Network communication management method, device, equipment and storage medium for cloud platform

Abstract

The present invention discloses a network communication management method, system, electronic device and storage medium for a cloud platform. The method includes: for any cloud host on the cloud platform, taking the cloud host as the host to be managed, determining the target communication scenario information currently possessed by the host to be managed; determining the current management configuration information that matches the target communication scenario information based on a pre-configured communication management configuration file; performing routing configuration on the communication network of the host to be managed based on the current management configuration information and the communication attribute information of the host to be managed, obtaining routing configuration information, so that the host to be managed can perform network communication based on the routing configuration information under the target communication scenario. The above technical solution can provide accurate and effective network services for different target communication scenario information of different cloud hosts, can improve the effectiveness of communication channel determination, and realize accurate management of network communications.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a network communication management method, system, electronic device and storage medium for a cloud platform. Background Art

[0002] Cloud platforms offer services based on hardware and software resources, providing computing, networking, and storage capabilities. For cloud hosts on cloud platforms, users who need to use security products can add security instances to their own VPC networks. A security instance can be added to multiple networks during operation, resulting in multiple network adapters dynamically present within the instance. Network management of these network adapters is required.

[0003] Currently, the default network management software of the operating system can achieve automatic DHCP allocation, but the advanced network configuration corresponding to each network card relies on customization to implement. In the case of multiple network cards, simply using the default DHCP-based network management software to allocate IP addresses for network cards can easily lead to routing conflicts, thereby causing network problems. Summary of the Invention

[0004] The present invention provides a network communication management method, system, electronic device, and storage medium for a cloud platform, which can provide accurate and effective network services based on the needs of different cloud hosts for different communication scenarios.

[0005] In a first aspect, an embodiment of the present disclosure provides a network communication management method for a cloud platform, which is applied to a network management device on the cloud platform. The method includes:

[0006] For any cloud host on the cloud platform, the cloud host is taken as the host to be managed, and the target communication scenario information currently possessed by the host to be managed is determined;

[0007] Determining current management configuration information that matches the target communication scenario information based on a pre-configured communication management configuration file;

[0008] According to the current management configuration information and the communication attribute information of the host to be managed, routing configuration is performed on the communication network of the host to be managed to obtain routing configuration information so that the host to be managed can perform network communication based on the routing configuration information in the target communication scenario.

[0009] In a second aspect, an embodiment of the present disclosure provides a network communication management device for a cloud platform, comprising:

[0010] The first determination module is used to determine the target communication scenario information currently possessed by any cloud host on the cloud platform, taking the cloud host as the host to be managed;

[0011] A second determining module is used to determine current management configuration information that matches the target communication scenario information based on a pre-configured communication management configuration file;

[0012] The first acquisition module is used to perform routing configuration on the communication network of the host to be managed based on the current management configuration information and the communication attribute information of the host to be managed, and obtain routing configuration information so that the host to be managed can perform network communication based on the routing configuration information in the target communication scenario.

[0013] In a third aspect, an embodiment of the present disclosure provides an electronic device, including:

[0014] at least one processor; and

[0015] a memory communicatively connected to at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by at least one processor. The computer program is executed by at least one processor so that the at least one processor can execute the network communication management method of the cloud platform provided by any embodiment.

[0017] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium storing computer instructions, which are used to enable a processor to implement the network communication management method of the cloud platform provided by any embodiment when executed.

[0018] The embodiments of the present invention provide a network communication management method, device, equipment and storage medium for a cloud platform. By targeting any cloud host on the cloud platform, the cloud host is used as a host to be managed, and the target communication scenario information currently possessed by the host to be managed is determined; based on a pre-configured communication management configuration file, the current management configuration information that matches the target communication scenario information is determined; based on the current management configuration information, combined with the communication attribute information of the host to be managed, the communication network of the host to be managed is routed and configured to obtain routing configuration information, so that the host to be managed can perform network communication based on the routing configuration information in the target communication scenario. By adopting the above technical solution, the communication management configuration file is pre-configured, which improves the efficiency of network communication services. According to the management configuration information corresponding to each communication scenario information, the routing is configured in combination with the host attribute, so that accurate and effective network services can be provided for different target communication scenario information of different cloud hosts. The above technical solution improves the effectiveness of communication channel determination and realizes accurate management of network communications.

[0019] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 This is a flow chart of a network communication management method for a cloud platform provided in Example 1 of the present invention;

[0022] Figure 2 This is a flow chart of a network communication management method for a cloud platform provided by Embodiment 2 of the present invention;

[0023] Figure 3 This is an example diagram of topological communication between a cloud host and a business virtual host in the network communication management method of a cloud platform provided in the second embodiment of the present invention;

[0024] Figure 4 This is a schematic diagram of the structure of a network communication management device for a cloud platform provided by a third embodiment of the present invention;

[0025] Figure 5 This is a structural diagram of an electronic device provided in Example 4 of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first," "second," and "target" and the like in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or precedence. It should be understood that the numbers used in this way are interchangeable where appropriate so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having," as well as any variations thereof, are intended to cover non-exclusive inclusions. For example, a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to these processes, methods, products, or apparatus.

[0028] Example 1

[0029] Figure 1 This is a flowchart of a network communication management method for a cloud platform provided in Example 1 of the present invention. This embodiment is applicable to situations where network communication services of different hosts on a cloud platform are configured and managed. The method can be executed by a network communication management device of the cloud platform, which can be implemented in the form of hardware and / or software.

[0030] like Figure 1 As shown, the method includes:

[0031] S101: For any cloud host on the cloud platform, the cloud host is taken as a host to be managed, and target communication scenario information currently possessed by the host to be managed is determined.

[0032] In this embodiment, the cloud platform can be a cloud computing platform, which can be specifically understood as a virtual platform that provides computing, networking, and storage capabilities based on hardware and software resources. It can provide users with public Internet infrastructure services. Cloud platforms can include storage-based cloud platforms primarily focused on data storage, computing-based cloud platforms primarily focused on data processing, and comprehensive cloud computing platforms that combine computing and data storage processing.

[0033] A cloud host can be understood as a server built using virtualization technology. It is an important component of cloud computing in infrastructure applications. It integrates computing, storage, and network resources into an IT (Internet Technology) infrastructure capacity rental service. It can provide on-demand and pay-as-you-go server rental services based on the cloud computing model, and can freely customize resource utilization.

[0034] The host to be managed can be understood as a cloud host on the cloud platform that has not undergone network management.

[0035] The target communication scenario information can be understood as scenario information in which the host to be managed communicates with the target communication device.

[0036] Specifically, for any cloud host in the security resource pool on the cloud platform, the cloud host is determined as a host to be managed, and target communication scenario information between the host to be managed and the target communication device is determined.

[0037] Exemplarily, the target communication scenario information may include communication scenario information of security products, etc., and the security products may include at least WAF (Web Application Firewall) or security log service, etc.

[0038] S102: Determine current management configuration information that matches the target communication scenario information according to a pre-configured communication management configuration file.

[0039] In this embodiment, the communication management configuration file can be understood as a file storing management configuration information required for communication. The current management configuration information can be understood as instruction information input and stored by the host to be managed after determining the target communication scenario.

[0040] Specifically, a communication management configuration file is pre-configured in the host to be managed. The management configuration file can meet a variety of communication scenarios. After determining the target communication scenario of the device to be managed, the pre-configured communication management configuration file is directly searched, and the current management configuration information corresponding to the scenario information is determined based on the target communication scenario information.

[0041] S103: Perform routing configuration on the communication network of the host to be managed based on the current management configuration information and the communication attribute information of the host to be managed, and obtain routing configuration information so that the host to be managed can perform network communication based on the routing configuration information in the target communication scenario.

[0042] In this embodiment, communication attribute information can be understood as the attribute information of the hardware used to achieve interconnected communication between devices. A communication network can be a data link that physically connects isolated terminals, enabling information exchange between terminals and achieving resource sharing and communication. Routing configuration can be understood as the configuration of network routes, which can include configurations such as the addresses to which data packets flow. Routing configuration information can be understood as the content information of the routing configuration of the communication network of the host to be managed. Specific routing configuration information can be configured differently based on different communication scenarios. Users can display routing configuration information by querying the routing table of the communication network of the host to be managed.

[0043] Specifically, based on a pre-configured communication management configuration file, the corresponding management configuration information is determined based on the target communication scenario information of the managed host. Combined with the communication attribute information of the managed host, routing configuration is performed on each communication network of the managed host, and each routing configuration information is determined. Based on the routing configuration information of the communication network, the managed host can achieve network communication based on this routing configuration information in the target communication scenario.

[0044] In this embodiment, by targeting any cloud host on the cloud platform, the cloud host is used as the host to be managed, and the target communication scenario information currently possessed by the host to be managed is determined; based on the pre-configured communication management configuration file, the current management configuration information that matches the target communication scenario information is determined; based on the current management configuration information, combined with the communication attribute information of the host to be managed, the communication network of the host to be managed is routed and configured to obtain routing configuration information, so that the host to be managed can perform network communication based on the routing configuration information in the target communication scenario. By adopting the above technical solution, the communication management configuration file is pre-configured, which improves the efficiency of network communication management. According to the management configuration information corresponding to each communication scenario information, combined with the host attribute configuration routing, accurate and effective network services can be provided for different communication scenario information of different cloud hosts. The above technical solution improves the effectiveness of communication channel determination and realizes accurate management of network communications.

[0045] As a first optional embodiment of the embodiment, based on the above embodiment, this first optional embodiment further optimizes and adds: detecting the network card equipped on the host to be managed, and using the obtained network card information as communication attribute information.

[0046] In this embodiment, a network card can be a piece of computer hardware designed to allow cloud hosts to communicate on a cloud computing network, and can be connected to each other via cables or wirelessly. Each network card has a unique 48-bit serial number called a MAC (Media Access Control Address), which is written in a ROM (Read-Only Memory) on the network card. Each network card on a communication network has a unique MAC address. Network card information can be understood as the configuration information of the network card, which can include hardware information such as the network card model and network configuration information.

[0047] Specifically, the cloud host's network card can be hot-swappable, allowing it to join or leave the private network at any time. Based on the managed hosts on the cloud platform, automatic network card discovery can be used to detect the managed hosts' network cards. For example, this can be done using periodic checkpoints or by using the operating system's built-in hardware device discovery mechanism to detect and obtain network card information. This information is then used as communication attribute information.

[0048] For example, the periodic inspection logic can detect the addition or removal of network cards based on a fixed time interval. Under Linux, the increase or decrease of network cards can be determined by querying the kernel storage folder " / sys / class / net / "; the hardware device discovery mechanism of the operating system can be based on udev rules to trigger the network card management script under Linux, and the add or remove in the configuration based on udev rules can determine the addition or removal event of the network card. If the event is a new addition, the run+= assignment can be used for the network card, and a specific script can be assigned to the newly added network card, and the corresponding script can be executed on the newly added network card to use this network card.

[0049] In this optional embodiment, the network card information obtained by detecting the network card equipped on the managed host is used as communication attribute information. This technical solution effectively monitors changes such as the addition and removal of network cards, and determines the network card information of the changed network card as the communication attribute information of the managed host, laying a solid information foundation for network communication. This technical solution effectively reduces the time lag associated with changes in communication attribute information during network communication, ensuring the correctness of network communication connections.

[0050] As a second optional embodiment of the embodiment, based on the above embodiment, this second optional embodiment is further optimized and added: according to each security instance included in the security resource pool, a communication management profile containing at least one binary relationship group is determined, and the binary relationship group is a pairing of communication scenario information and management configuration information.

[0051] In this embodiment, the security resource pool on the cloud platform contains many security instances. A security resource pool can be understood as a method for managing a collection of security instances, capable of managing security instances with various security engines. A security instance can be understood as a virtual machine (VM) or cloud host with a security software engine installed. Examples of security software engines include WAFs and NGFWs (Next Generation Firewalls). A binary relationship group can be understood as a pairing relationship consisting of two sets of data information that are paired. Based on known information, a table lookup can be used to find the pairing information for that information within the binary relationship group.

[0052] Specifically, the communication management configuration file includes at least one binary relationship group, which can be a pairing relationship group of communication scenario information and management configuration information. In network communications, the corresponding management configuration information can be determined based on the communication scenario information in each binary relationship group in the communication management configuration file.

[0053] Furthermore, determining a communication management profile including at least one binary relationship group according to each security instance included in the security resource pool may include:

[0054] a1) Obtain each security instance stored in the security resource pool.

[0055] In this embodiment, a security pool stores a plurality of security instances. First, each security instance is obtained, and the type of each obtained security instance is determined.

[0056] b1) Determining associated communication scenario information by analyzing each of the security instances.

[0057] In this embodiment, according to the type of the security instance, the security software engine installed in the security instance is determined, and the type of communication scenario information involved in the operation of the security instance is determined.

[0058] c1) receiving management configuration information corresponding to each of the communication scenario information configurations.

[0059] In this embodiment, each communication scenario information has management configuration information corresponding to the communication scenario information, and the management configuration information configured for the communication scenario information is received based on each communication scenario information.

[0060] d1) forming binary relationship groups with communication scenario information and corresponding management configuration information, and forming a communication management configuration file containing each of the binary relationship groups.

[0061] In this embodiment, based on the above-mentioned received management configuration information configured relative to each communication scenario information, and each communication scenario information, a binary relationship group is constructed for each pair of communication scenario information and management configuration information with a corresponding configuration relationship, and a communication management configuration file is formed based on each binary relationship group with a corresponding configuration relationship.

[0062] In this optional embodiment, each security instance stored in the security resource pool is obtained, and through analysis of each security instance, the associated communication scenario information is determined, and the management configuration information configured relative to each communication scenario information is received. The communication scenario information and the corresponding management configuration information constitute a binary relationship group, forming a communication management configuration file containing each binary relationship group. In the above technical solution, the content of the pre-configured communication management configuration file is determined. In the communication management configuration file, there is a binary relationship group of the target communication scenario and the management configuration information. The management configuration information corresponding to the target communication scenario of the host to be managed can be directly determined based on the corresponding relationship in each binary relationship group, without the need to go through complex steps to determine the current management configuration information corresponding to the host to be managed. This effectively improves the management efficiency of cloud computing network communications.

[0063] Example 2

[0064] Figure 2 This is a flow chart of a cloud platform network communication management method provided in Example 1 of the present invention. This embodiment further optimizes any of the above embodiments. This embodiment is applicable to configuring and managing network communication services for different hosts on a cloud platform. The method can be executed by a cloud platform network communication management device, which can be implemented in hardware and / or software.

[0065] like Figure 2 As shown, the method includes:

[0066] S201: For any cloud host on the cloud platform, set the cloud host as a host to be managed.

[0067] S202: Determine the target security instance currently running on the host to be managed, and determine the communication requirements corresponding to the communication networks under various communication network types involved in the operation of the target security instance.

[0068] The target security instance can be understood as the security instance currently running on the cloud host that is being managed. The communication network type can be understood as the type of communication network. The communication requirements can be understood as the requirements required for communication on the communication network in the target security instance.

[0069] For example, communication networks may include management communication networks and service communication networks. For a communication network of management communication network type, the corresponding communication requirements may include at least single sign-on, SSH (Secure Shell) access, activation, and issuance of certificates to a security engine. For a communication network of service communication network type, the corresponding communication requirements may include at least receiving externally pushed data information.

[0070] Specifically, the security instance currently running on the host to be managed is determined as the target security instance, and based on the type of communication network involved in the operation of the target security instance, the communication requirements corresponding to that type of communication network are determined. For example, based on the management communication network running on the target security instance, the communication requirement of the management communication network may be determined to be single sign-on, and based on the service communication network running on the target security instance, the communication requirement of the service communication network may be determined to be receiving externally pushed log data, etc. This embodiment does not limit this.

[0071] S203: Based on each communication requirement, determine the target communication scenario information currently possessed by the host to be managed.

[0072] In this embodiment, the target communication scenario information is determined by combining the various communication requirements within the host to be managed. The host to be managed may include different types of communication networks, such as a management communication network and a service communication network. Based on the communication requirements corresponding to the management communication network and the communication requirements corresponding to the service communication network, the target communication scenario information currently available to the host to be managed can be determined.

[0073] For example, a management communication network might require cloud management functions such as single sign-on, activation, and certificate issuance. It only receives external requests and doesn't actively initiate connections. A business communication network might only receive external business data and forward it as a network proxy. It doesn't actively initiate connections and, when using the UDP protocol, doesn't even need to respond. The communication scenario information content can be determined based on the needs of both the management and business communication networks. For example, it could include a WAF firewall or security logging service.

[0074] S204: Determine current management configuration information that matches the target communication scenario information according to a pre-configured communication management configuration file.

[0075] S205: Analyze the current management configuration information and determine the network communication management rules included in the current management configuration information.

[0076] In this embodiment, the network communication management rules can be understood as rule information for managing network communications in the cloud platform, for example, including configuring default routing rules and / or configuring routing policies.

[0077] Specifically, configuring the default route can be based on automatic network card discovery and DHCP to obtain network configuration, combined with setting route priority to determine the default route's exit network card. Among them, automatic network card discovery can be implemented based on detecting the network card in the above embodiment, and DHCP obtains network configuration, which can be understood as the managed host obtaining information such as IP address, mask, gateway, and domain name service address through DHCP (Dynamic Host Configuration Protocol). Setting route priority can be determined by setting only a default route or by setting a route management distance (metric).

[0078] For example, only one default route is set to determine the routing priority. For example, you can set the routing priority of the communication network. The first network card eth0 is the network card of this communication network. Only the default route is set to go through the network gateway of the first network card. No default routes are set for other network cards. This effectively avoids the problem of routing conflicts caused by multiple default routes on multiple network cards.

[0079] For example, route priority is determined by setting a route management distance. In the route management distance metric policy, the smaller the distance, the higher the priority. For example, to set the route priority of a communication network, the first network card eth0 can be set as the network card for the communication network. The default route metric for the first network card eth0 can be set to 1 or no route management distance can be set. The default routes for other network cards can be set to a metric greater than 1. In this case, the network card eth0 in the communication network has the highest priority, and external traffic will only pass through the network gateway of the first network card. This effectively avoids routing conflicts.

[0080] By setting the routing priority, the default route of the communication network can be correctly configured, and the traffic of the current type of communication network will not be diverted to another communication network. This effectively avoids the situation where multiple network cards have default routes and the network card gateway for external traffic cannot be determined, resulting in network conflicts.

[0081] Specifically, configuring a routing policy can be understood as modifying routing information to change the path of network traffic. This is primarily accomplished by changing routing attributes (including reachability). For example, you can use iptables routing policies to ensure that traffic flows to and from the network interface cards are consistent, enabling accurate traffic delivery.

[0082] By configuring routing policies, you can ensure that the traffic entering and exiting the network ports are consistent, and that the network address segments have consistent addresses, thus resolving communication issues caused by network conflicts.

[0083] S206: Determine the communication network card currently possessed by the host to be managed according to the network card information included in the communication attribute information.

[0084] In this embodiment, the network card information included in the communication attributes can directly determine the type and number of communication network cards currently available. In a specific communication scenario of the host to be managed, it is determined whether the current network card is the first network card. If it is the first network card, a default route can be configured according to the network communication management rules.

[0085] S207: Perform routing configuration in combination with each communication network card according to the network communication management rule to obtain current routing configuration information of the host to be managed, so that the host to be managed can perform network communication based on the routing configuration information in the target communication scenario.

[0086] In this embodiment, based on different network communication management rules and the network routing configuration of each communication network card, the current routing configuration information of the host to be managed is obtained. The routing configuration information can be queried through the routing table to realize network communication of the host to be managed in the target communication scenario.

[0087] In this embodiment, by targeting any cloud host on the cloud platform, the cloud host is used as the host to be managed; the target security instance currently running on the host to be managed is determined, and the communication requirements corresponding to the communication network under each communication network type involved in the operation of the target security instance are determined; based on each communication requirement, the target communication scenario information currently possessed by the host to be managed is determined; based on the pre-configured communication management configuration file, the current management configuration information matching the target communication scenario information is determined; the current management configuration information is parsed to determine the network communication management rules contained in the current management configuration information; based on the network card information included in the communication attribute information, the communication network card currently possessed by the host to be managed is determined; based on the network communication management rules, routing configuration is performed in combination with each communication network card to obtain the current routing configuration information of the host to be managed, so that the host to be managed can perform network communication based on the routing configuration information in the target communication scenario. Using the above technical solution, network routing configuration is performed in combination with the communication network card according to the network communication management rules, effectively avoiding routing conflicts between network cards and conflicts between networks. The above technical solution solves the problem of network communication failure caused by communication network conflicts and can realize basic network services for various network requirements of different cloud platforms.

[0088] As a first optional embodiment of the embodiment, based on the above embodiment, this first optional embodiment further optimizes and adds the step of obtaining the management communication network routing configuration information on the host to be managed, which may specifically include:

[0089] a2) determining a target management network card corresponding to the management communication network on the host to be managed from each of the communication network cards.

[0090] In this embodiment, the target management network card is specifically understood as a network card on the cloud host that enables the management communication network to communicate. There may be multiple network cards on the host to be managed. Based on the target communication scenario information and network card information, the network card corresponding to the management communication network is determined among the network cards as the target management network card.

[0091] b2) configuring the network gateway of the target management network card as the default routing information on the host to be managed, and recording it as the current routing configuration information of the host to be managed.

[0092] In this embodiment, a network gateway can be understood as an IP address connecting one network to another. There are multiple types of gateways according to different classification standards. In this embodiment, gateways can include gateways under the TCP / IP (Transmission Control Protocol / Internet Protocol) protocol and gateways under the UDP (User Datagram Protocol) protocol, etc., but this embodiment does not limit this.

[0093] Specifically, the gateway of the target management network card of the management communication network is configured as the default route of the host to be managed. No default route is set for other network cards. At this time, the host to be managed has only one default route for the management communication network. The routing configuration information is recorded and stored, and the specific content of the routing configuration information can be found by querying the routing table.

[0094] Exemplarily, eth0 is used as the target management network card for managing the communication network, and the default route is configured to go through the eth0 network card. For example, if the gateway of the network card is 10.73.14.1, then 10.73.14.1 can be configured as the default route.

[0095] c2) determining the routing management distances of the target management network card and the remaining communication network cards according to a set distance determination rule, and constructing the current routing configuration information of the host to be managed based on the set routing management distances.

[0096] In this embodiment, the distance determination rule set in the network communication management rule can be understood as a metric policy for routing management distance, in which the smaller the metric distance, the higher the priority.

[0097] For example, eth0 is used as the target management network card for the management communication network. The default route metric for eth0 is set to 1, and the default routes for other communication network cards are set to metrics greater than 1, for example, eth1's metric is set to 2, and eth2's metric is set to 3. In this case, eth0, the target management network card for the management communication network, has the highest priority, and external traffic will only go through the network gateway of eth0, the target management network card. This effectively avoids routing conflicts.

[0098] In this embodiment, by setting the routing priority, the default route of the communication network can be correctly configured, and the only network card through which the traffic sent to the outside flows out can be determined, which solves the problem that the traffic of the current type of communication network goes to another communication network, and effectively avoids the situation where multiple network cards have default routes and the network card gateway through which the traffic sent to the outside flows cannot be determined, resulting in network conflicts.

[0099] As a second optional embodiment of the embodiment, based on the above embodiment, this second optional embodiment further optimizes and adds the step of obtaining the service communication network routing configuration information on the host to be managed, which may specifically include:

[0100] a3) determining target service network cards corresponding to the service communication network on the host to be managed from the communication network cards.

[0101] In this embodiment, the target service network card is specifically understood to be a network card on the cloud host that enables communication over the service communication network. The managed host may have multiple service network cards. Based on the target communication scenario information and network card information, the network card corresponding to the service communication network is determined from among the network cards as the target service network card.

[0102] b3) determining the service virtual host corresponding to each target service network card according to the receiving path of the data packet received by the host to be managed.

[0103] In this embodiment, a data packet can be understood as the multiple data blocks into which a single message is divided in a switching network. These data blocks, called packets, contain the sender and receiver address information. Data packets are transmitted along different paths across one or more networks and reassembled at the destination. The receiving path can be understood as the path along which the managed host receives data packets sent from the service virtual host. The service virtual host can be understood as the corresponding virtual host on the cloud platform that conducts service communications with the managed host.

[0104] On the cloud platform, the security resource pool contains many security instances. When users need to use security products, they can add security instances to their own VPC (Virtual Private Cloud) networks. A security instance can be added to multiple business communication networks during operation. Therefore, the managed host dynamically has multiple network adapters, which communicate with both the cloud security management and control platform (the management communication network) and the user's VPC network (the business communication network).

[0105] Specifically, according to the receiving path of the data packet received by the host to be managed, the data packet sending end at the other end of the path is determined, and the data packet sending end is determined as the service virtual host corresponding to the target service network card.

[0106] c3) determining the data packet tag of each target service network card based on the host identifier of each service virtual host.

[0107] The host identifier can be understood as a unique identification number of the service virtual host, and the service virtual host can be determined based on the unique host identifier. The data packet marking can be understood as marking the data packets transmitted between the management host and the service virtual host.

[0108] Exemplarily, the data packet tag may be a Mark tag, which is a digital tag printed on the kernel data packet, for example, may be represented by a 16-bit or 32-bit integer.

[0109] Under the iptables routing configuration, data packets entering eth1 are marked with 0x1, and data packets entering eth2 are marked with 0x2. The marks of these data packets are saved in the connection record. When the security engine processes the data and needs to respond, the mark of the data packet is restored from the connection record so that the data packet can be routed correctly.

[0110] Figure 3 This is an example diagram of the topological communication between the cloud host and the business virtual host in the network communication management method of the cloud platform provided in the second embodiment of the present invention. Figure 3 As shown in the figure, in a TCP connection, the cloud host currently being managed has four network cards: eth0 is the management communication network card, and eth1, eth2, and eth3 are all service communication network cards. eth1 generates service communications with service virtual host 1, eth2 with service virtual host 2, and eth3 with service virtual host 3. eth1 and eth3 are network cards for vpc1, and eth2 is a network card for vpc2. The IP addresses of eth1 and eth2 are the same, network1, for example, 172.17.0.5. The IP address of eth3 is another address, network2. The security instance listens on TCP port 5.

[0111] Specifically, in the service network 172.17.0.0 / 24 of vpc1, there is a service virtual host 1, whose IP address might be 172.17.0.2. When accessing 172.17.0.5 on the same network, traffic will flow through eth1, with the packet marked with mark=1 (i.e., 0x1 (hexadecimal) in the above embodiment). At this point, after the packet sent by service virtual host 1 accesses eth1 via TCP port 5, the packet is marked with 1 based on the iptables routing policy. This means that the packet returning to the service virtual host can be returned along the original path, rather than being sent out through other network cards using the default route.

[0112] In vpc2's service network 172.17.0.0 / 24, there is a service virtual host 2 with the IP address 172.17.0.2. When accessing 172.17.0.5 on the same network, traffic will be routed through eth2, with the packet marked with "mark = 2," which is equivalent to 0x2 in the above example. At this point, after the packet sent from service virtual host 2 reaches eth2 via TCP port 5, it will be marked with "2" based on the iptables routing policy. This means that the packet will return to the service virtual host along the original path, rather than being routed out of another NIC using the default route.

[0113] In this example, eth1 and eth2 have identical network address segments and IP addresses, but their initiators and targets are different. The initiators are two business virtual hosts in different VPC networks, while the targets are two different business communication network cards in a single cloud host, both in different VPC networks. Routing policies can still be used to tag packets, ensuring consistent round-trip paths and clearly identifying the target network card's gateway address. This avoids network conflicts caused by different inbound and outbound network cards, ensuring that packets are sent and received correctly.

[0114] d3) Determining the routing information table of each target service network card based on each data packet tag.

[0115] In this embodiment, a routing table can be understood as a spreadsheet (file) or database-like structure stored in a router or cloud host. The routing table stores the paths to specific network addresses. Routing rules specify packet tags corresponding to specific routing tables.

[0116] For example, in the configuration of routing rules, data packets marked with 0x1 are configured to go through routing table 1, data packets marked with 0x2 are configured to go through routing table 2, and other data packets are configured according to the system default routing rules.

[0117] e3) using each of the routing information tables as the current routing configuration information of the host to be managed.

[0118] In this embodiment, the routing information tables determined based on the data packet tags can be determined as the current routing configuration information of the host to be managed.

[0119] In this embodiment, the service communication network is configured with iptables routing policies, enabling each service virtual host to send and receive data packets normally and correctly even when the network address segments and IP addresses are identical. By adopting the technical solution of this embodiment, the inbound and outbound traffic of the current communication network can be consistent, and the network address segments can be consistent, thus resolving the problem of communication failure caused by network conflicts.

[0120] Example 3

[0121] Figure 4 This is a schematic diagram of the structure of a network communication management device for a cloud platform provided by the third embodiment of the present invention. Figure 4 As shown, the device includes a first determining module 31 , a second determining module 32 and a first acquiring module 33 .

[0122] The first determining module 31 is configured to determine target communication scenario information currently possessed by any cloud host on the cloud platform, taking the cloud host as a host to be managed;

[0123] A second determining module 32 is configured to determine current management configuration information matching the target communication scenario information based on a pre-configured communication management configuration file;

[0124] The first acquisition module 33 is used to perform routing configuration on the communication network of the host to be managed based on the current management configuration information and the communication attribute information of the host to be managed, and obtain routing configuration information so that the host to be managed can perform network communication based on the routing configuration information in the communication scenario.

[0125] By adopting the technical solution of this embodiment, communication management profiles are preconfigured, improving the efficiency of network communication management. By configuring routing based on the management configuration information corresponding to each communication scenario and combining it with host attributes, accurate and effective network services can be provided for the different communication scenarios of different cloud hosts. This improves the effectiveness of communication channel determination and enables precise management of network communications.

[0126] The device also includes a third determining module, which is used to determine a communication management configuration file including at least one binary relationship group according to each security instance included in the security resource pool, wherein the binary relationship group is a pairing of communication scenario information and management configuration information.

[0127] Optionally, the third determining module is specifically configured to:

[0128] Obtain each security instance stored in the security resource pool;

[0129] Determining associated communication scenario information by analyzing each of the security instances;

[0130] Receiving management configuration information corresponding to each of the communication scenario information configurations;

[0131] The communication scenario information and the corresponding management configuration information constitute a binary relationship group, and a communication management configuration file containing each of the binary relationship groups is formed.

[0132] Optionally, the first determining module 31 is specifically configured to:

[0133] Determine the target security instance currently running on the host to be managed, and determine the communication requirements corresponding to the communication networks under each communication network type involved in the operation of the target security instance;

[0134] Based on each of the communication requirements, target communication scenario information currently possessed by the host to be managed is determined.

[0135] Optionally, the first acquisition module 33 includes:

[0136] a first determining unit, configured to parse the current management configuration information and determine the network communication management rules contained in the current management configuration information;

[0137] A second determining unit is configured to determine a communication network card currently possessed by the host to be managed according to the network card information included in the communication attribute information;

[0138] The first acquisition unit is configured to perform routing configuration according to the network communication management rule and in combination with each of the communication network cards to obtain current routing configuration information of the host to be managed.

[0139] Optionally, the first acquiring unit is specifically configured to:

[0140] Determining a target management network card corresponding to the management communication network on the host to be managed from each of the communication network cards;

[0141] Configuring the network gateway of the target management network card as the default routing information on the host to be managed, and recording it as the current routing configuration information of the host to be managed; or

[0142] According to the set distance determination rule, the routing management distances of the target management network card and the remaining communication network cards are determined, and the current routing configuration information of the host to be managed is constructed based on the set routing management distances.

[0143] Optionally, the first acquiring unit is further configured to:

[0144] Determine, from the communication network cards, the target service network cards corresponding to the service communication network on the host to be managed;

[0145] Determining the service virtual host corresponding to each target service network card according to the receiving path of the data packet received by the host to be managed;

[0146] Determining the data packet tag of each target service network card based on the host identifier of each service virtual host;

[0147] Determine the routing information table of each target service network card based on each data packet tag;

[0148] Each of the routing information tables is used as the current routing configuration information of the host to be managed.

[0149] The network communication management device for the cloud platform provided in the embodiment of the present invention can execute the network communication management method for the cloud platform provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0150] Example 4

[0151] Figure 5 A structural diagram of an electronic device provided for embodiment four of the present invention. The electronic device 40 can be understood as a network management device applied to a cloud platform, and is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0152] like Figure 5 As shown, the electronic device 40 includes at least one processor 41, and a memory connected to the at least one processor 41, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 41 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 42 or the computer program loaded from the storage unit 48 to the random access memory (RAM) 43. In RAM 43, various programs and data required for the operation of the network communication management device 40 of the cloud platform can also be stored. The processor 41, ROM 42 and RAM 43 are connected to each other via a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0153] Multiple components in the electronic device 40 are connected to the I / O interface 45, including an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a magnetic disk, an optical disk, etc.; and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0154] Processor 41 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors that run machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. Processor 41 executes the various methods and processes described above, such as the network communication management method for the cloud platform.

[0155] In some embodiments, the network communication management method of the cloud platform can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 48. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 40 via the ROM 42 and / or the communication unit 49. When the computer program is loaded into the RAM 43 and executed by the processor 41, one or more steps of the network communication management method of the cloud platform described above can be performed. Alternatively, in other embodiments, the processor 41 can be configured to execute the network communication management method of the cloud platform by any other appropriate means (for example, by means of firmware).

[0156] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0157] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0158] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0159] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0160] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0161] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0162] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0163] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A network communication management method for a cloud platform, characterized in that: Applied to network management devices on cloud platforms, including: For any cloud host on the cloud platform, the cloud host is used as a host to be managed, and target communication scenario information currently possessed by the host to be managed is determined, wherein the target communication scenario information includes a network application firewall (WAF) or a security log service; Determining, based on a pre-configured communication management configuration file, current management configuration information that matches the target communication scenario information; Performing routing configuration on the communication network of the host to be managed according to the current management configuration information and in combination with the communication attribute information of the host to be managed, and obtaining routing configuration information so that the host to be managed can perform network communication based on the routing configuration information in a target communication scenario; The step of performing routing configuration on the communication network of the host to be managed based on the current management configuration information and in combination with the communication attribute information of the host to be managed to obtain routing configuration information includes: Parsing the current management configuration information to determine the network communication management rules contained in the current management configuration information; Determining the communication network card currently possessed by the host to be managed according to the network card information included in the communication attribute information; According to the network communication management rules, in combination with each of the communication network cards, routing configuration is performed to obtain the current routing configuration information of the host to be managed; Wherein, when the routing configuration information is the routing configuration information for managing the communication network, performing routing configuration according to the network communication management rules in combination with each of the communication network cards to obtain the current routing configuration information of the host to be managed includes: Determining a target management network card corresponding to the management communication network on the host to be managed from each of the communication network cards; Configuring the network gateway of the target management network card as the default routing information on the host to be managed, and recording it as the current routing configuration information of the host to be managed; or Determine the routing management distances of the target management network card and the remaining communication network cards according to the set distance determination rules, and form the current routing configuration information of the host to be managed based on the set routing management distances; Wherein, when the routing configuration information is the routing configuration information of the service communication network, performing routing configuration according to the network communication management rules in combination with each of the communication network cards to obtain the current routing configuration information of the host to be managed includes: Determine, from the communication network cards, the target service network cards corresponding to the service communication network on the host to be managed; Determining the service virtual host corresponding to each target service network card according to the receiving path of the data packet received by the host to be managed; Determining the data packet tag of each target service network card based on the host identifier of each service virtual host; Determine the routing information table of each target service network card based on each data packet tag; Each of the routing information tables is used as the current routing configuration information of the host to be managed.

2. The method according to claim 1, characterized in that Also includes: The network card equipped on the host to be managed is detected, and the obtained network card information is used as the communication attribute information.

3. The method according to claim 1, characterized in that Also includes: According to each security instance included in the security resource pool, a communication management configuration file including at least one binary relationship group is determined, where the binary relationship group includes a pairing of communication scenario information and management configuration information.

4. The method according to claim 3, characterized in that The step of determining, based on each security instance included in the security resource pool, a communication management profile including at least one binary relationship group, includes: Obtain each security instance stored in the security resource pool; Determining associated communication scenario information by analyzing each of the security instances; Receiving management configuration information corresponding to each of the communication scenario information configurations; The communication scenario information and the corresponding management configuration information constitute a binary relationship group, and a communication management configuration file containing each of the binary relationship groups is formed.

5. The method according to claim 1, wherein The determining of target communication scenario information currently possessed by the host to be managed includes: Determine the target security instance currently running on the host to be managed, and determine the communication requirements corresponding to the communication networks under each communication network type involved in the operation of the target security instance; Based on each of the communication requirements, target communication scenario information currently possessed by the host to be managed is determined.

6. A network communication management device for a cloud platform, characterized in that: include: The first determination module is configured to determine, for any cloud host on the cloud platform, target communication scenario information currently possessed by the host to be managed, using the cloud host as the host to be managed, wherein the target communication scenario information is a network application firewall (WAF) or a security log service; A second determining module is configured to determine current management configuration information that matches the target communication scenario information based on a pre-configured communication management configuration file; A first acquisition module is configured to perform routing configuration on the communication network of the host to be managed based on the current management configuration information and the communication attribute information of the host to be managed, and obtain routing configuration information so that the host to be managed can perform network communication based on the routing configuration information in a communication scenario; The first acquisition module includes: a first determining unit, configured to parse the current management configuration information and determine the network communication management rules contained in the current management configuration information; A second determining unit is configured to determine a communication network card currently possessed by the host to be managed according to the network card information included in the communication attribute information; A first acquiring unit is configured to perform routing configuration according to the network communication management rule and in combination with each of the communication network cards to obtain current routing configuration information of the host to be managed; The first acquiring unit is specifically configured to: Determining a target management network card corresponding to the management communication network on the host to be managed from each of the communication network cards; Configuring the network gateway of the target management network card as the default routing information on the host to be managed, and recording it as the current routing configuration information of the host to be managed; or Determine the routing management distances of the target management network card and the remaining communication network cards according to the set distance determination rules, and form the current routing configuration information of the host to be managed based on the set routing management distances; The first acquiring unit is further configured to: Determine, from the communication network cards, the target service network cards corresponding to the service communication network on the host to be managed; Determining the service virtual host corresponding to each target service network card according to the receiving path of the data packet received by the host to be managed; Determining the data packet tag of each target service network card based on the host identifier of each service virtual host; Determine the routing information table of each target service network card based on each data packet tag; Each of the routing information tables is used as the current routing configuration information of the host to be managed.

7. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the network communication management method of the cloud platform according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the network communication management method for the cloud platform according to any one of claims 1 to 5 when executed.

Images