In view of this, an embodiment of this specification provides a data processing method. One or more embodiments of this specification also relate to a data processing device, a data processing system, a computing device, a computer-readable storage medium and a computer program to solve the technical defects existing in the prior art.

[0005] According to a first aspect of an embodiment of this specification, a data processing method is provided, including:

[0006] Establishing a first data transmission channel between a first VPC and a second VPC, and establishing a second data transmission channel between the second VPC and a service network, wherein the first VPC includes a first type of test application, the second VPC includes a second type of test application, and the service network includes a service object;

[0007] Processing, based on the first data transmission channel, first test data between the first type test application in the first VPC and the second type test application in the second VPC;

[0008] Based on the second data transmission channel, second test data between the second type of test application in the second VPC and the service object in the service network is processed.

[0009] According to a second aspect of an embodiment of this specification, there is provided a data processing device, including:

[0010] A building module is configured to establish a first data transmission channel between a first VPC and a second VPC, and to establish a second data transmission channel between the second VPC and a service network, wherein the first VPC includes a first type of test application, the second VPC includes a second type of test application, and the service network includes a service object;

[0011] A first processing module is configured to process, based on the first data transmission channel, first test data between the first type test application in the first VPC and the second type test application in the second VPC;

[0012] The second processing module is configured to process second test data between the second type test application in the second VPC and the service object in the service network based on the second data transmission channel.

[0013] According to a third aspect of an embodiment of this specification, a data processing system is provided, including a first VPC, a second VPC, and a service network, wherein:

[0014] The first VPC and the second VPC are configured to establish a first data transmission channel between the first VPC and the second VPC, wherein the first VPC includes a first type of test application and the second VPC includes a second type of test application;

[0015] The second VPC and the service network are configured to establish a second data transmission channel between the second VPC and the service network, wherein the service network includes a service object;

[0016] Processing, based on the first data transmission channel, first test data between the first type test application in the first VPC and the second type test application in the second VPC;

[0017] Based on the second data transmission channel, second test data between the second type of test application in the second VPC and the service object in the service network is processed.

[0018] According to a fourth aspect of an embodiment of this specification, a computing device is provided, including:

[0019] Memory and processor;

[0020] The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the steps of the above data processing method are implemented.

[0021] According to a fifth aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores computer-executable instructions, and when the instructions are executed by a processor, the steps of the above-mentioned data processing method are implemented.

[0022] According to a sixth aspect of the embodiments of this specification, a computer program is provided, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned data processing method.

[0023] The present specification provides a data processing method, including: establishing a first data transmission channel between a first VPC and a second VPC, and establishing a second data transmission channel between the second VPC and a service network, wherein the first VPC includes a first type of test application, the second VPC includes a second type of test application, and the service network includes a service object; based on the first data transmission channel, processing first test data between the first type of test application in the first VPC and the second type of test application in the second VPC; based on the second data transmission channel, processing second test data between the second type of test application in the second VPC and the service object in the service network.

[0024] Specifically, the solution implements network isolation between the first VPC and the service network by establishing a first data transmission channel between the first VPC and the second VPC, and establishing a second data transmission channel between the second VPC and the service network, and processes the first test data between the first type test application in the first VPC and the second type test application in the second VPC through the first data transmission channel, and processes the second test data between the second type test application in the second VPC and the service object in the service network based on the second data transmission channel, thereby avoiding the first test data from leaking into the service network environment, which would damage the service network environment and affect the data security of users in the service network environment. At the same time, the second VPC and the service network are interconnected through the second data transmission channel, so that the second type test application can interact with the service network, thereby successfully completing the application test. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a schematic diagram of a traffic isolation solution provided by an embodiment of this specification;

[0026] Figure 2 This is a schematic diagram of an application scenario of a data processing method provided by an embodiment of this specification;

[0027] Figure 3 is a flow chart of a data processing method provided by an embodiment of this specification;

[0028] Figure 4 is a structural diagram of a data processing system provided by an embodiment of this specification;

[0029] Figure 5 is a structural schematic diagram of a data processing device provided by an embodiment of this specification;

[0030] Figure 6 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0031] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0032] The terms used in one or more embodiments of this specification are only for the purpose of describing specific embodiments, and are not intended to limit one or more embodiments of this specification. The singular forms of "a", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items.

[0033] It should be understood that although the terms first, second, etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, the first may also be referred to as the second, and similarly, the second may also be referred to as the first. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0034] First, the terms involved in one or more embodiments of this specification are explained.

[0035] VPC: Virtual Private Cloud (VPC) is an isolated network environment. VPC networks and VPC networks and public networks are completely isolated logically, and cannot access each other by default.

[0036] Cloud Enterprise Network (CEN) is a technology and product that can build private communication channels between VPCs and between VPCs and local data centers and realize automatic routing.

[0037] Pod: A management unit. A Pod can encapsulate one or more containers.

[0038] With the continuous development of Internet technology, applications need to be frequently updated to meet different user needs. In order to ensure that the updated applications can run stably, the updated applications need to be tested.

[0039] In the prior art, an updated application is tested in a simulation environment through simulated traffic to determine the stability of the updated application. The simulation environment is an online environment parallel to grayscale and production, with the goal of completely simulating the production environment, supporting pre-change verification and prevention to reduce failures, and providing a realistic working environment for technical risks such as funding / high availability drills / fault playback / fuzz testing. The simulation environment will mirror production traffic to an independent environment for operation, so that highly simulated traffic can determine in advance whether production changes are controllable, further reducing the risk of changes. However, the simulated traffic is completely consistent with production. If the traffic escapes to production, it will cause production data pollution and affect users, so the simulation environment needs to be isolated. Based on this, this specification provides a traffic isolation solution, see Figure 1 , Figure 1 This is a schematic diagram of a traffic isolation solution provided by an embodiment of this specification. Specifically, the solution is to perform network isolation by using various types of security groups (for example, general security groups, enterprise security groups). Although the above solution can achieve traffic isolation, the solution has certain stability risks. Its main disadvantages are as follows: 1. Poor stability: In the case of large-scale, multi-scenario, and multi-instance states, the strategy is complex, and a series of problems such as policy issuance failure and confusion will occur. The stability has certain defects. If there are problems with isolation stability, a large number of simulation requests will escape to production, causing serious failures. 2. The configuration cost is high, and there is a great possibility of change errors, resulting in isolation risks.

[0040] Based on this, in this specification, a data processing method is provided. This specification also involves a data processing device, a data processing system, a computing device, and a computer-readable storage medium, which are described in detail one by one in the following embodiments.

[0041] See also Figure 2 , Figure 2A schematic diagram of an application scenario of a data processing method provided according to an embodiment of the present specification is shown, wherein the simulated independent VPC can be a first VPC, the simulated intercommunication VPC can be a second VPC, and the generation environment can be a service network. Based on this, Figure 2 The system deployment scheme of the data processing method provided in this manual is demonstrated. Figure 2 It can be seen that the simulated intercommunication VPC and the production environment are interconnected, and the simulated independent VPC and the production environment are isolated at the routing level, while various simulated VPCs are interconnected; at the same time, for frequently changing application scenarios, this manual provides a data processing solution; specifically, the data processing method provided in this manual achieves reliable environment isolation through independent VPC, and the main process is as follows.

[0042] Step 1: Create a new independent VPC.

[0043] Specifically, in the data processing method provided in this specification, in the process of testing the application through a simulation environment, it is first necessary to establish an intercommunication VPC and an independent VPC in the simulation environment respectively. At this time, the intercommunication VPC and the independent VPC are routed isolated. The route isolation means that the IP routes of the two logical network areas are unreachable, and private IPs cannot access each other by default. They need to go through two network protocol conversions of the border gateway before they can access each other.

[0044] The constructed simulated independent VPC has routing isolation from the production environment; and in the simulated independent VPC, application testing that does not require interaction with the production environment can be performed.

[0045] The constructed simulated intercommunication VPC and the production environment can communicate with each other, and in the simulated intercommunication VPC, application tests that need to interact with the production environment can be performed.

[0046] In practical applications, testing or simulation is generally performed on the "scenario" dimension, which can be understood as a collection of many applications, some of which need to interact with the production environment, while others do not.

[0047] Specifically, for "applications that do not need to interact with the production environment", member core data and dependencies have been independently deployed in simulation, and if the production data is read and written, it will have a great impact on the online environment. For example, if a user recharges a one-year membership, the simulation replicates this request and introduces it into the simulation environment for testing; but if the isolation fails, the request is leaked to the production environment, which will cause the user to recharge another year of membership, or multiple deductions.

[0048] In addition, for "applications that need to interact with production", such as simulation server metadata collection applications, unified management and deployment are required. However, there can only be one management and control end and it must be in the production environment. In this case, it is necessary to interact with the production environment.

[0049] Step 2: Independent VPC and interconnected VPC are connected through Cloud Enterprise Network.

[0050] Specifically, there is no route between the independent VPC and the interconnected VPC, but the independent VPC and the interconnected VPC belong to the same simulation environment and need to request interaction between them. Based on this, the routes between the independent VPC and the interconnected VPC are connected through the policy configured in the routing policy table of the Cloud Enterprise Network.

[0051] For example, for an independent VPC, a routing policy table between the independent VPC and the cloud enterprise network is configured with a routing policy so that the independent VPC and the cloud enterprise network can communicate with each other.

[0052] For the intercommunication VPC, a routing policy table between the intercommunication VPC and the cloud enterprise network is configured with a routing policy so that the intercommunication VPC and the cloud enterprise network can be intercommunication.

[0053] Afterwards, the interoperable VPC is connected to the independent VPC through the forwarding router in the cloud enterprise network.

[0054] It should be noted that the core of the data processing method provided in this specification is to connect the intercommunication VPC and the independent VPC through the cloud enterprise network; specifically, the cloud enterprise network provides a variety of network interconnection and routing management functions such as connecting network instances, adding custom routing tables, adding routing entries, and adding routing policies through forwarding routers. It is mainly connected to the intercommunication VPC and will not be connected to the production environment, thus cutting off the risk of simulated request escape from the routing. From the perspective of isolation security level, since routing isolation achieves network isolation by controlling the three-layer routing table, it has strong isolation reliability, and as a bottom-up strategy, it does not change frequently, which further enhances the isolation stability.

[0055] Step 3: Modify the network tag of the app.

[0056] Specifically, after the independent VPC and the intercommunication VPC are connected through the cloud enterprise network, the data processing method provided in this specification can create different security groups for the application by analyzing the different application scenarios corresponding to the application. The security group, also known as the network security group, is a network access control list that controls the traffic in and out of the network through the network protocol five-tuple black and white list; then, through an independent VSW (virtual switch) and mapping sgTAG (tag) to the application instance, each application can be isolated and segmented.

[0057] Among them, the security group is a collection of network policies. It is controlled through the network five-tuple (source IP, destination IP, source port, destination port, allow / deny (allow and deny)), and is a network control tool for the application level.

[0058] The purpose of using this security group is that even if the applications are in interconnected VPCs, they will have different isolation requirements. For example, application A needs to access the database in the production environment without damaging the production data. Therefore, application A needs to be able to access the production database. If application B reads and writes the database in the production environment, it will have a great impact. Therefore, it cannot be allowed to connect to the production database, but it needs to access the control end of the production environment (such as sending notifications). In this case, although application A and application B are in interconnected VPCs, more sophisticated isolation control is still required. Based on this, security groups are used in this solution to achieve more sophisticated isolation control.

[0059] The VSW is a virtual switch used to divide the simulated independent network segments. The sgTAG is a label used to mark which security group a pod is scheduled to, or to an independent VPC.

[0060] Based on this, the process of "isolating and segmenting each application through independent VSW and mapping sgTAG to application instances" is as follows: When creating a pod, this solution will add a fixed label to the pod. Referred to as sgTAG (i.e. sg tag), its value represents the security group in which the pod will be created. Through specific management and control methods, an application-security group mapping table is maintained to control application isolation. Among them, this feature control method can be understood as a method that can maintain an application-security group mapping table and control application isolation, and this manual does not impose specific restrictions on this.

[0061] Step 4: Migrate the application to a separate VPC.

[0062] Specifically, for applications that do not need to interact with the production environment, sgTAG is sent to schedule the application pod to an independent VPC, ultimately achieving network isolation at the routing level.

[0063] It should be noted that the method of migrating the application to an independent VPC in step 4 is the same as the method of adjusting the application to a security group; that is, when creating an application pod, a fixed label will be added to the pod, such as the sim label, where "sim" is a custom label. When the sim label is recognized, the pod will be automatically scheduled to the specified VPC (independent VPC).

[0064] Based on the above steps, it can be seen that the data processing method provided in this specification is a network isolation solution based on VPC. This solution provides a highly available and stable isolation architecture solution based on VPC, which makes up for the problems of complex scheduling and distribution and poor stability. In view of the lack of stability and high configuration cost of the above traffic isolation solution, this solution can reduce configuration costs while improving stability. The specific features of this solution are:

[0065] 1. Extremely high stability: Network isolation is achieved by controlling the routing table policy on the three-layer router. Control is performed at the bottom layer of the network, and fixed policies are built. There are very few change scenarios, and there is basically no scenario where the policy fails to be issued. The stability is extremely high.

[0066] 2. Low configuration cost: When building a VPC, you only need to set the routing table policy once, and the configuration cost is low.

[0067] In summary, the data processing method provided in this specification is a network isolation solution that is easy to control, stable and reliable, and easy to adapt to complex application scenarios. It can use forwarding routers to control routing table policies to achieve VPC routing isolation. Since it is controlled at the bottom of the network policy, a high degree of isolation is achieved; and the delivery policy is centralized and simple, and there is basically no problem of delivery failure, which has the characteristics of high stability. At the same time, due to the routing backup strategy, there is basically no change, so the change frequency is low, making the configuration cost low.

[0068] See also Figure 3 , Figure 3 A flow chart of a data processing method provided according to an embodiment of the present specification is shown, which specifically includes the following steps.

[0069] Step 302: Establish a first data transmission channel between the first VPC and the second VPC, and establish a second data transmission channel between the second VPC and the service network.

[0070] The first VPC includes a first type of test application, the second VPC includes a second type of test application, and the service network includes a service object.

[0071] Among them, the first VPC can be understood as a VPC that requires strict routing isolation from the service network, such as the simulated independent VPC in the above embodiment; the first type of test application can be understood as an application that cannot interact with the service network, such as the "application that does not need to interact with the production environment" in the above embodiment.

[0072] Among them, the second VPC can be understood as a VPC that needs to be connected to the service network, such as the simulated connected VPC in the above embodiment; the second type of test application can be understood as an application that can interact with the service network, such as the "application that needs to interact with production" in the above embodiment.

[0073] The service network can be understood as a real production environment, and the service object can be a database, a control terminal, and other objects in the production environment.

[0074] The first data transmission channel can be understood as a channel that can only realize data transmission between the first VPC and the second VPC; correspondingly, the second data transmission channel can be understood as a channel that can only realize data transmission between the second VPC and the service network.

[0075] Specifically, the data processing method provided in this specification can establish a first data transmission channel between the first VPC and the second VPC, and the first data transmission channel can only transmit data between the first VPC and the second VPC; and establish a second data transmission channel between the second VPC and the service network, and the second data transmission channel can only transmit data between the second VPC and the service network.

[0076] In the embodiments provided in this specification, in order to ensure a better routing isolation effect between the first VPC and the service network, the data processing method provided in this specification uses a VPC communication network to connect the first VPC with the second VPC, thereby cutting off the risk of simulation request escape from the routing. Specifically, the establishment of a first data transmission channel between the first VPC and the second VPC includes:

[0077] A first data transmission channel is established between the first VPC and the second VPC based on the VPC communication network and the communication route in the VPC communication network, wherein the VPC communication network only implements data transmission between the first VPC and the second VPC.

[0078] Among them, the VPC communication network can be understood as a network dedicated to data transmission between the first VPC and the second VPC. A data transmission channel between the first VPC and the second VPC can be constructed through the VPC communication network, so as to ensure data security between the first VPC and the second VPC while realizing data transmission between the two, and avoid data leakage. For example, the VPC communication network can be the above-mentioned cloud enterprise network; the communication route can be understood as a router used for data forwarding in the VPC communication network. The routing strategy is controlled by the communication route, so as to realize route isolation and route forwarding between the first VPC and the second VPC. For example, the communication route can be a forwarding router in the above-mentioned cloud enterprise network.

[0079] For example, there is no route between the independent VPC and the interconnected VPC, and the independent VPC and the interconnected VPC belong to the same simulation environment, and request interaction is required between them; based on this, through the policy configured in the routing policy table of the Cloud Enterprise Network, the routes between the independent VPC and the interconnected VPC are connected through forwarding routing, thereby building a data transmission channel between the independent VPC and the interconnected VPC, thereby achieving data transmission between the first VPC and the second VPC while ensuring data security between the two and avoiding data leakage.

[0080] Furthermore, in the embodiment provided in this specification, a VPC communication network is used to connect the first VPC and the second VPC, thereby cutting off the risk of simulation request escape from the routing and avoiding data leakage. The specific method of connecting the first VPC and the second VPC through the VPC communication network is to establish a first data transmission channel between the first VPC and the second VPC based on the VPC communication network and the communication route in the VPC communication network, including:

[0081] Establishing a first VPC communication channel between the VPC communication network and the first VPC by configuring a routing policy between the VPC communication network and the first VPC;

[0082] Establishing a second VPC communication channel between the VPC communication network and the second VPC by configuring a routing policy between the VPC communication network and the second VPC;

[0083] The first VPC communication channel and the second VPC communication channel are associated through the communication route in the VPC communication network, and a first data transmission channel between the first VPC and the second VPC is established.

[0084] For example, for an independent VPC, a routing policy is configured for the routing policy table between the independent VPC and the cloud enterprise network, so that the independent VPC and the cloud enterprise network can communicate with each other. For an interoperable VPC, a routing policy is configured for the routing policy table between the interoperable VPC and the cloud enterprise network, so that the interoperable VPC and the cloud enterprise network can communicate with each other. Afterwards, the interoperable VPC is connected to the independent VPC through the forwarding router in the cloud enterprise network.

[0085] In an embodiment provided in this specification, considering that an application in an intercommunication VPC needs to interact with a production environment; therefore, the data processing method provided in this specification can establish a data transmission channel between the intercommunication VPC and the production environment, and implement the interaction between the application in the intercommunication VPC and the production environment based on the data transmission channel, so that the application that needs to interact with the production environment can successfully complete the test. Specifically, the establishment of a second data transmission channel between the second VPC and the service network includes:

[0086] A second data transmission channel between the second VPC and the service network is established by configuring a routing policy between the second VPC and the service network.

[0087] For example, by configuring the routing policy in the routing policy table between the intercommunication VPC and the production environment, routing intercommunication is achieved between the intercommunication VPC and the production environment, thereby building a data transmission channel between the intercommunication VPC and the production environment.

[0088] In an embodiment provided in this specification, considering that different applications correspond to different application scenarios and different applications have different isolation requirements, a security group policy is adopted for applications in an independent VPC to isolate and subdivide each application, thereby further ensuring data security. Specifically, the data processing method provided in this specification also includes:

[0089] Receive an application set construction request for the first VPC, wherein the application set construction request carries at least two application set types and routing configuration parameters corresponding to the at least two application set types;

[0090] Based on the at least two application set types, construct at least two application sets in the first VPC, and based on the routing configuration parameters, adjust the routing policy of the first data transmission channel;

[0091] Determine application type information of the first type test application, determine a target application set corresponding to the application type information from the at least two application sets, and add the first type test application to the target application set.

[0092] Among them, the application set construction request can be understood as a request to build the application set, and the application set is understood as a set containing a specific type of test applications, for example, test applications with the same security level are placed in the same set, or test applications with the same network label are placed in the same set; wherein, the application set can be understood as the above-mentioned security group, and the two types of application sets can be understood as security types of different security groups, security levels of different security groups, or labels corresponding to the test applications included in the security group, etc.; the routing configuration parameters can be understood as parameters for configuring the routing policies between the different security groups and the interoperable VPC. In actual applications, the applications in the interoperable VPC that can be accessed by different security groups are different. Therefore, it is necessary to configure the applications in the interoperable VPC that can be accessed by different security groups based on the routing configuration parameters, so as to achieve more refined routing isolation.

[0093] The application type information may be understood as the application scenario corresponding to the first type test application, or the security type corresponding to the first type test application.

[0094] Using the above example, in actual applications, applications are in independent VPCs and will have different isolation requirements. Therefore, the data processing method provided in this specification can respond to the received security group construction request, build security groups of different security types in the independent VPC, and configure the routing policy between the security group and the application in the interconnected VPC, thereby limiting the interaction between the security group and the application in the interconnected VPC. Afterwards, the application type of the application in the independent VPC is determined, and the application is assigned to the corresponding security group based on the application type.

[0095] Further, in the embodiment provided in this specification, the adding the first type of test application to the target application set includes:

[0096] An application set tag corresponding to the target application set is determined, and the first type of test application is added to the target application set by modifying the application tag of the first type of test application to an application set tag.

[0097] The application set tag may be understood as the network tag of all applications included in the security group, for example, the above-mentioned sgTAG; the application tag may be understood as the network tag assigned to the application when it is created.

[0098] Using the above example, when creating a pod, a fixed label will be added to the application pod, and its value represents the security group in which the application pod will be created. Based on this, after the security group is built in the independent VPC, the application pod can be assigned to the corresponding security group based on the label.

[0099] In an embodiment provided in this specification, considering that the applications in the inter-connected VPC interact with the inter-connected VPC, there may be different isolation requirements; based on this, the data processing method provided in this specification also includes:

[0100] receiving an application set construction request for the second VPC, wherein the application set construction request carries at least two application set types and routing configuration parameters corresponding to the at least two application set types;

[0101] Based on the at least two application set types, construct at least two application sets in the second VPC, and based on the routing configuration parameters, adjust the routing policies of the first data transmission channel and the second data transmission channel;

[0102] Determine application type information of the second-type test application, determine a target application set corresponding to the application type information from the at least two application sets, and add the second-type test application to the target application set.

[0103] Among them, the routing configuration parameters can be understood as the parameters for configuring the routing policies between the different security groups and the service network. In actual applications, the service objects that different security groups can access are different. Therefore, it is necessary to configure the service objects that different security groups can access based on the routing configuration parameters, so as to achieve more refined routing isolation.

[0104] Continuing with the above example, in actual applications, applications are in interoperable VPCs and will have different isolation requirements. Therefore, the data processing method provided in this specification can respond to the received security group construction request, build security groups of different security types in the interoperable VPC, and configure the routing policy between the security group and the database, control end and other objects in the production environment, thereby limiting the interaction between the security group and the database, control end and other objects in the production environment. Afterwards, determine the application type of the application in the interoperable VPC, and assign the application to the corresponding security group based on the application type.

[0105] Further, in the embodiment provided in this specification, the adding the second type test application to the target application set includes:

[0106] An application set tag corresponding to the target application set is determined, and the second type of test application is added to the target application set by modifying the application tag of the second type of test application to an application set tag.

[0107] Using the above example, when creating a pod, a fixed label will be added to the application pod, and its value represents the security group in which the application pod will be created. Based on this, after the security group is built in the interconnected VPC, the application pod can be assigned to the corresponding security group based on the label.

[0108] In one embodiment provided in this specification, the data processing method further includes:

[0109] receiving an adjustment request for the application to be adjusted, wherein the adjustment request carries an application identifier of the application to be adjusted and a target VPC corresponding to the application to be adjusted, the application to be adjusted is the first type test application or the second type test application, and the target VPC is the first VPC or the second VPC;

[0110] An application tag of the application to be adjusted and a VPC tag corresponding to the target VPC are determined, and the application to be adjusted is added to the target VPC by modifying the application tag of the application to be adjusted to a VPC tag.

[0111] Continuing with the above example, for applications that do not need to interact with the production environment, the application pod is scheduled to an independent VPC through labels, and finally network isolation at the routing level is achieved. It should be noted that the method of migrating applications to an independent VPC is the same as the method of adjusting applications to security groups mentioned above; that is, when the application pod is created, a fixed label will be added to the pod. When this label is recognized, the pod will be automatically scheduled to the specified VPC (independent VPC).

[0112] Step 304: Based on the first data transmission channel, process the first test data between the first type test application in the first VPC and the second type test application in the second VPC.

[0113] Specifically, the process of processing the first test data based on the first data transmission channel is: determining whether the routing parameters of the first test data meet the routing policy of the first data transmission channel; if so, transmitting the first test data based on the first data transmission channel; if not, discarding the first test data.

[0114] Using the above example, the first type of test application is application A in an independent VPC, and the second type of test application is application B in an interconnected VPC. When application A sends a call request to application B, or application B sends a call request to application A, it is necessary to determine from the routing policy table whether the source IP address of the call request sent and the destination IP address receiving the call request are interconnected. If so, the call request is forwarded to the destination IP address through routing; if not, the call request is discarded.

[0115] Further, in the embodiment provided in this specification, in order to perform more refined routing control, a security group mechanism is adopted. Based on this, the manner in which applications in the security group communicate with other applications is as follows: based on the first data transmission channel, the first test data between the first type test application in the first VPC and the second type test application in the second VPC is processed, including:

[0116] Determine first test data between the first type of test application included in the target application set in the first VPC and the second type of test application included in the target application set in the second VPC;

[0117] When it is determined that the routing parameters of the first test data satisfy the routing policy of the first data transmission channel, transmitting the first test data based on the first data transmission channel; or

[0118] When it is determined that the routing parameters of the first test data do not satisfy the routing policy of the first data transmission channel, the first test data is discarded.

[0119] Using the above example, the first type of test application is application A in the security group of an independent VPC, and the second type of test application is application B in the security group of an interoperable VPC. Based on this, when application A sends a call request to application B, or application B sends a call request to application A, it is necessary to determine from the routing policy table whether the source IP address of the call request sent and the destination IP address receiving the call request are routed and interoperable. If so, the call request is forwarded to the destination IP address through routing; if not, the call request is discarded.

[0120] Step 306: Based on the second data transmission channel, process the second test data between the second type of test application in the second VPC and the service object in the service network.

[0121] Specifically, the process of processing the second test data based on the second data transmission channel is: determine whether the routing parameters of the second test data meet the routing policy of the second data transmission channel; if so, transmit the second test data based on the second data transmission channel; if not, discard the second test data.

[0122] Using the above example, the second type of test application is application A in the interconnected VPC, and the service object is database B in the production environment. When application A sends a call request to database B, it is necessary to determine from the routing policy table whether the source IP address of the call request sent and the destination IP address receiving the call request are interconnected. If so, the call request is forwarded to the destination IP address through routing; if not, the call request is discarded.

[0123] Further, in the embodiment provided in this specification, the processing of the second test data between the second type test application in the second VPC and the service object in the service network based on the second data transmission channel includes:

[0124] Determine second test data between the second type of test application included in the target application set in the second VPC and the service object included in the service network;

[0125] When determining that the routing parameters of the second test data satisfy the routing policy of the second data transmission channel, transmitting the second test data based on the second data transmission channel; or

[0126] When it is determined that the routing parameters of the second test data do not satisfy the routing policy of the second data transmission channel, the second test data is discarded.

[0127] Using the above example, the second type of test application is application A in the security group of the interconnected VPC, and the service object is database B in the production environment. Based on this, when application A sends a call request to database B, it is necessary to determine from the routing policy table whether the source IP address of the call request sent and the destination IP address receiving the call request are interconnected. If so, the call request is forwarded to the destination IP address through routing; if not, the call request is discarded.

[0128] The data processing method provided in this specification realizes network isolation between the first VPC and the service network by establishing a first data transmission channel between the first VPC and the second VPC, and establishing a second data transmission channel between the second VPC and the service network, and processes the first test data between the first type test application in the first VPC and the second type test application in the second VPC through the first data transmission channel, and processes the second test data between the second type test application in the second VPC and the service object in the service network based on the second data transmission channel, thereby avoiding the first test data from leaking into the service network environment, which will damage the service network environment and affect the data security of users in the service network environment. At the same time, the second VPC and the service network are interconnected through the second data transmission channel, so that the second type test application can interact with the service network, thereby successfully completing the application test.

[0129] Corresponding to the above method embodiment, this specification also provides a data processing system embodiment. Figure 4 FIG. 1 shows a schematic diagram of a data processing system provided by an embodiment of the present specification. Figure 4 As shown, the system includes a first VPC 402, a second VPC 404, and a service network 406, wherein:

[0130] The first VPC 402 and the second VPC 404 are configured to establish a first data transmission channel between the first VPC 402 and the second VPC 404, wherein the first VPC 402 includes a first type of test application, and the second VPC 404 includes a second type of test application;

[0131] The second VPC 404 and the service network 406 are configured to establish a second data transmission channel between the second VPC 404 and the service network 406, wherein the service network 406 includes a service object;

[0132] Processing, based on the first data transmission channel, first test data between the first type test application in the first VPC 402 and the second type test application in the second VPC 404;

[0133] Based on the second data transmission channel, second test data between the second type test application in the second VPC 404 and the service object in the service network 406 is processed.

[0134] It should be noted that, for the explanation of the data processing system, reference may be made to the corresponding or corresponding content in the above-mentioned data processing method embodiment, and no further details will be given here.

[0135] The data processing system provided in this specification realizes network isolation between the first VPC and the service network by establishing a first data transmission channel between the first VPC and the second VPC, and establishing a second data transmission channel between the second VPC and the service network, and processes the first test data between the first type test application in the first VPC and the second type test application in the second VPC through the first data transmission channel, and processes the second test data between the second type test application in the second VPC and the service object in the service network based on the second data transmission channel, thereby avoiding the first test data from leaking into the service network environment, which will damage the service network environment and affect the data security of users in the service network environment. At the same time, the second VPC and the service network are interconnected through the second data transmission channel, so that the second type test application can interact with the service network, thereby successfully completing the application test.

[0136] The above is a schematic scheme of a data processing system of this embodiment. It should be noted that the technical scheme of the data processing system and the technical scheme of the above data processing method belong to the same concept, and the details not described in detail in the technical scheme of the data processing system can be referred to the description of the technical scheme of the above data processing method.

[0137] Corresponding to the above method embodiment, this specification also provides a data processing device embodiment, Figure 5 FIG. 1 is a schematic diagram showing the structure of a data processing device provided by an embodiment of the present specification. Figure 5 As shown, the device comprises:

[0138] A construction module 502 is configured to establish a first data transmission channel between a first VPC and a second VPC, and to establish a second data transmission channel between the second VPC and a service network, wherein the first VPC includes a first type of test application, the second VPC includes a second type of test application, and the service network includes a service object;

[0139] A first processing module 504 is configured to process, based on the first data transmission channel, first test data between the first type test application in the first VPC and the second type test application in the second VPC;

[0140] The second processing module 506 is configured to process second test data between the second type of test application in the second VPC and the service object in the service network based on the second data transmission channel.

[0141] Optionally, the construction module 502 is further configured to:

[0142] A first data transmission channel is established between the first VPC and the second VPC based on the VPC communication network and the communication route in the VPC communication network, wherein the VPC communication network only implements data transmission between the first VPC and the second VPC.

[0143] Optionally, the construction module 502 is further configured to:

[0144] Establishing a first VPC communication channel between the VPC communication network and the first VPC by configuring a routing policy between the VPC communication network and the first VPC;

[0145] Establishing a second VPC communication channel between the VPC communication network and the second VPC by configuring a routing policy between the VPC communication network and the second VPC;

[0146] The first VPC communication channel and the second VPC communication channel are associated through the communication route in the VPC communication network, and a first data transmission channel between the first VPC and the second VPC is established.

[0147] Optionally, the construction module 502 is further configured to:

[0148] A second data transmission channel between the second VPC and the service network is established by configuring a routing policy between the second VPC and the service network.

[0149] Optionally, the data processing device further includes an application processing module configured to:

[0150] Receive an application set construction request for the first VPC, wherein the application set construction request carries at least two application set types and routing configuration parameters corresponding to the at least two application set types;

[0151] Based on the at least two application set types, construct at least two application sets in the first VPC, and based on the routing configuration parameters, adjust the routing policy of the first data transmission channel;

[0152] Determine application type information of the first type test application, determine a target application set corresponding to the application type information from the at least two application sets, and add the first type test application to the target application set.

[0153] Optionally, the application processing module is further configured to:

[0154] receiving an application set construction request for the second VPC, wherein the application set construction request carries at least two application set types and routing configuration parameters corresponding to the at least two application set types;

[0155] Based on the at least two application set types, construct at least two application sets in the second VPC, and based on the routing configuration parameters, adjust the routing policies of the first data transmission channel and the second data transmission channel;

[0156] Determine application type information of the second-type test application, determine a target application set corresponding to the application type information from the at least two application sets, and add the second-type test application to the target application set.

[0157] Optionally, the first processing module 504 is further configured to:

[0158] Determine first test data between the first type of test application included in the target application set in the first VPC and the second type of test application included in the target application set in the second VPC;

[0159] When it is determined that the routing parameters of the first test data satisfy the routing policy of the first data transmission channel, transmitting the first test data based on the first data transmission channel; or

[0160] When it is determined that the routing parameters of the first test data do not satisfy the routing policy of the first data transmission channel, the first test data is discarded.

[0161] Optionally, the second processing module 506 is further configured to:

[0162] Determine second test data between the second type of test application included in the target application set in the second VPC and the service object included in the service network;

[0163] When determining that the routing parameters of the second test data satisfy the routing policy of the second data transmission channel, transmitting the second test data based on the second data transmission channel; or

[0164] When it is determined that the routing parameters of the second test data do not satisfy the routing policy of the second data transmission channel, the second test data is discarded.

[0165] Optionally, the application processing module is further configured to:

[0166] Determine an application set tag corresponding to the target application set, and add the first type of test application to the target application set by modifying the application tag of the first type of test application to an application set tag;

[0167] Accordingly, the adding the second type test application to the target application set includes:

[0168] An application set tag corresponding to the target application set is determined, and the second type of test application is added to the target application set by modifying the application tag of the second type of test application to an application set tag.

[0169] Optionally, the application processing module is further configured to:

[0170] receiving an adjustment request for the application to be adjusted, wherein the adjustment request carries an application identifier of the application to be adjusted and a target VPC corresponding to the application to be adjusted, the application to be adjusted is the first type test application or the second type test application, and the target VPC is the first VPC or the second VPC;

[0171] An application tag of the application to be adjusted and a VPC tag corresponding to the target VPC are determined, and the application to be adjusted is added to the target VPC by modifying the application tag of the application to be adjusted to a VPC tag.

[0172] The data processing device provided in this specification realizes network isolation between the first VPC and the service network by establishing a first data transmission channel between the first VPC and the second VPC, and establishing a second data transmission channel between the second VPC and the service network, and processes the first test data between the first type test application in the first VPC and the second type test application in the second VPC through the first data transmission channel, and processes the second test data between the second type test application in the second VPC and the service object in the service network based on the second data transmission channel, thereby avoiding the first test data from leaking into the service network environment, which will damage the service network environment and affect the data security of users in the service network environment. At the same time, the second VPC and the service network are interconnected through the second data transmission channel, so that the second type test application can interact with the service network, thereby successfully completing the application test.

[0173] The above is a schematic scheme of a data processing device of this embodiment. It should be noted that the technical scheme of the data processing device and the technical scheme of the above data processing method belong to the same concept, and the details of the technical scheme of the data processing device that are not described in detail can be referred to the description of the technical scheme of the above data processing method.

[0174] Figure 6 The block diagram of a computing device 600 according to an embodiment of the present specification is shown. The components of the computing device 600 include but are not limited to a memory 610 and a processor 620. The processor 620 is connected to the memory 610 via a bus 630, and the database 650 is used to store data.

[0175] The computing device 600 also includes an access device 640 that enables the computing device 600 to communicate via one or more networks 660. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 640 may include one or more of any type of network interface (e.g., a network interface card (NIC)) whether wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a World Wide Interoperability for Microwave Access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, a near field communication (NFC) interface, and the like.

[0176] In one embodiment of the present specification, the above components of the computing device 600 and Figure 6 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 6 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0177] The computing device 600 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or PC. The computing device 600 may also be a mobile or stationary server.

[0178] The processor 620 is used to execute the following computer executable instructions, which implement the steps of the above data processing method when executed by the processor.

[0179] The above is a schematic scheme of a computing device of this embodiment. It should be noted that the technical scheme of the computing device and the technical scheme of the above data processing method belong to the same concept, and the details not described in detail in the technical scheme of the computing device can be referred to the description of the technical scheme of the above data processing method.

[0180] An embodiment of the present specification further provides a computer-readable storage medium storing computer-executable instructions, which can implement the steps of the above-mentioned data processing method when executed by a processor.

[0181] The above is a schematic scheme of a computer-readable storage medium of this embodiment. It should be noted that the technical scheme of the storage medium and the technical scheme of the above data processing method belong to the same concept, and the details not described in detail in the technical scheme of the storage medium can be referred to the description of the technical scheme of the above data processing method.

[0182] An embodiment of the present specification further provides a computer program, wherein when the computer program is executed in a computer, the computer is caused to execute the steps of the above-mentioned data processing method.

[0183] The above is a schematic scheme of a computer program of this embodiment. It should be noted that the technical scheme of the computer program and the technical scheme of the above data processing method belong to the same concept, and the details not described in detail in the technical scheme of the computer program can be referred to the description of the technical scheme of the above data processing method.

[0184] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0185] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0186] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the embodiments of this specification are not limited by the order of the actions described, because according to the embodiments of this specification, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of this specification.

[0187] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0188] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to only the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can well understand and use this specification. This specification is only limited by the claims and their full scope and equivalents.

Claims

1. A data processing method, comprising: Based on the VPC communication network and the communication routes in the VPC communication network, a first data transmission channel is established between the first VPC and the second VPC, and a second data transmission channel is established between the second VPC and the service network, wherein the first VPC includes a first type of test application, the second VPC includes a second type of test application, the service network includes a service object, and the VPC communication network only implements data transmission between the first VPC and the second VPC; Processing, based on the first data transmission channel, first test data between the first type test application in the first VPC and the second type test application in the second VPC; Based on the second data transmission channel, second test data between the second type of test application in the second VPC and the service object in the service network is processed.

2. The data processing method according to claim 1, wherein the step of establishing a first data transmission channel between the first VPC and the second VPC based on the VPC communication network and the communication route in the VPC communication network comprises: Establishing a first VPC communication channel between the VPC communication network and the first VPC by configuring a routing policy between the VPC communication network and the first VPC; Establishing a second VPC communication channel between the VPC communication network and the second VPC by configuring a routing policy between the VPC communication network and the second VPC; The first VPC communication channel and the second VPC communication channel are associated through the communication route in the VPC communication network, and a first data transmission channel between the first VPC and the second VPC is established.

3. The data processing method according to claim 1, wherein establishing a second data transmission channel between the second VPC and the service network comprises: A second data transmission channel between the second VPC and the service network is established by configuring a routing policy between the second VPC and the service network.

4. The data processing method according to claim 1, further comprising: receiving an application set construction request for the second VPC, wherein the application set construction request carries at least two application set types and routing configuration parameters corresponding to the at least two application set types; Based on the at least two application set types, construct at least two application sets in the second VPC, and based on the routing configuration parameters, adjust the routing policies of the first data transmission channel and the second data transmission channel; Determine application type information of the second-type test application, determine a target application set corresponding to the application type information from the at least two application sets, and add the second-type test application to the target application set.

5. The data processing method according to claim 1, wherein the processing, based on the second data transmission channel, of the second test data between the second type of test application in the second VPC and the service object in the service network comprises: Determine second test data between the second type of test application included in the target application set in the second VPC and the service object included in the service network; When determining that the routing parameters of the second test data meet the routing policy of the second data transmission channel, transmitting the second test data based on the second data transmission channel; or When it is determined that the routing parameters of the second test data do not satisfy the routing policy of the second data transmission channel, the second test data is discarded.

6. The data processing method according to claim 4, wherein adding the second type of test application to the target application set comprises: An application set tag corresponding to the target application set is determined, and the second type of test application is added to the target application set by modifying the application tag of the second type of test application to an application set tag.

7. The data processing method according to claim 4, further comprising: receiving an adjustment request for the application to be adjusted, wherein the adjustment request carries an application identifier of the application to be adjusted and a target VPC corresponding to the application to be adjusted, the application to be adjusted is the first type test application or the second type test application, and the target VPC is the first VPC or the second VPC; An application tag of the application to be adjusted and a VPC tag corresponding to the target VPC are determined, and the application to be adjusted is added to the target VPC by modifying the application tag of the application to be adjusted to a VPC tag.

8. A data processing system, comprising a first VPC, a second VPC, and a service network, wherein: The first VPC and the second VPC are configured to establish a first data transmission channel between the first VPC and the second VPC based on a VPC communication network and a communication route in the VPC communication network, wherein the first VPC includes a first type of test application and the second VPC includes a second type of test application; The second VPC and the service network are configured to establish a second data transmission channel between the second VPC and the service network, wherein the service network includes a service object, and the VPC communication network only implements data transmission between the first VPC and the second VPC; Processing, based on the first data transmission channel, first test data between the first type test application in the first VPC and the second type test application in the second VPC; Based on the second data transmission channel, second test data between the second type of test application in the second VPC and the service object in the service network is processed.

9. A data processing device, comprising: A building module is configured to establish a first data transmission channel between a first VPC and a second VPC, and establish a second data transmission channel between the second VPC and a service network based on a VPC communication network and a communication route in the VPC communication network, wherein the first VPC includes a first type of test application, the second VPC includes a second type of test application, the service network includes a service object, and the VPC communication network only implements data transmission between the first VPC and the second VPC; A first processing module is configured to process, based on the first data transmission channel, first test data between the first type test application in the first VPC and the second type test application in the second VPC; The second processing module is configured to process second test data between the second type test application in the second VPC and the service object in the service network based on the second data transmission channel.

10. A computing device comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the data processing method described in any one of claims 1 to 7 are implemented.

11. A computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions, when executed by a processor, implement the steps of the data processing method according to any one of claims 1 to 7.

Images